Refactor and cleanup duplicate code in the isc_hmac functions

Resolve "New cppcheck-detected errors"

See merge request isc-projects/bind9!324

CHANGES

@@ -1,5 +1,30 @@
+4955.	[cleanup]	Silence cppcheck warnings in lib/dns/master.c.
+			[GL #286]
+
+4954.	[func]		Messages about serving of stale answers are now
+			directed to the "serve-stale" logging category.
+			Also clarified serve-stale documentation. [GL !323]
+
+4953.	[bug]		Removed the option to build the red black tree
+			database without a hash table; the non-hashing
+			version was buggy and is not needed. [GL #184]
+
+4952.	[func]		Authoritative server support in named for the
+			EDNS CLIENT-SUBNET option (which was experimental
+			and not practical to deploy) has been removed.
+
+			The ECS option is still supported in dig and mdig
+			via the +subnet option, and can be parsed and logged
+			when received by named, but it is no longer used
+			for ACL processing. The "geoip-use-ecs" option
+			is now obsolete; a warning will be logged if it is
+			used in named.conf. "ecs" tags in an ACL definition
+			are also obsolete and will cause the configuration
+			to fail to load.  [GL #32]
+
 4951.	[protocol]	Add "HOME.ARPA" to list of built in empty zones as
 			per RFC 8375. [GL #273]
+
 	--- 9.13.0 released ---
 
 4950.	[bug]		ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238]

README

@@ -99,11 +99,19 @@ format-patch.
 
 BIND 9.13 features
 
-BIND 9.13.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.12 and earlier releases. New features
-include:
+BIND 9.13 is the newest development branch of BIND 9. It includes a number
+of changes from BIND 9.12 and earlier releases. New features include:
 
-  * TBD
+  * Support for IDNA2008 when linking with libidn2.
+  * "Root key sentinel" support, enabling validating resolvers to indicate
+    via a special query which trust anchors are configured for the root
+    zone.
+
+In addition, cryptographic support has been modernized. BIND now uses the
+best available pseudo-random number generator for the platform on which
+it's built. Very old versions of OpenSSL are no longer supported.
+Cryptography is now mandatory; building BIND without DNSSEC is now longer
+supported.
 
 Building BIND
 

README.md

@@ -116,11 +116,19 @@ including your patch as an attachment, preferably generated by
 
 ### <a name="features"/> BIND 9.13 features
 
-BIND 9.13.0 is the newest development branch of BIND 9. It includes a
+BIND 9.13 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:
 
-* TBD
+* Support for IDNA2008 when linking with `libidn2`.
+* "Root key sentinel" support, enabling validating resolvers to indicate
+  via a special query which trust anchors are configured for the root zone.
+
+In addition, cryptographic support has been modernized. BIND now uses the
+best available pseudo-random number generator for the platform on which
+it's built. Very old versions of OpenSSL are no longer supported.
+Cryptography is now mandatory; building BIND without DNSSEC is now
+longer supported.
 
 ### <a name="build"/> Building BIND
 

bin/dig/dig.c

@@ -1933,7 +1933,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			{
 				debug("config line %s", batchline);
 				bargc = split_batchline(batchline, bargv, 62,
-						        ".digrc argv");
+							".digrc argv");
 				bargv[0] = argv[0];
 				argv0 = argv[0];
 				parse_args(ISC_TRUE, ISC_TRUE,

bin/named/controlconf.c

@@ -230,13 +230,12 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {
 
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
 
-	result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, acl, env, &match,
-			       NULL);
-
-	if (result != ISC_R_SUCCESS || match <= 0)
+	result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL);
+	if (result != ISC_R_SUCCESS || match <= 0) {
 		return (ISC_FALSE);
-	else
+	} else {
 		return (ISC_TRUE);
+	}
 }
 
 static isc_result_t

bin/named/server.c

@@ -28,7 +28,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/httpd.h>
 #include <isc/lex.h>
 #include <isc/meminfo.h>
@@ -3613,8 +3613,7 @@ create_mapped_acl(void) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = dns_iptable_addprefix(acl->iptable, &addr, 96,
-				       ISC_TRUE, ISC_FALSE);
+	result = dns_iptable_addprefix(acl->iptable, &addr, 96, ISC_TRUE);
 	if (result == ISC_R_SUCCESS)
 		dns_acl_attach(acl, &named_g_mapped);
 	dns_acl_detach(&acl);
@@ -4094,7 +4093,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj = NULL;
 	result = named_config_get(maps, "max-stale-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	max_stale_ttl = cfg_obj_asuint32(obj);
+	max_stale_ttl = ISC_MAX(cfg_obj_asuint32(obj), 1);
 
 	obj = NULL;
 	result = named_config_get(maps, "stale-answer-enable", &obj);
@@ -6262,7 +6261,7 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
 			return (result);
 
 		result = dns_iptable_addprefix(src_acl->iptable, &netaddr,
-					       128, ISC_TRUE, ISC_FALSE);
+					       128, ISC_TRUE);
 		if (result != ISC_R_SUCCESS)
 			goto clean;
 
@@ -7910,11 +7909,6 @@ load_configuration(const char *filename, named_server_t *server,
 		named_geoip_load(NULL);
 	}
 	named_g_aclconfctx->geoip = named_g_geoip;
-
-	obj = NULL;
-	result = named_config_get(maps, "geoip-use-ecs", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	env->geoip_use_ecs = cfg_obj_asboolean(obj);
 #endif /* HAVE_GEOIP */
 
 	/*
@@ -9266,7 +9260,7 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
  */
 static isc_result_t
 get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-		  dns_message_t *message, dns_aclenv_t *env, dns_ecs_t *ecs,
+		  dns_message_t *message, dns_aclenv_t *env,
 		  isc_result_t *sigresult, dns_view_t **viewp)
 {
 	dns_view_t *view;
@@ -9283,9 +9277,6 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 		    message->rdclass == dns_rdataclass_any)
 		{
 			dns_name_t *tsig = NULL;
-			isc_netaddr_t *addr = NULL;
-			isc_uint8_t *scope = NULL;
-			isc_uint8_t source = 0;
 
 			*sigresult = dns_message_rechecksig(message, view);
 			if (*sigresult == ISC_R_SUCCESS) {
@@ -9295,15 +9286,9 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 				tsig = dns_tsigkey_identity(tsigkey);
 			}
 
-			if (ecs != NULL) {
-				addr = &ecs->addr;
-				source = ecs->source;
-				scope = &ecs->scope;
-			}
-
-			if (dns_acl_allowed(srcaddr, tsig, addr, source,
-					    scope, view->matchclients, env) &&
-			    dns_acl_allowed(destaddr, tsig, NULL, 0, NULL,
+			if (dns_acl_allowed(srcaddr, tsig,
+					    view->matchclients, env) &&
+			    dns_acl_allowed(destaddr, tsig,
 					    view->matchdestinations, env) &&
 			    !(view->matchrecursiveonly &&
 			      (message->flags & DNS_MESSAGEFLAG_RD) == 0))
@@ -14420,7 +14405,6 @@ mkey_destroy(named_server_t *server, dns_view_t *view, isc_buffer_t **text) {
 	return (result);
 }
 
-
 static isc_result_t
 mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 	isc_result_t result;

bin/named/statschannel.c

@@ -3196,8 +3196,8 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	isc_netaddr_fromsockaddr(&netaddr, fromaddr);
 
 	LOCK(&listener->lock);
-	if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, listener->acl, env,
-			  &match, NULL) == ISC_R_SUCCESS && match > 0)
+	if ((dns_acl_match(&netaddr, NULL, listener->acl, env,
+			   &match, NULL) == ISC_R_SUCCESS) && match > 0)
 	{
 		UNLOCK(&listener->lock);
 		return (ISC_TRUE);

bin/named/zoneconf.c

@@ -815,11 +815,12 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 			tsig = dns_tsigkey_identity(mykey);
 		}
 
-		if (dns_acl_allowed(&netsrc, tsig, NULL, 0, NULL,
-				    view->matchclients, env) &&
-		    dns_acl_allowed(&netdst, tsig, NULL, 0, NULL,
-				    view->matchdestinations, env))
+		if (dns_acl_allowed(&netsrc, tsig, view->matchclients, env) &&
+		    dns_acl_allowed(&netdst, tsig, view->matchdestinations,
+				    env))
+		{
 			break;
+		}
 	}
 	return (ISC_TF(view == myview));
 }

bin/rndc/rndc.docbook

@@ -785,20 +785,28 @@
       </varlistentry>
 
       <varlistentry>
-	<term><userinput>serve-stale ( on | off | status | reset ) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
+	<term><userinput>serve-stale ( on | off | reset | status ) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
 	<listitem>
 	  <para>
-	    Enable, disable, or reset the serving of stale answers
-	    as configured in named.conf. Serving of stale answers
-	    will remain disabled across <filename>named.conf</filename>
-	    reloads if disabled via rndc until it is reset via rndc.
+	    Enable, disable, reset, or report the current status
+            of the serving of stale answers as configured in
+            <filename>named.conf</filename>.
 	  </para>
 	  <para>
-	    Status will report whether serving of stale answers is
-	    currently enabled, disabled or not configured for a
-	    view.  If serving of stale records is configured then
-	    the values of stale-answer-ttl and max-stale-ttl are
-	    reported.
+            If serving of stale answers is disabled by
+            <command>rndc-serve-stale off</command>, then it
+	    will remain disabled even if <command>named</command>
+            is reloaded or reconfigured.
+            <command>rndc serve-stale reset</command> restores
+            the setting as configured in <filename>named.conf</filename>.
+	  </para>
+	  <para>
+	    <command>rndc serve-stale status</command> will report
+            whether serving of stale answers is currently enabled,
+            disabled by the configuration, or disabled by
+            <command>rndc</command>.  It will also report the
+	    values of <command>stale-answer-ttl</command> and
+	    <command>max-stale-ttl</command>.
 	  </para>
 	</listitem>
       </varlistentry>

bin/tests/optional/.gitignore

@@ -0,0 +1,5 @@
+/backtrace_test.dSYM/
+/backtrace_test0.dSYM/
+/backtrace_test_nosymtbl
+/backtrace_test_nosymtbl.dSYM/
+/nsecify

bin/tests/optional/hash_test.c

@@ -15,8 +15,7 @@
 #include <stdio.h>
 #include <string.h>
 
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/md5.h>
 #include <isc/sha1.h>
 #include <isc/util.h>
@@ -105,7 +104,7 @@ main(int argc, char **argv) {
 	isc_hmacmd5_init(&hmacmd5, key, 16);
 	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-	isc_hmacmd5_sign(&hmacmd5, digest);
+	isc_hmacmd5_sign(&hmacmd5, digest, ISC_MD5_DIGESTLENGTH);
 	print_digest(s, "hmacmd5", digest, 4);
 
 	s = "what do ya want for nothing?";
@@ -113,7 +112,7 @@ main(int argc, char **argv) {
 	isc_hmacmd5_init(&hmacmd5, key, 4);
 	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-	isc_hmacmd5_sign(&hmacmd5, digest);
+	isc_hmacmd5_sign(&hmacmd5, digest, ISC_MD5_DIGESTLENGTH);
 	print_digest(s, "hmacmd5", digest, 4);
 
 	s = "\335\335\335\335\335\335\335\335\335\335"
@@ -125,7 +124,7 @@ main(int argc, char **argv) {
 	isc_hmacmd5_init(&hmacmd5, key, 16);
 	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
-	isc_hmacmd5_sign(&hmacmd5, digest);
+	isc_hmacmd5_sign(&hmacmd5, digest, ISC_MD5_DIGESTLENGTH);
 	print_digest(s, "hmacmd5", digest, 4);
 #endif
 

bin/tests/system/acl/ns2/named6.conf.in

@@ -1,50 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-options {
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-	ixfr-from-differences yes;
-	check-integrity no;
-	allow-query-on { 10.53.0.2; };
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
-
-zone "example" {
-	type master;
-	file "example.db";
-};
-
-zone "tsigzone" {
-	type master;
-	file "tsigzone.db";
-	allow-transfer { ecs 10.53/16; !10/8; };
-};

bin/tests/system/acl/ns2/named7.conf.in

@@ -1,60 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-options {
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-	ixfr-from-differences yes;
-	check-integrity no;
-	allow-query-on { 10.53.0.2; };
-};
-
-view one {
-	match-clients { ecs 192.0.2/24; };
-
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
-
-	zone "example" {
-		type master;
-		file "example.db";
-	};
-};
-
-view two {
-	zone "." {
-		type hint;
-		file "../../common/root.hint";
-	};
-
-	zone "example" {
-		type master;
-		file "example.db";
-	};
-};

bin/tests/system/acl/tests.sh

@@ -144,36 +144,6 @@ $DIG -p ${PORT} +tcp soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.${t}
 grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
-echo_i "testing EDNS client-subnet ACL processing"
-copy_setports ns2/named6.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
-sleep 5
-
-# should fail
-t=`expr $t + 1`
-$DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
-
-# should succeed
-t=`expr $t + 1`
-$DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 +subnet="10.53.0/24" axfr > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
-
-echo_i "testing EDNS client-subnet response scope"
-copy_setports ns2/named7.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
-sleep 5
-
-t=`expr $t + 1`
-$DIG -p ${PORT} example. soa @10.53.0.2 +subnet="10.53.0.1/32" > dig.out.${t}
-grep "CLIENT-SUBNET.*10.53.0.1/32/0" dig.out.${t} > /dev/null || { echo_i "test $t failed" ; status=1; }
-
-t=`expr $t + 1`
-$DIG -p ${PORT} example. soa @10.53.0.2 +subnet="192.0.2.128/32" > dig.out.${t}
-grep "CLIENT-SUBNET.*192.0.2.128/32/24" dig.out.${t} > /dev/null || { echo_i "test $t failed" ; status=1; }
-
 # AXFR tests against ns3
 
 echo_i "testing allow-transfer ACLs against ns3 (no existing zones)"

bin/tests/system/catz/clean.sh

@@ -17,8 +17,8 @@ rm -f ns*/named.run
 rm -f ns1/*dom*example.db
 rm -f ns2/__catz__*db
 rm -f ns2/named.conf.tmp
-rm -f ns3/dom{13,14}.example.db
+rm -f ns3/dom13.example.db ns3/dom14.example.db
 rm -f nsupdate.out.*
-rm -f ns{1,2,3}/catalog{1,2,3,4}.example.db
+rm -f ns[123]/catalog[1234].example.db
 rm -rf ns2/zonedir
 rm -f ns*/*.nzd ns*/*.nzd-lock

bin/tests/system/checkconf/bad-geoip-use-ecs.conf

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	geoip-use-ecs yes;
+};

bin/tests/system/checkconf/tests.sh

@@ -396,5 +396,13 @@ grep "trusted-key for dlv.isc.org still present" checkconf.out$n > /dev/null ||
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
+echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
+ret=0
+$CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1
+[ -s checkconf.out$n ] || ret=1
+grep "'geoip-use-ecs' is obsolete" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/checkconf/warn-geoip-use-ecs.conf

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	geoip-use-ecs no;
+};

bin/tests/system/conf.sh.in

@@ -163,7 +163,7 @@ NZD=@NZD_TOOLS@
 #
 # Set up color-coded test output
 #
-if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 ; then
+if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
     COLOR_END=`tput setaf 4`    # blue
     COLOR_FAIL=`tput setaf 1`   # red
     COLOR_INFO=`tput bold`      # bold

bin/tests/system/geoip/ns2/named14.conf.in

@@ -21,7 +21,6 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	geoip-directory "../data";
-	geoip-use-ecs no;
 };
 
 key rndc_key {

bin/tests/system/geoip/tests.sh

@@ -35,30 +35,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking GeoIP country database by code (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "checking response scope using client subnet ($n)"
-ret=0
-$DIG +tcp -p ${PORT} @10.53.0.2 txt example -b 127.0.0.1 +subnet="10.53.0.1/32" > dig.out.ns2.test$n.1 || ret=1
-grep 'CLIENT-SUBNET.*10.53.0.1/32/32' dig.out.ns2.test$n.1 > /dev/null || ret=1
-$DIG +tcp -p ${PORT} @10.53.0.2 txt example -b 127.0.0.1 +subnet="192.0.2.64/32" > dig.out.ns2.test$n.2 || ret=1
-grep 'CLIENT-SUBNET.*192.0.2.64/32/24' dig.out.ns2.test$n.2 > /dev/null || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 echo_i "reloading server"
 copy_setports ns2/named2.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -137,20 +113,6 @@ done
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo_i "checking GeoIP region database (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
-
 echo_i "reloading server"
 copy_setports ns2/named6.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -182,20 +144,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking GeoIP city database (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 echo_i "reloading server"
 copy_setports ns2/named7.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -215,20 +163,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking GeoIP isp database (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 echo_i "reloading server"
 copy_setports ns2/named8.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -248,20 +182,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking GeoIP org database (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 echo_i "reloading server"
 copy_setports ns2/named9.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -281,20 +201,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking GeoIP asnum database (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 echo_i "reloading server"
 copy_setports ns2/named10.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -314,20 +220,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking GeoIP asnum database - ASNNNN only (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 echo_i "reloading server"
 copy_setports ns2/named11.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -347,20 +239,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking GeoIP domain database (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 echo_i "reloading server"
 copy_setports ns2/named12.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -380,20 +258,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking GeoIP netspeed database (using client subnet) ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4; do
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 echo_i "reloading server"
 copy_setports ns2/named13.conf.in ns2/named.conf
 $RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
@@ -426,30 +290,6 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-echo_i "reloading server"
-copy_setports ns2/named14.conf.in ns2/named.conf
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
-sleep 3
-
-n=`expr $n + 1`
-echo_i "checking geoip-use-ecs ($n)"
-ret=0
-lret=0
-for i in 1 2 3 4 5 6 7; do
-    $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
-    [ "$i" = "$j" ] || lret=1
-    [ $lret -eq 1 ] && break
-
-    $DIG $DIGOPTS txt example -b 127.0.0.1 +subnet="10.53.0.$i/32" > dig.out.ns2.test$n.ecs.$i || lret=1
-    j=`cat dig.out.ns2.test$n.ecs.$i | tr -d '"'`
-    [ "$j" = "bogus" ] || lret=1
-    [ $lret -eq 1 ] && break
-done
-[ $lret -eq 1 ] && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "reloading server with different geoip-directory ($n)"
 copy_setports ns2/named15.conf.in ns2/named.conf

bin/tests/system/rootkeysentinel/ns3/hint.db

@@ -1,2 +1,11 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 .                       NS      a.root-servers.nil.
 a.root-servers.nil.     A       10.53.0.1

bin/tests/system/rootkeysentinel/ns4/hint.db

@@ -1,2 +1,11 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 .                       NS      a.root-servers.nil.
 a.root-servers.nil.     A       10.53.0.1

contrib/dnsperf-2.1.0.0-1/dns.c

@@ -42,8 +42,7 @@
 
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -388,7 +387,7 @@ hmac_sign(perf_dnstsigkey_t *tsigkey, hmac_ctx_t *ctx, unsigned char *digest,
 {
 	switch (tsigkey->hmactype) {
 	case TSIG_HMACMD5:
-		isc_hmacmd5_sign(&ctx->hmacmd5, digest);
+		isc_hmacmd5_sign(&ctx->hmacmd5, digest, digestlen);
 		break;
 	case TSIG_HMACSHA1:
 		isc_hmacsha1_sign(&ctx->hmacsha1, digest, digestlen);

doc/arm/Bv9ARM-book.xml

@@ -3833,6 +3833,7 @@ notrace</command>. All debugging messages in the server have a debug
     syslog daemon;
     // only send priority info and higher
     severity info;
+};
 
 channel default_debug {
     // write to named.run in the working directory
@@ -5348,12 +5349,13 @@ options {
 		Specifies the TTL to be returned on stale answers.
 		The default is 1 second. The minimum allowed is
 		also 1 second; a value of 0 will be updated silently
-		to 1 second.  For stale answers to be returned,
-		they must be enabled (either in the configuration file
-		using <command>stale-answer-enable</command> or via
-		<command>rndc</command>), and
-		<option>max-stale-ttl</option> must be set to a
-		nonzero value.
+		to 1 second.
+	      </para>
+	      <para>
+		For stale answers to be returned, they must be enabled,
+		either in the configuration file using
+		<command>stale-answer-enable</command> or via
+		<command>rndc serve-stale on</command>.
 	      </para>
 	    </listitem>
 	  </varlistentry>
@@ -5794,12 +5796,9 @@ options {
 	      <term><command>geoip-use-ecs</command></term>
 	      <listitem>
 		<para>
-		  When BIND is compiled with GeoIP support and configured
-		  with "geoip" ACL elements, this option indicates whether
-		  the EDNS Client Subnet option, if present in a request,
-		  should be used for matching against the GeoIP database.
-		  The default is
-		  <command>geoip-use-ecs</command> <userinput>yes</userinput>.
+		  This option was part of an experimental implementation
+		  of the EDNS CLIENT-SUBNET for authoritative servers,
+		  but is now obsolete.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -6100,18 +6099,28 @@ options {
 	      <term><command>stale-answer-enable</command></term>
 	      <listitem>
 		<para>
-		  Enable the returning of stale answers when the
-		  nameservers for the zone are not answering.  This
-		  is off by default, but can be enabled/disabled via
-		  <command>rndc serve-stale on</command> and
-		  <command>rndc serve-stale off</command>, which
-		  override the <filename>named.conf</filename>
-		  setting.  <command>rndc serve-stale reset</command>
+		  Enable the returning of "stale" cached answers when
+		  the nameservers for a zone are not answering.  The
+		  default is not to return stale answers.
+		</para>
+		<para>
+		  Stale answers can also be enabled or disabled at
+		  runtime via <command>rndc serve-stale on</command> or
+		  <command>rndc serve-stale off</command>; these
+		  override the configured setting.
+		  <command>rndc serve-stale reset</command>
 		  restores the setting to the one specified in
-		  <filename>named.conf</filename>.  Note that
-		  reloading or reconfiguring <command>named</command>
-		  will not re-enable serving of stale records if they
-		  have been disabled via <command>rndc</command>.
+		  <filename>named.conf</filename>.  Note that if
+		  stale answers have been disabled by <command>rndc</command>,
+		  then they cannot be re-enabled by reloading or
+		  reconfiguring <command>named</command>;
+		  they must be re-enabled with
+		  <command>rndc serve-stale on</command>,
+		  or the server must be restarted.
+		</para>
+		<para>
+		  Information about stale answers is logged under
+		  the <command>serve-stale</command> log category.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -8903,19 +8912,21 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      <term><command>max-stale-ttl</command></term>
 	      <listitem>
 		<para>
-		  Sets the maximum time for which the server will
+		  If stale answers are enabled,
+		  <command>max-stale-ttl</command>
+		  sets the maximum time for which the server will
 		  retain records past their normal expiry to
 		  return them as stale records when the servers
-		  for those records are not reachable.  The default
-		  is to not retain the record.
+		  for those records are not reachable.
+		  The default is 1 week. The minimum allowed is
+		  1 second; a value of 0 will be updated silently
+		  to 1 second.
 		</para>
 		<para>
-		  <command>rndc serve-stale</command> can be used
-		  to disable and re-enable the serving of stale
-		  records at runtime.  Reloading or reconfiguring
-		  <command>named</command> will not re-enable serving
-		  of stale records if they have been disabled via
-		  <command>rndc</command>.
+		  For stale answers to be returned, they must be enabled,
+		  either in the configuration file using
+		  <command>stale-answer-enable</command> or via
+		  <command>rndc serve-stale on</command>.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -16711,37 +16722,8 @@ zone "example.com" {
 	  In addition to network addresses and prefixes, which are
 	  matched against the source address of the DNS request, ACLs
 	  may include <option>key</option> elements, which specify the
-	  name of a TSIG or SIG(0) key, or <option>ecs</option>
-	  elements, which specify a network prefix but are only matched
-	  if that prefix matches an EDNS client subnet option included
-	  in the request.
+	  name of a TSIG or SIG(0) key.
 	</para>
-	<para>
-	  The EDNS Client Subnet (ECS) option is used by a recursive
-	  resolver to inform an authoritative name server of the network
-	  address block from which the original query was received, enabling
-	  authoritative servers to give different answers to the same
-	  resolver for different resolver clients.  An ACL containing
-	  an element of the form
-	  <command>ecs <replaceable>prefix</replaceable></command>
-	  will match if a request arrives in containing an ECS option
-	  encoding an address within that prefix.  If the request has no
-	  ECS option, then "ecs" elements are simply ignored.  Addresses
-	  in ACLs that are not prefixed with "ecs" are matched only
-	  against the source address.
-	</para>
-	<note>
-	  <simpara>
-	    (Note: The authoritative ECS implementation in
-	    <command>named</command> is based on an early version of the
-	    specification, and is known to have incompatibilities with
-	    other implementations.  It is also inefficient, requiring
-	    a separate view for each client subnet to be sent different
-	    answers, and it is unable to correct for overlapping subnets in
-	    the configuration.  It can be used for testing purposes, but is
-	    not recommended for production use.)
-	  </simpara>
-	</note>
 	<para>
 	  When <acronym>BIND</acronym> 9 is built with GeoIP support,
 	  ACLs can also be used for geographic access restrictions.
@@ -16786,14 +16768,6 @@ zone "example.com" {
 	  database if it is installed, or the "region" database if it is
 	  installed, or the "country" database, in that order.
 	</para>
-	<para>
-	  By default, if a DNS query includes an EDNS Client Subnet (ECS)
-	  option which encodes a non-zero address prefix, then GeoIP ACLs
-	  will be matched against that address prefix.  Otherwise, they
-	  are matched against the source address of the query.  To
-	  prevent GeoIP ACLs from matching against ECS options, set
-	  the <command>geoip-use-ecs</command> to <literal>no</literal>.
-	</para>
 	<para>
 	  Some example GeoIP ACLs:
 	</para>

doc/arm/Makefile.in

@@ -15,9 +15,11 @@ top_srcdir =	@top_srcdir@
 
 MANOBJS = Bv9ARM.html notes.html
 
+TXTOBJS = notes.txt
+
 PDFOBJS = Bv9ARM.pdf notes.pdf
 
-doc man:: ${MANOBJS} ${PDFOBJS}
+doc man:: ${MANOBJS} ${TXTOBJS} ${PDFOBJS}
 
 clean::
 	rm -f Bv9ARM.aux Bv9ARM.brf Bv9ARM.glo Bv9ARM.idx Bv9ARM.toc
@@ -42,6 +44,11 @@ notes.pdf: notes-wrapper.xml notes.xml releaseinfo.xml pkgversion.xml noteversio
 	${XSLTPROC} ${top_srcdir}/doc/xsl/pre-latex.xsl notes-wrapper.xml | \
 	${DBLATEX} -c notes.conf -Pdoc.layout="mainmatter" -o notes.pdf -
 
+notes.txt: notes.html
+	${W3M} -dump -cols 75 -O ascii -T text/html < notes.html | \
+		sed 's/  *$$//' | \
+		sed -e :a -e '/^\n*$$/{$$d;N;};/\n$$/ba' > notes.txt
+
 # use xmllint to process include
 Bv9ARM.html: Bv9ARM-book.xml releaseinfo.xml pkgversion.xml noteversion.xml
 	expand Bv9ARM-book.xml | ${XMLLINT} --xinclude - | \

doc/arm/logging-categories.xml

@@ -315,6 +315,17 @@
 	  </para>
 	</entry>
       </row>
+      <row rowsep="0">
+	<entry colname="1">
+	  <para><command>serve-stale</command></para>
+	</entry>
+	<entry colname="2">
+	  <para>
+	    Whether or not a stale answer is used
+	    following a resolver failure.
+	  </para>
+	</entry>
+      </row>
       <row rowsep="0">
 	<entry colname="1">
 	  <para><command>spill</command></para>

doc/arm/notes.txt

@@ -0,0 +1,148 @@
+Release Notes for BIND Version 9.13.0
+
+Introduction
+
+BIND 9.13 is an unstable development release of BIND. This document
+summarizes new features and functional changes that have been introduced
+on this branch. With each development release leading up to the stable
+BIND 9.14 release, this document will be updated with additional features
+added and bugs fixed.
+
+Note on Version Numbering
+
+Prior to BIND 9.13, new feature development releases were tagged as
+"alpha" and "beta", leading up to the first stable release for a given
+development branch, which always ended in ".0".
+
+Now, however, BIND has adopted the "odd-unstable/even-stable" release
+numbering convention. There will be no "alpha" or "beta" releases in the
+9.13 branch, only increasing version numbers. So, for example, what would
+previously have been called 9.13.0a1, 9.13.0a2, 9.13.0b1, and so on, will
+instead be called 9.13.0, 9.13.1, 9.13.2, etc.
+
+The first stable release from this development branch will be renamed as
+9.14.0. Thereafter, maintenance releases will continue on the 9.14 branch,
+while unstable feature development proceeds in 9.15.
+
+Download
+
+The latest versions of BIND 9 software can always be found at http://
+www.isc.org/downloads/. There you will find additional information about
+each release, source code, and pre-compiled versions for Microsoft Windows
+operating systems.
+
+Security Fixes
+
+  * None.
+
+New Features
+
+  * BIND now can be compiled against the libidn2 library to add IDNA2008
+    support. Previously, BIND supported IDNA2003 using the (now obsolete
+    and unsupported) idnkit-1 library.
+
+  * named now supports the "root key sentinel" mechanism. This enables
+    validating resolvers to indicate to which trust anchors are configured
+    for the root, so that information about root key rollover status can
+    be gathered. To disable this feature, add root-key-sentinel no; to
+    named.conf.
+
+  * The dnskey-sig-validity option allows the sig-validity-interval to be
+    overriden for signatures covering DNSKEY RRsets. [GL #145]
+
+Removed Features
+
+  * dnssec-keygen can no longer generate HMAC keys for TSIG
+    authentication. Use tsig-keygen to generate these keys. [RT #46404]
+
+  * Support for OpenSSL 0.9.x has been removed. OpenSSL version 1.0.0 or
+    greater, or LibreSSL is now required.
+
+  * The configure --enable-seccomp option, which formerly turned on
+    system-call filtering on Linux, has been removed. [GL #93]
+
+  * IPv4 addresses in forms other than dotted-quad are no longer accepted
+    in master files. [GL #13] [GL #56]
+
+  * IDNA2003 support via (bundled) idnkit-1.0 has been removed.
+
+  * The "rbtdb64" database implementation (a parallel implementation of
+    "rbt") has been removed. [GL #217]
+
+  * The -r randomdev option to explicitly select random device has been
+    removed from the ddns-confgen, rndc-confgen, nsupdate, dnssec-confgen,
+    and dnssec-signzone commands.
+
+    The -p option to use pseudo-random data has been removed from the
+    dnssec-signzone command.
+
+Feature Changes
+
+  * BIND will now always use the best CSPRNG (cryptographically-secure
+    pseudo-random number generator) available on the platform where it is
+    compiled. It will use arc4random() family of functions on BSD
+    operating systems, getrandom() on Linux and Solaris, CryptGenRandom on
+    Windows, and the selected cryptography provider library (OpenSSL or
+    PKCS#11) as the last resort. [GL #221]
+
+  * BIND can no longer be built without DNSSEC support. A cryptography
+    provder (i.e., OpenSSL or a hardware service module with PKCS#11
+    support) must be available. [GL #244]
+
+  * Zone types primary and secondary are now available as synonyms for
+    master and slave, respectively, in named.conf.
+
+  * named will now log a warning if the old root DNSSEC key is explicitly
+    configured and has not been updated. [RT #43670]
+
+  * dig +nssearch will now list name servers that have timed out, in
+    addition to those that respond. [GL #64]
+
+  * dig +noidnin can be used to disable IDN processing on the input domain
+    name, when BIND is compiled with IDN support.
+
+  * Up to 64 response-policy zones are now supported by default;
+    previously the limit was 32. [GL #123]
+
+  * Several configuration options for time periods can now use TTL value
+    suffixes (for example, 2h or 1d) in addition to an integer number of
+    seconds. These include fstrm-set-reopen-interval, interface-interval,
+    max-cache-ttl, max-ncache-ttl, max-policy-ttl, and min-update-interval
+    . [GL #203]
+
+Bug Fixes
+
+  * None.
+
+License
+
+BIND is open source software licenced under the terms of the Mozilla
+Public License, version 2.0 (see the LICENSE file for the full text).
+
+The license requires that if you make changes to BIND and distribute them
+outside your organization, those changes must be published under the same
+license. It does not require that you publish or disclose anything other
+than the changes you have made to our software. This requirement does not
+affect anyone who is using BIND, with or without modifications, without
+redistributing it, nor anyone redistributing BIND without changes.
+
+Those wishing to discuss license compliance may contact ISC at https://
+www.isc.org/mission/contact/.
+
+End of Life
+
+BIND 9.13 is an unstable development branch. When its development is
+complete, it will be renamed to BIND 9.14, which will be a stable branch.
+
+The end of life date for BIND 9.14 has not yet been determined. For those
+needing long term support, the current Extended Support Version (ESV) is
+BIND 9.11, which will be supported until at least December 2021. See
+https://www.isc.org/downloads/software-support-policy/ for details of
+ISC's software support policy.
+
+Thank You
+
+Thank you to everyone who assisted us in making this release possible. If
+you would like to contribute to ISC to assist us in continuing to make
+quality open source software, please visit our donations page at http://
+www.isc.org/donate/.

doc/arm/notes.xml

@@ -84,7 +84,7 @@
       <listitem>
 	<para>
 	  <command>named</command> now supports the "root key sentinel"
-	  mechanism. This enables validating resolvers to indicate to
+	  mechanism. This enables validating resolvers to indicate
 	  which trust anchors are configured for the root, so that
 	  information about root key rollover status can be gathered.
 	  To disable this feature, add
@@ -104,6 +104,28 @@
 
   <section xml:id="relnotes_removed"><info><title>Removed Features</title></info>
     <itemizedlist>
+      <listitem>
+	<para>
+	  <command>named</command> can no longer use the EDNS CLIENT-SUBNET
+	  option for view selection.  In its existing form, the authoritative
+	  ECS feature was not fully RFC-compliant, and could not realistically
+	  have been deployed in production for an authoritative server; its
+	  only practical use was for testing and experimentation. In the
+	  interest of code simplification, this feature has now been removed.
+	</para>
+	<para>
+	  The ECS option is still supported in <command>dig</command> and
+	  <command>mdig</command> via the +subnet argument, and can be parsed
+	  and logged when received by <command>named</command>, but
+	  it is no longer used for ACL processing. The
+	  <command>geoip-use-ecs</command> option is now obsolete;
+	  a warning will be logged if it is used in
+	  <filename>named.conf</filename>.
+	  <command>ecs</command> tags in an ACL definition are
+	  also obsolete, and will cause the configuration to fail to
+	  load if they are used. [GL #32]
+	</para>
+      </listitem>
       <listitem>
 	<para>
 	  <command>dnssec-keygen</command> can no longer generate HMAC

doc/design/db_rules

@@ -6,7 +6,6 @@ Here is a more formal statement of the important database design
 rules.  Each rule has a 5 character mnemonic, for use in source code
 comments.
 
-
 Reference Safety						[DBREF]
 
 	1)	Any node reference retrieved from the database shall remain

doc/dev/tests

@@ -5,7 +5,6 @@ See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
 We do hourly test builds of the bind9 tree.  This is an attempt to
 document how they work.
 
-
 * How things work
 
 The scripts driving the build system are in ~wpk/b9t.  They are now

lib/bind9/check.c

@@ -1602,6 +1602,17 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 			result = ISC_R_RANGE;
 	}
 
+	obj = NULL;
+	(void)cfg_map_get(options, "geoip-use-ecs", &obj);
+	if (obj != NULL && cfg_obj_asboolean(obj)) {
+		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+			    "'geoip-use-ecs yes': "
+			    "ECS can no longer be used in geoip ACLs");
+		if (result == ISC_R_SUCCESS) {
+			result = ISC_R_FAILURE;
+		}
+	}
+
 	return (result);
 }
 

lib/dns/acl.c

@@ -100,8 +100,7 @@ dns_acl_anyornone(isc_mem_t *mctx, isc_boolean_t neg, dns_acl_t **target) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = dns_iptable_addprefix(acl->iptable, NULL, 0, ISC_TF(!neg),
-				       ISC_FALSE);
+	result = dns_iptable_addprefix(acl->iptable, NULL, 0, ISC_TF(!neg));
 	if (result != ISC_R_SUCCESS) {
 		dns_acl_detach(&acl);
 		return (result);
@@ -183,9 +182,6 @@ dns_acl_isnone(dns_acl_t *acl)
 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr,
 	      const dns_name_t *reqsigner,
-	      const isc_netaddr_t *ecs,
-	      isc_uint8_t ecslen,
-	      isc_uint8_t *scope,
 	      const dns_acl_t *acl,
 	      const dns_aclenv_t *env,
 	      int *match,
@@ -202,7 +198,6 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 
 	REQUIRE(reqaddr != NULL);
 	REQUIRE(matchelt == NULL || *matchelt == NULL);
-	REQUIRE(ecs != NULL || scope == NULL);
 
 	if (env != NULL && env->match_mapped &&
 	    addr->family == AF_INET6 &&
@@ -214,7 +209,7 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 
 	/* Always match with host addresses. */
 	bitlen = (addr->family == AF_INET6) ? 128 : 32;
-	NETADDR_TO_PREFIX_T(addr, pfx, bitlen, ISC_FALSE);
+	NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
 
 	/* Assume no match. */
 	*match = 0;
@@ -224,53 +219,17 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 
 	/* Found a match. */
 	if (result == ISC_R_SUCCESS && node != NULL) {
-		int off = ISC_RADIX_OFF(&pfx);
-		match_num = node->node_num[off];
-		if (*(isc_boolean_t *) node->data[off])
+		int fam = ISC_RADIX_FAMILY(&pfx);
+		match_num = node->node_num[fam];
+		if (*(isc_boolean_t *) node->data[fam]) {
 			*match = match_num;
-		else
+		} else {
 			*match = -match_num;
+		}
 	}
 
 	isc_refcount_destroy(&pfx.refcount);
 
-	/*
-	 * If ecs is not NULL, we search the radix tree again to
-	 * see if we find a better match on an ECS node
-	 */
-	if (ecs != NULL) {
-		node = NULL;
-		addr = ecs;
-
-		if (env != NULL && env->match_mapped &&
-		    addr->family == AF_INET6 &&
-		    IN6_IS_ADDR_V4MAPPED(&addr->type.in6))
-		{
-			isc_netaddr_fromv4mapped(&v4addr, addr);
-			addr = &v4addr;
-		}
-
-		NETADDR_TO_PREFIX_T(addr, pfx, ecslen, ISC_TRUE);
-
-		result = isc_radix_search(acl->iptable->radix, &node, &pfx);
-		if (result == ISC_R_SUCCESS && node != NULL) {
-			int off = ISC_RADIX_OFF(&pfx);
-			if (match_num == -1 ||
-			    node->node_num[off] < match_num)
-			{
-				match_num = node->node_num[off];
-				if (scope != NULL)
-					*scope = node->bit;
-				if (*(isc_boolean_t *) node->data[off])
-					*match = match_num;
-				else
-					*match = -match_num;
-			}
-		}
-
-		isc_refcount_destroy(&pfx.refcount);
-	}
-
 	/* Now search non-radix elements for a match with a lower node_num. */
 	for (i = 0; i < acl->length; i++) {
 		dns_aclelement_t *e = &acl->elements[i];
@@ -280,8 +239,7 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 			break;
 		}
 
-		if (dns_aclelement_match(reqaddr, reqsigner, ecs, ecslen,
-					 scope, e, env, matchelt))
+		if (dns_aclelement_match(reqaddr, reqsigner, e, env, matchelt))
 		{
 			if (match_num == -1 || e->node_num < match_num) {
 				if (e->negative)
@@ -418,9 +376,6 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos)
 isc_boolean_t
 dns_aclelement_match(const isc_netaddr_t *reqaddr,
 		     const dns_name_t *reqsigner,
-		     const isc_netaddr_t *ecs,
-		     isc_uint8_t ecslen,
-		     isc_uint8_t *scope,
 		     const dns_aclelement_t *e,
 		     const dns_aclenv_t *env,
 		     const dns_aclelement_t **matchelt)
@@ -428,11 +383,6 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr,
 	dns_acl_t *inner = NULL;
 	int indirectmatch;
 	isc_result_t result;
-#ifdef HAVE_GEOIP
-	const isc_netaddr_t *addr = NULL;
-#endif
-
-	REQUIRE(ecs != NULL || scope == NULL);
 
 	switch (e->type) {
 	case dns_aclelementtype_keyname:
@@ -464,17 +414,15 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr,
 	case dns_aclelementtype_geoip:
 		if (env == NULL || env->geoip == NULL)
 			return (ISC_FALSE);
-		addr = (env->geoip_use_ecs && ecs != NULL) ? ecs : reqaddr;
-		return (dns_geoip_match(addr, scope, env->geoip,
-					&e->geoip_elem));
+		return (dns_geoip_match(reqaddr, env->geoip, &e->geoip_elem));
 #endif
 	default:
 		/* Should be impossible. */
 		INSIST(0);
 	}
 
-	result = dns_acl_match(reqaddr, reqsigner, ecs, ecslen, scope,
-			       inner, env, &indirectmatch, matchelt);
+	result = dns_acl_match(reqaddr, reqsigner, inner, env,
+			       &indirectmatch, matchelt);
 	INSIST(result == ISC_R_SUCCESS);
 
 	/*
@@ -566,28 +514,28 @@ is_insecure(isc_prefix_t *prefix, void **data) {
 	 * If all nonexistent or negative then this node is secure.
 	 */
 	if ((data[0] == NULL || !* (isc_boolean_t *) data[0]) &&
-	    (data[1] == NULL || !* (isc_boolean_t *) data[1]) &&
-	    (data[2] == NULL || !* (isc_boolean_t *) data[2]) &&
-	    (data[3] == NULL || !* (isc_boolean_t *) data[3]))
+	    (data[1] == NULL || !* (isc_boolean_t *) data[1]))
+	{
 		return;
+	}
 
 	/*
-	 * If a loopback address found and the other family and
-	 * ecs entry doesn't exist or is negative, return.
+	 * If a loopback address found and the other family
+	 * entry doesn't exist or is negative, return.
 	 */
 	if (prefix->bitlen == 32 &&
 	    htonl(prefix->add.sin.s_addr) == INADDR_LOOPBACK &&
-	    (data[1] == NULL || !* (isc_boolean_t *) data[1]) &&
-	    (data[2] == NULL || !* (isc_boolean_t *) data[2]) &&
-	    (data[3] == NULL || !* (isc_boolean_t *) data[3]))
+	    (data[1] == NULL || !* (isc_boolean_t *) data[1]))
+	{
 		return;
+	}
 
 	if (prefix->bitlen == 128 &&
 	    IN6_IS_ADDR_LOOPBACK(&prefix->add.sin6) &&
-	    (data[0] == NULL || !* (isc_boolean_t *) data[0]) &&
-	    (data[2] == NULL || !* (isc_boolean_t *) data[2]) &&
-	    (data[3] == NULL || !* (isc_boolean_t *) data[3]))
+	    (data[0] == NULL || !* (isc_boolean_t *) data[0]))
+	{
 		return;
+	}
 
 	/* Non-negated, non-loopback */
 	insecure_prefix_found = ISC_TRUE;	/* LOCKED */
@@ -659,18 +607,18 @@ dns_acl_isinsecure(const dns_acl_t *a) {
  */
 isc_boolean_t
 dns_acl_allowed(isc_netaddr_t *addr, dns_name_t *signer,
-		isc_netaddr_t *ecs_addr, isc_uint8_t ecs_addrlen,
-		isc_uint8_t *ecs_scope, dns_acl_t *acl, dns_aclenv_t *aclenv)
+		dns_acl_t *acl, dns_aclenv_t *aclenv)
 {
 	int match;
 	isc_result_t result;
 
-	if (acl == NULL)
+	if (acl == NULL) {
 		return (ISC_TRUE);
-	result = dns_acl_match(addr, signer, ecs_addr, ecs_addrlen,
-			       ecs_scope, acl, aclenv, &match, NULL);
-	if (result == ISC_R_SUCCESS && match > 0)
+	}
+	result = dns_acl_match(addr, signer, acl, aclenv, &match, NULL);
+	if (result == ISC_R_SUCCESS && match > 0) {
 		return (ISC_TRUE);
+	}
 	return (ISC_FALSE);
 }
 
@@ -692,7 +640,6 @@ dns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env) {
 	env->match_mapped = ISC_FALSE;
 #ifdef HAVE_GEOIP
 	env->geoip = NULL;
-	env->geoip_use_ecs = ISC_FALSE;
 #endif
 	return (ISC_R_SUCCESS);
 
@@ -711,7 +658,6 @@ dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
 	t->match_mapped = s->match_mapped;
 #ifdef HAVE_GEOIP
 	t->geoip = s->geoip;
-	t->geoip_use_ecs = s->geoip_use_ecs;
 #endif
 }
 

lib/dns/dispatch.c

@@ -1127,8 +1127,7 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
 	 */
 	isc_netaddr_fromsockaddr(&netaddr, &ev->address);
 	if (disp->mgr->blackhole != NULL &&
-	    dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
-			  disp->mgr->blackhole,
+	    dns_acl_match(&netaddr, NULL, disp->mgr->blackhole,
 			  NULL, &match, NULL) == ISC_R_SUCCESS &&
 	    match > 0)
 	{

lib/dns/dns64.c

@@ -9,7 +9,6 @@
  * information regarding copyright ownership.
  */
 
-
 #include <config.h>
 
 #include <isc/list.h>
@@ -138,8 +137,8 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 		return (DNS_R_DISALLOWED);
 
 	if (dns64->clients != NULL) {
-		result = dns_acl_match(reqaddr, reqsigner, NULL, 0, NULL,
-				       dns64->clients, env, &match, NULL);
+		result = dns_acl_match(reqaddr, reqsigner, dns64->clients,
+				       env, &match, NULL);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		if (match <= 0)
@@ -152,8 +151,8 @@ dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 
 		memmove(&ina.s_addr, a, 4);
 		isc_netaddr_fromin(&netaddr, &ina);
-		result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
-				       dns64->mapped, env, &match, NULL);
+		result = dns_acl_match(&netaddr, NULL, dns64->mapped,
+				       env, &match, NULL);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		if (match <= 0)
@@ -227,8 +226,8 @@ dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 		 * Work out if this dns64 structure applies to this client.
 		 */
 		if (dns64->clients != NULL) {
-			result = dns_acl_match(reqaddr, reqsigner, NULL, 0,
-					       NULL, dns64->clients, env,
+			result = dns_acl_match(reqaddr, reqsigner,
+					       dns64->clients, env,
 					       &match, NULL);
 			if (result != ISC_R_SUCCESS)
 				continue;
@@ -266,8 +265,7 @@ dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
 				memmove(&in6.s6_addr, rdata.data, 16);
 				isc_netaddr_fromin6(&netaddr, &in6);
 
-				result = dns_acl_match(&netaddr, NULL, NULL,
-						       0, NULL,
+				result = dns_acl_match(&netaddr, NULL,
 						       dns64->excluded, env,
 						       &match, NULL);
 				if (result == ISC_R_SUCCESS && match <= 0) {

lib/dns/dst_api.c

@@ -33,7 +33,7 @@
 #include <isc/buffer.h>
 #include <isc/dir.h>
 #include <isc/fsaccess.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -1875,7 +1875,7 @@ static isc_result_t
 algorithm_status(unsigned int alg) {
 	REQUIRE(dst_initialized == ISC_TRUE);
 
-	if (dst_algorithm_supported(alg)) {		
+	if (dst_algorithm_supported(alg)) {
 		return (ISC_R_SUCCESS);
 	}
 	return (DST_R_UNSUPPORTEDALG);

lib/dns/dst_internal.h

@@ -38,8 +38,7 @@
 #include <isc/sha1.h>
 #include <isc/sha2.h>
 #include <isc/stdtime.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 
 #include <pk11/site.h>
 

lib/dns/geoip.c

@@ -67,7 +67,6 @@ typedef struct geoip_state {
 	unsigned int family;
 	isc_uint32_t ipnum;
 	geoipv6_t ipnum6;
-	isc_uint8_t scope;
 	GeoIPRecord *record;
 	GeoIPRegion *region;
 	const char *text;
@@ -159,7 +158,7 @@ clean_state(geoip_state_t *state) {
 
 static isc_result_t
 set_state(unsigned int family, isc_uint32_t ipnum, const geoipv6_t *ipnum6,
-	  isc_uint8_t scope, dns_geoip_subtype_t subtype, GeoIPRecord *record,
+	  dns_geoip_subtype_t subtype, GeoIPRecord *record,
 	  GeoIPRegion *region, char *name, const char *text, int id)
 {
 	geoip_state_t *state = NULL;
@@ -201,7 +200,6 @@ set_state(unsigned int family, isc_uint32_t ipnum, const geoipv6_t *ipnum6,
 
 	state->family = family;
 	state->subtype = subtype;
-	state->scope = scope;
 	state->record = record;
 	state->region = region;
 	state->name = name;
@@ -248,12 +246,10 @@ get_state_for(unsigned int family, isc_uint32_t ipnum,
 static const char *
 country_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 	       unsigned int family,
-	       isc_uint32_t ipnum, const geoipv6_t *ipnum6,
-	       isc_uint8_t *scope)
+	       isc_uint32_t ipnum, const geoipv6_t *ipnum6)
 {
 	geoip_state_t *prev_state = NULL;
 	const char *text = NULL;
-	GeoIPLookup gl;
 
 	REQUIRE(db != NULL);
 
@@ -266,40 +262,35 @@ country_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 	prev_state = get_state_for(family, ipnum, ipnum6);
 	if (prev_state != NULL && prev_state->subtype == subtype) {
 		text = prev_state->text;
-		if (scope != NULL)
-			*scope = prev_state->scope;
 	}
 
 	if (text == NULL) {
 		switch (subtype) {
 		case dns_geoip_country_code:
 			if (family == AF_INET)
-				text = GeoIP_country_code_by_ipnum_gl(db,
-								 ipnum, &gl);
+				text = GeoIP_country_code_by_ipnum(db, ipnum);
 #ifdef HAVE_GEOIP_V6
 			else
-				text = GeoIP_country_code_by_ipnum_v6_gl(db,
-								 *ipnum6, &gl);
+				text = GeoIP_country_code_by_ipnum_v6(db,
+								      *ipnum6);
 #endif
 			break;
 		case dns_geoip_country_code3:
 			if (family == AF_INET)
-				text = GeoIP_country_code3_by_ipnum_gl(db,
-								 ipnum, &gl);
+				text = GeoIP_country_code3_by_ipnum(db, ipnum);
 #ifdef HAVE_GEOIP_V6
 			else
-				text = GeoIP_country_code3_by_ipnum_v6_gl(db,
-								 *ipnum6, &gl);
+				text = GeoIP_country_code3_by_ipnum_v6(db,
+								       *ipnum6);
 #endif
 			break;
 		case dns_geoip_country_name:
 			if (family == AF_INET)
-				text = GeoIP_country_name_by_ipnum_gl(db,
-								 ipnum, &gl);
+				text = GeoIP_country_name_by_ipnum(db, ipnum);
 #ifdef HAVE_GEOIP_V6
 			else
-				text = GeoIP_country_name_by_ipnum_v6_gl(db,
-								 *ipnum6, &gl);
+				text = GeoIP_country_name_by_ipnum_v6(db,
+								      *ipnum6);
 #endif
 			break;
 		default:
@@ -309,10 +300,7 @@ country_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 		if (text == NULL)
 			return (NULL);
 
-		if (scope != NULL)
-			*scope = gl.netmask;
-
-		set_state(family, ipnum, ipnum6, gl.netmask, subtype,
+		set_state(family, ipnum, ipnum6, subtype,
 			  NULL, NULL, NULL, text, 0);
 	}
 
@@ -402,8 +390,7 @@ is_city(dns_geoip_subtype_t subtype) {
 static GeoIPRecord *
 city_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 	    unsigned int family, isc_uint32_t ipnum,
-	    const geoipv6_t *ipnum6,
-	    isc_uint8_t *scope)
+	    const geoipv6_t *ipnum6)
 {
 	GeoIPRecord *record = NULL;
 	geoip_state_t *prev_state = NULL;
@@ -419,8 +406,6 @@ city_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 	prev_state = get_state_for(family, ipnum, ipnum6);
 	if (prev_state != NULL && is_city(prev_state->subtype)) {
 		record = prev_state->record;
-		if (scope != NULL)
-			*scope = record->netmask;
 	}
 
 	if (record == NULL) {
@@ -433,11 +418,8 @@ city_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 		if (record == NULL)
 			return (NULL);
 
-		if (scope != NULL)
-			*scope = record->netmask;
-
-		set_state(family, ipnum, ipnum6, record->netmask, subtype,
-			  record, NULL, NULL, NULL, 0);
+		set_state(family, ipnum, ipnum6, subtype, record,
+			  NULL, NULL, NULL, 0);
 	}
 
 	return (record);
@@ -485,32 +467,24 @@ is_region(dns_geoip_subtype_t subtype) {
  * outside the Region database.
  */
 static GeoIPRegion *
-region_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
-	      isc_uint32_t ipnum, isc_uint8_t *scope)
-{
+region_lookup(GeoIP *db, dns_geoip_subtype_t subtype, isc_uint32_t ipnum) {
 	GeoIPRegion *region = NULL;
 	geoip_state_t *prev_state = NULL;
-	GeoIPLookup gl;
 
 	REQUIRE(db != NULL);
 
 	prev_state = get_state_for(AF_INET, ipnum, NULL);
 	if (prev_state != NULL && is_region(prev_state->subtype)) {
 		region = prev_state->region;
-		if (scope != NULL)
-			*scope = prev_state->scope;
 	}
 
 	if (region == NULL) {
-		region = GeoIP_region_by_ipnum_gl(db, ipnum, &gl);
+		region = GeoIP_region_by_ipnum(db, ipnum);
 		if (region == NULL)
 			return (NULL);
 
-		if (scope != NULL)
-			*scope = gl.netmask;
-
-		set_state(AF_INET, ipnum, NULL, gl.netmask,
-			  subtype, NULL, region, NULL, NULL, 0);
+		set_state(AF_INET, ipnum, NULL, subtype, NULL,
+			  region, NULL, NULL, 0);
 	}
 
 	return (region);
@@ -522,32 +496,24 @@ region_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
  * or was for a search of a different subtype.
  */
 static char *
-name_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
-	    isc_uint32_t ipnum, isc_uint8_t *scope)
-{
+name_lookup(GeoIP *db, dns_geoip_subtype_t subtype, isc_uint32_t ipnum) {
 	char *name = NULL;
 	geoip_state_t *prev_state = NULL;
-	GeoIPLookup gl;
 
 	REQUIRE(db != NULL);
 
 	prev_state = get_state_for(AF_INET, ipnum, NULL);
 	if (prev_state != NULL && prev_state->subtype == subtype) {
 		name = prev_state->name;
-		if (scope != NULL)
-			*scope = prev_state->scope;
 	}
 
 	if (name == NULL) {
-		name = GeoIP_name_by_ipnum_gl(db, ipnum, &gl);
+		name = GeoIP_name_by_ipnum(db, ipnum);
 		if (name == NULL)
 			return (NULL);
 
-		if (scope != NULL)
-			*scope = gl.netmask;
-
-		set_state(AF_INET, ipnum, NULL, gl.netmask,
-			  subtype, NULL, NULL, name, NULL, 0);
+		set_state(AF_INET, ipnum, NULL, subtype, NULL, NULL,
+			  name, NULL, 0);
 	}
 
 	return (name);
@@ -559,12 +525,9 @@ name_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
  * different subtype.
  */
 static int
-netspeed_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
-		isc_uint32_t ipnum, isc_uint8_t *scope)
-{
+netspeed_lookup(GeoIP *db, dns_geoip_subtype_t subtype, isc_uint32_t ipnum) {
 	geoip_state_t *prev_state = NULL;
 	isc_boolean_t found = ISC_FALSE;
-	GeoIPLookup gl;
 	int id = -1;
 
 	REQUIRE(db != NULL);
@@ -572,21 +535,16 @@ netspeed_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 	prev_state = get_state_for(AF_INET, ipnum, NULL);
 	if (prev_state != NULL && prev_state->subtype == subtype) {
 		id = prev_state->id;
-		if (scope != NULL)
-			*scope = prev_state->scope;
 		found = ISC_TRUE;
 	}
 
 	if (!found) {
-		id = GeoIP_id_by_ipnum_gl(db, ipnum, &gl);
+		id = GeoIP_id_by_ipnum(db, ipnum);
 		if (id == 0)
 			return (0);
 
-		if (scope != NULL)
-			*scope = gl.netmask;
-
-		set_state(AF_INET, ipnum, NULL, gl.netmask,
-			  subtype, NULL, NULL, NULL, NULL, id);
+		set_state(AF_INET, ipnum, NULL, subtype, NULL,
+			  NULL, NULL, NULL, id);
 	}
 
 	return (id);
@@ -648,7 +606,7 @@ fix_subtype(const isc_netaddr_t *reqaddr, const dns_geoip_databases_t *geoip,
 #endif /* HAVE_GEOIP */
 
 isc_boolean_t
-dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
+dns_geoip_match(const isc_netaddr_t *reqaddr,
 		const dns_geoip_databases_t *geoip,
 		const dns_geoip_elem_t *elt)
 {
@@ -711,7 +669,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
 
 		INSIST(elt->as_string != NULL);
 
-		cs = country_lookup(db, subtype, family, ipnum, ipnum6, scope);
+		cs = country_lookup(db, subtype, family, ipnum, ipnum6);
 		if (cs != NULL && strncasecmp(elt->as_string, cs, maxlen) == 0)
 			return (ISC_TRUE);
 		break;
@@ -732,7 +690,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
 			return (ISC_FALSE);
 
 		record = city_lookup(db, subtype, family,
-				     ipnum, ipnum6, scope);
+				     ipnum, ipnum6);
 		if (record == NULL)
 			break;
 
@@ -748,7 +706,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
 			return (ISC_FALSE);
 
 		record = city_lookup(db, subtype, family,
-				     ipnum, ipnum6, scope);
+				     ipnum, ipnum6);
 		if (record == NULL)
 			break;
 
@@ -762,7 +720,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
 			return (ISC_FALSE);
 
 		record = city_lookup(db, subtype, family,
-				     ipnum, ipnum6, scope);
+				     ipnum, ipnum6);
 		if (record == NULL)
 			break;
 
@@ -783,7 +741,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
 		if (family == AF_INET6)
 			return (ISC_FALSE);
 
-		region = region_lookup(geoip->region, subtype, ipnum, scope);
+		region = region_lookup(geoip->region, subtype, ipnum);
 		if (region == NULL)
 			break;
 
@@ -817,7 +775,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
 		if (family == AF_INET6)
 			return (ISC_FALSE);
 
-		s = name_lookup(db, subtype, ipnum, scope);
+		s = name_lookup(db, subtype, ipnum);
 		if (s != NULL) {
 			size_t l;
 			if (strcasecmp(elt->as_string, s) == 0)
@@ -842,7 +800,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
 		if (family == AF_INET6)
 			return (ISC_FALSE);
 
-		id = netspeed_lookup(geoip->netspeed, subtype, ipnum, scope);
+		id = netspeed_lookup(geoip->netspeed, subtype, ipnum);
 		if (id == elt->as_int)
 			return (ISC_TRUE);
 		break;

lib/dns/hmac_link.c

@@ -26,8 +26,7 @@
 #include <config.h>
 
 #include <isc/buffer.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/md5.h>
 #include <isc/random.h>
 #include <isc/sha1.h>
@@ -106,7 +105,7 @@ hmacmd5_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	if (isc_buffer_availablelength(sig) < ISC_MD5_DIGESTLENGTH)
 		return (ISC_R_NOSPACE);
 	digest = isc_buffer_used(sig);
-	isc_hmacmd5_sign(hmacmd5ctx, digest);
+	isc_hmacmd5_sign(hmacmd5ctx, digest, ISC_MD5_DIGESTLENGTH);
 	isc_buffer_add(sig, ISC_MD5_DIGESTLENGTH);
 
 	return (ISC_R_SUCCESS);
@@ -119,7 +118,7 @@ hmacmd5_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	if (sig->length > ISC_MD5_DIGESTLENGTH)
 		return (DST_R_VERIFYFAILURE);
 
-	if (isc_hmacmd5_verify2(hmacmd5ctx, sig->base, sig->length))
+	if (isc_hmacmd5_verify(hmacmd5ctx, sig->base, sig->length))
 		return (ISC_R_SUCCESS);
 	else
 		return (DST_R_VERIFYFAILURE);
@@ -358,7 +357,6 @@ dst__hmacmd5_init(dst_func_t **funcp) {
 	 */
 
 	RUNTIME_CHECK(isc_md5_check(ISC_FALSE));
-	RUNTIME_CHECK(isc_hmacmd5_check(0));
 
 	REQUIRE(funcp != NULL);
 	if (*funcp == NULL)
@@ -649,7 +647,6 @@ dst__hmacsha1_init(dst_func_t **funcp) {
 	 * Prevent use of incorrect crypto
 	 */
 	RUNTIME_CHECK(isc_sha1_check(ISC_FALSE));
-	RUNTIME_CHECK(isc_hmacsha1_check(0));
 
 	REQUIRE(funcp != NULL);
 	if (*funcp == NULL)

lib/dns/include/dns/acl.h

@@ -95,7 +95,6 @@ struct dns_aclenv {
 	isc_boolean_t match_mapped;
 #ifdef HAVE_GEOIP
 	dns_geoip_databases_t *geoip;
-	isc_boolean_t geoip_use_ecs;
 #endif
 };
 
@@ -188,9 +187,7 @@ dns_acl_isinsecure(const dns_acl_t *a);
 
 isc_boolean_t
 dns_acl_allowed(isc_netaddr_t *addr, dns_name_t *signer,
-		isc_netaddr_t *ecs_addr, isc_uint8_t ecs_addrlen,
-		isc_uint8_t *ecs_scope, dns_acl_t *acl, dns_aclenv_t
-		*aclenv);
+		dns_acl_t *acl, dns_aclenv_t *aclenv);
 /*%<
  * Return #ISC_TRUE iff the 'addr', 'signer', or ECS values are
  * permitted by 'acl' in environment 'aclenv'.
@@ -211,9 +208,6 @@ dns_aclenv_destroy(dns_aclenv_t *env);
 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr,
 	      const dns_name_t *reqsigner,
-	      const isc_netaddr_t *ecs,
-	      isc_uint8_t ecslen,
-	      isc_uint8_t *scope,
 	      const dns_acl_t *acl,
 	      const dns_aclenv_t *env,
 	      int *match,
@@ -223,12 +217,7 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
  * be useful even for weird stuff like the topology and sortlist statements.
  *
  * Match the address 'reqaddr', and optionally the key name 'reqsigner',
- * and optionally the client prefix 'ecs' of length 'ecslen'
- * (reported via EDNS client subnet option) against 'acl'.
- *
- * 'reqsigner' and 'ecs' may be NULL.  If an ACL matches against 'ecs'
- * and 'ecslen', then 'scope' will be set to indicate the netmask that
- * matched.
+ * against 'acl'.  'reqsigner' may be NULL.
  *
  * If there is a match, '*match' will be set to an integer whose absolute
  * value corresponds to the order in which the matching value was inserted
@@ -252,9 +241,6 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 isc_boolean_t
 dns_aclelement_match(const isc_netaddr_t *reqaddr,
 		     const dns_name_t *reqsigner,
-		     const isc_netaddr_t *ecs,
-		     isc_uint8_t ecslen,
-		     isc_uint8_t *scope,
 		     const dns_aclelement_t *e,
 		     const dns_aclenv_t *env,
 		     const dns_aclelement_t **matchelt);

lib/dns/include/dns/geoip.h

@@ -103,7 +103,7 @@ typedef struct dns_geoip_databases {
 ISC_LANG_BEGINDECLS
 
 isc_boolean_t
-dns_geoip_match(const isc_netaddr_t *reqaddr, isc_uint8_t *scope,
+dns_geoip_match(const isc_netaddr_t *reqaddr,
 		const dns_geoip_databases_t *geoip,
 		const dns_geoip_elem_t *elt);
 

lib/dns/include/dns/iptable.h

@@ -9,7 +9,6 @@
  * information regarding copyright ownership.
  */
 
-
 #ifndef DNS_IPTABLE_H
 #define DNS_IPTABLE_H 1
 
@@ -44,8 +43,7 @@ dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target);
 
 isc_result_t
 dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
-		      isc_uint16_t bitlen, isc_boolean_t pos,
-		      isc_boolean_t is_ecs);
+		      isc_uint16_t bitlen, isc_boolean_t pos);
 /*
  * Add an IP prefix to an existing IP table
  */

lib/dns/include/dns/rbt.h

@@ -9,7 +9,6 @@
  * information regarding copyright ownership.
  */
 
-
 #ifndef DNS_RBT_H
 #define DNS_RBT_H 1
 
@@ -25,8 +24,6 @@
 
 ISC_LANG_BEGINDECLS
 
-#define DNS_RBT_USEHASH 1
-
 /*@{*/
 /*%
  * Option values for dns_rbt_findnode() and dns_rbt_findname().
@@ -108,7 +105,7 @@ struct dns_rbtnode {
 	unsigned int oldnamelen : 8;    /*%< range is 1..255 */
 	/*@}*/
 
-	/* flags needed for serialization to file*/
+	/* flags needed for serialization to file */
 	unsigned int is_mmapped : 1;
 	unsigned int parent_is_relative : 1;
 	unsigned int left_is_relative : 1;
@@ -120,11 +117,15 @@ struct dns_rbtnode {
 	unsigned int rpz : 1;
 	unsigned int :0;                /* end of bitfields c/o tree lock */
 
-#ifdef DNS_RBT_USEHASH
+	/*%
+	 * These are needed for hashing. The 'uppernode' points to the
+	 * node's superdomain node in the parent subtree, so that it can
+	 * be reached from a child that was found by a hash lookup.
+	 */
 	unsigned int hashval;
 	dns_rbtnode_t *uppernode;
 	dns_rbtnode_t *hashnext;
-#endif
+
 	dns_rbtnode_t *parent;
 	dns_rbtnode_t *left;
 	dns_rbtnode_t *right;

lib/dns/iptable.c

@@ -56,8 +56,7 @@ static isc_boolean_t dns_iptable_pos = ISC_TRUE;
  */
 isc_result_t
 dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
-		      isc_uint16_t bitlen, isc_boolean_t pos,
-		      isc_boolean_t is_ecs)
+		      isc_uint16_t bitlen, isc_boolean_t pos)
 {
 	isc_result_t result;
 	isc_prefix_t pfx;
@@ -67,7 +66,7 @@ dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
 	INSIST(DNS_IPTABLE_VALID(tab));
 	INSIST(tab->radix);
 
-	NETADDR_TO_PREFIX_T(addr, pfx, bitlen, is_ecs);
+	NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
 
 	result = isc_radix_insert(tab->radix, &node, NULL, &pfx);
 	if (result != ISC_R_SUCCESS) {
@@ -79,16 +78,16 @@ dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
 	if (pfx.family == AF_UNSPEC) {
 		/* "any" or "none" */
 		INSIST(pfx.bitlen == 0);
-		for (i = 0; i < 4; i++) {
+		for (i = 0; i < RADIX_FAMILIES; i++) {
 			if (node->data[i] == NULL)
 				node->data[i] = pos ? &dns_iptable_pos
 						    : &dns_iptable_neg;
 		}
 	} else {
 		/* any other prefix */
-		int offset = ISC_RADIX_OFF(&pfx);
-		if (node->data[offset] == NULL) {
-			node->data[offset] = pos ? &dns_iptable_pos
+		int fam = ISC_RADIX_FAMILY(&pfx);
+		if (node->data[fam] == NULL) {
+			node->data[fam] = pos ? &dns_iptable_pos
 						 : &dns_iptable_neg;
 		}
 	}
@@ -122,7 +121,7 @@ dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, isc_boolean_t pos)
 		 * could be a security risk.  To prevent this, we
 		 * just leave the negative nodes negative.
 		 */
-		for (i = 0; i < 4; i++) {
+		for (i = 0; i < RADIX_FAMILIES; i++) {
 			if (!pos) {
 				if (node->data[i] &&
 				    *(isc_boolean_t *) node->data[i])

lib/dns/master.c

@@ -1009,6 +1009,19 @@ openfile_text(dns_loadctx_t *lctx, const char *master_file) {
 	return (isc_lex_openfile(lctx->lex, master_file));
 }
 
+static int
+find_free_name(dns_incctx_t *incctx) {
+	int i;
+
+	for (i = 0; i < (NBUFS - 1); i++) {
+		if (!incctx->in_use[i]) {
+			break;
+		}
+	}
+	INSIST(!incctx->in_use[i]);
+	return (i);
+}
+
 static isc_result_t
 load_text(dns_loadctx_t *lctx) {
 	dns_rdataclass_t rdclass;
@@ -1378,13 +1391,8 @@ load_text(dns_loadctx_t *lctx) {
 
 			/*
 			 * Normal processing resumes.
-			 *
-			 * Find a free name buffer.
 			 */
-			for (new_in_use = 0; new_in_use < NBUFS; new_in_use++)
-				if (!ictx->in_use[new_in_use])
-					break;
-			INSIST(new_in_use < NBUFS);
+			new_in_use = find_free_name(ictx);
 			new_name =
 			      dns_fixedname_initname(&ictx->fixed[new_in_use]);
 			isc_buffer_init(&buffer, token.value.as_region.base,
@@ -2088,7 +2096,6 @@ pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx) {
 	dns_incctx_t *ictx;
 	dns_incctx_t *newctx = NULL;
 	isc_region_t r;
-	int new_in_use;
 
 	REQUIRE(master_file != NULL);
 	REQUIRE(DNS_LCTX_VALID(lctx));
@@ -2107,11 +2114,7 @@ pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx) {
 
 	/* Set current domain. */
 	if (ictx->glue != NULL || ictx->current != NULL) {
-		for (new_in_use = 0; new_in_use < NBUFS; new_in_use++)
-			if (!newctx->in_use[new_in_use])
-				break;
-		INSIST(new_in_use < NBUFS);
-		newctx->current_in_use = new_in_use;
+		newctx->current_in_use = find_free_name(newctx);
 		newctx->current =
 			dns_fixedname_name(&newctx->fixed[newctx->current_in_use]);
 		newctx->in_use[newctx->current_in_use] = ISC_TRUE;

lib/dns/rbt.c

@@ -152,6 +152,7 @@ static isc_result_t
 serialize_nodes(FILE *file, dns_rbtnode_t *node, uintptr_t parent,
 		dns_rbtdatawriter_t datawriter, void *writer_arg,
 		uintptr_t *where, isc_uint64_t *crc);
+
 /*
  * The following functions allow you to get the actual address of a pointer
  * without having to use an if statement to check to see if that address is
@@ -204,9 +205,7 @@ getdata(dns_rbtnode_t *node, file_header_t *header) {
 #define LEFT(node)              ((node)->left)
 #define RIGHT(node)             ((node)->right)
 #define DOWN(node)              ((node)->down)
-#ifdef DNS_RBT_USEHASH
 #define UPPERNODE(node)         ((node)->uppernode)
-#endif /* DNS_RBT_USEHASH */
 #define DATA(node)              ((node)->data)
 #define IS_EMPTY(node)          ((node)->data == NULL)
 #define HASHNEXT(node)          ((node)->hashnext)
@@ -234,9 +233,10 @@ getdata(dns_rbtnode_t *node, file_header_t *header) {
  *	<name_data>{1..255}<oldoffsetlen>{1}<offsets>{1..128}
  *
  * <name_data> contains the name of the node when it was created.
- * <oldoffsetlen> contains the length of <offsets> when the node was created.
- * <offsets> contains the offets into name for each label when the node was
- * created.
+ * <oldoffsetlen> contains the length of <offsets> when the node
+ * was created.
+ * <offsets> contains the offets into name for each label when the node
+ * was created.
  */
 
 #define NAME(node)      ((unsigned char *)((node) + 1))
@@ -295,14 +295,9 @@ dns_rbtnode_nodename(dns_rbtnode_t *node, dns_name_t *name) {
 
 dns_rbtnode_t *
 dns_rbt_root(dns_rbt_t *rbt) {
-  return rbt->root;
+	return (rbt->root);
 }
 
-#ifdef DNS_RBT_USEHASH
-static isc_result_t
-inithash(dns_rbt_t *rbt);
-#endif
-
 #ifdef DEBUG
 #define inline
 /*
@@ -344,8 +339,6 @@ hexdump(const char *desc, unsigned char *data, size_t size) {
 }
 #endif /* DEBUG */
 
-#ifdef DNS_RBT_USEHASH
-
 /*
  * Upper node is the parent of the root of the passed node's
  * subtree. The passed node must not be NULL.
@@ -376,35 +369,6 @@ fixup_uppernodes(dns_rbt_t *rbt) {
 	fixup_uppernodes_helper(rbt->root, NULL);
 }
 
-#else
-
-/* The passed node must not be NULL. */
-static inline dns_rbtnode_t *
-get_subtree_root(dns_rbtnode_t *node) {
-	while (!IS_ROOT(node)) {
-		node = PARENT(node);
-	}
-
-	return (node);
-}
-
-/* Upper node is the parent of the root of the passed node's
- * subtree. The passed node must not be NULL.
- */
-static inline dns_rbtnode_t *
-get_upper_node(dns_rbtnode_t *node) {
-	dns_rbtnode_t *root = get_subtree_root(node);
-
-	/*
-	 * Return the node in the level above the argument node that points
-	 * to the level the argument node is in.  If the argument node is in
-	 * the top level, the return value is NULL.
-	 */
-	return (PARENT(root));
-}
-
-#endif /* DNS_RBT_USEHASH */
-
 size_t
 dns__rbtnode_getdistance(dns_rbtnode_t *node) {
 	size_t nodes = 1;
@@ -425,18 +389,17 @@ dns__rbtnode_getdistance(dns_rbtnode_t *node) {
 static isc_result_t
 create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep);
 
-#ifdef DNS_RBT_USEHASH
+static isc_result_t
+inithash(dns_rbt_t *rbt);
+
 static inline void
 hash_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name);
+
 static inline void
 unhash_node(dns_rbt_t *rbt, dns_rbtnode_t *node);
+
 static void
 rehash(dns_rbt_t *rbt, unsigned int newcount);
-#else
-#define hash_node(rbt, node, name)
-#define unhash_node(rbt, node)
-#define rehash(rbt, newcount)
-#endif
 
 static inline void
 rotate_left(dns_rbtnode_t *node, dns_rbtnode_t **rootp);
@@ -965,9 +928,7 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
 		goto cleanup;
 	}
 
-#ifdef DNS_RBT_USEHASH
 	fixup_uppernodes(rbt);
-#endif /* DNS_RBT_USEHASH */
 
 	*rbtp = rbt;
 	if (originp != NULL)
@@ -990,9 +951,7 @@ isc_result_t
 dns_rbt_create(isc_mem_t *mctx, dns_rbtdeleter_t deleter,
 	       void *deleter_arg, dns_rbt_t **rbtp)
 {
-#ifdef DNS_RBT_USEHASH
 	isc_result_t result;
-#endif
 	dns_rbt_t *rbt;
 
 	REQUIRE(mctx != NULL);
@@ -1013,13 +972,11 @@ dns_rbt_create(isc_mem_t *mctx, dns_rbtdeleter_t deleter,
 	rbt->hashsize = 0;
 	rbt->mmap_location = NULL;
 
-#ifdef DNS_RBT_USEHASH
 	result = inithash(rbt);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_putanddetach(&rbt->mctx, rbt, sizeof(*rbt));
 		return (result);
 	}
-#endif
 
 	rbt->magic = RBT_MAGIC;
 
@@ -1197,9 +1154,9 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 		if (result == ISC_R_SUCCESS) {
 			rbt->nodecount++;
 			new_current->is_root = 1;
-#ifdef DNS_RBT_USEHASH
+
 			UPPERNODE(new_current) = NULL;
-#endif /* DNS_RBT_USEHASH */
+
 			rbt->root = new_current;
 			*nodep = new_current;
 			hash_node(rbt, new_current, name);
@@ -1371,10 +1328,9 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 				PARENT(current) = new_current;
 				DOWN(new_current) = current;
 				root = &DOWN(new_current);
-#ifdef DNS_RBT_USEHASH
+
 				UPPERNODE(new_current) = UPPERNODE(current);
 				UPPERNODE(current) = new_current;
-#endif /* DNS_RBT_USEHASH */
 
 				INSIST(level_count < DNS_RBT_LEVELBLOCK);
 				level_count++;
@@ -1433,12 +1389,12 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 		result = create_node(rbt->mctx, add_name, &new_current);
 
 	if (ISC_LIKELY(result == ISC_R_SUCCESS)) {
-#ifdef DNS_RBT_USEHASH
-		if (*root == NULL)
+		if (*root == NULL) {
 			UPPERNODE(new_current) = current;
-		else
+		} else {
 			UPPERNODE(new_current) = PARENT(*root);
-#endif /* DNS_RBT_USEHASH */
+		}
+
 		addonlevel(new_current, current, order, root);
 		rbt->nodecount++;
 		*nodep = new_current;
@@ -1560,7 +1516,6 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 			break;
 
 		if (compared == dns_namereln_none) {
-#ifdef DNS_RBT_USEHASH
 			/*
 			 * Here, current is pointing at a subtree root
 			 * node. We try to find a matching node using
@@ -1635,13 +1590,19 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 				 * match a labelsequence from some other
 				 * subdomain.
 				 */
-				if (ISC_LIKELY(get_upper_node(hnode) != up_current))
+				if (ISC_LIKELY(get_upper_node(hnode) !=
+					       up_current))
+				{
 					continue;
+				}
 
 				dns_name_init(&hnode_name, NULL);
 				NODENAME(hnode, &hnode_name);
-				if (ISC_LIKELY(dns_name_equal(&hnode_name, &hash_name)))
+				if (ISC_LIKELY(dns_name_equal(&hnode_name,
+							      &hash_name)))
+				{
 					break;
+				}
 			}
 
 			if (hnode != NULL) {
@@ -1676,19 +1637,6 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 			 */
 			current = NULL;
 			continue;
-
-#else /* DNS_RBT_USEHASH */
-
-			/*
-			 * Standard binary search tree movement.
-			 */
-			if (order < 0)
-				current = LEFT(current);
-			else
-				current = RIGHT(current);
-
-#endif /* DNS_RBT_USEHASH */
-
 		} else {
 			/*
 			 * The names have some common suffix labels.
@@ -1698,9 +1646,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 			 * down pointer and search in the new tree.
 			 */
 			if (compared == dns_namereln_subdomain) {
-#ifdef DNS_RBT_USEHASH
-		subdomain:
-#endif
+ subdomain:
 				/*
 				 * Whack off the current node's common parts
 				 * for the name to search in the next level.
@@ -2264,10 +2210,8 @@ create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep) {
 	node->data_is_relative = 0;
 	node->rpz = 0;
 
-#ifdef DNS_RBT_USEHASH
 	HASHNEXT(node) = NULL;
 	HASHVAL(node) = 0;
-#endif
 
 	ISC_LINK_INIT(node, deadlink);
 
@@ -2309,7 +2253,9 @@ create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep) {
 	return (ISC_R_SUCCESS);
 }
 
-#ifdef DNS_RBT_USEHASH
+/*
+ * Add a node to the hash table
+ */
 static inline void
 hash_add_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name) {
 	unsigned int hash;
@@ -2324,6 +2270,9 @@ hash_add_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name) {
 	rbt->hashtable[hash] = node;
 }
 
+/*
+ * Initialize hash table
+ */
 static isc_result_t
 inithash(dns_rbt_t *rbt) {
 	unsigned int bytes;
@@ -2340,6 +2289,9 @@ inithash(dns_rbt_t *rbt) {
 	return (ISC_R_SUCCESS);
 }
 
+/*
+ * Rebuild the hashtable to reduce the load factor
+ */
 static void
 rehash(dns_rbt_t *rbt, unsigned int newcount) {
 	unsigned int oldsize;
@@ -2378,6 +2330,10 @@ rehash(dns_rbt_t *rbt, unsigned int newcount) {
 	isc_mem_put(rbt->mctx, oldtable, oldsize * sizeof(dns_rbtnode_t *));
 }
 
+/*
+ * Add a node to the hash table. Rehash the hashtable if the node count
+ * rises above a critical level.
+ */
 static inline void
 hash_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name) {
 	REQUIRE(DNS_RBTNODE_VALID(node));
@@ -2388,6 +2344,9 @@ hash_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name) {
 	hash_add_node(rbt, node, name);
 }
 
+/*
+ * Remove a node from the hash table
+ */
 static inline void
 unhash_node(dns_rbt_t *rbt, dns_rbtnode_t *node) {
 	unsigned int bucket;
@@ -2408,7 +2367,6 @@ unhash_node(dns_rbt_t *rbt, dns_rbtnode_t *node) {
 		HASHNEXT(bucket_node) = HASHNEXT(node);
 	}
 }
-#endif /* DNS_RBT_USEHASH */
 
 static inline void
 rotate_left(dns_rbtnode_t *node, dns_rbtnode_t **rootp) {

lib/dns/rbtdb.c

@@ -2885,19 +2885,16 @@ findnodeintree(dns_rbtdb_t *rbtdb, dns_rbt_t *tree, const dns_name_t *name,
 		result = dns_rbt_addnode(tree, name, &node);
 		if (result == ISC_R_SUCCESS) {
 			dns_rbt_namefromnode(node, &nodename);
-#ifdef DNS_RBT_USEHASH
 			node->locknum = node->hashval % rbtdb->node_lock_count;
-#else
-			node->locknum = dns_name_hash(&nodename, ISC_TRUE) %
-				rbtdb->node_lock_count;
-#endif
 			if (tree == rbtdb->tree) {
 				add_empty_wildcards(rbtdb, name);
 
 				if (dns_name_iswildcard(name)) {
-					result = add_wildcard_magic(rbtdb, name);
+					result = add_wildcard_magic(rbtdb,
+								    name);
 					if (result != ISC_R_SUCCESS) {
-						RWUNLOCK(&rbtdb->tree_lock, locktype);
+						RWUNLOCK(&rbtdb->tree_lock,
+							 locktype);
 						return (result);
 					}
 				}
@@ -7202,12 +7199,7 @@ loading_addrdataset(void *arg, const dns_name_t *name,
 		dns_name_t foundname;
 		dns_name_init(&foundname, NULL);
 		dns_rbt_namefromnode(node, &foundname);
-#ifdef DNS_RBT_USEHASH
 		node->locknum = node->hashval % rbtdb->node_lock_count;
-#else
-		node->locknum = dns_name_hash(&foundname, ISC_TRUE) %
-			rbtdb->node_lock_count;
-#endif
 	}
 
 	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
@@ -8451,15 +8443,9 @@ dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 		 */
 		dns_name_init(&name, NULL);
 		dns_rbt_namefromnode(rbtdb->origin_node, &name);
-#ifdef DNS_RBT_USEHASH
 		rbtdb->origin_node->locknum =
 			rbtdb->origin_node->hashval %
 			rbtdb->node_lock_count;
-#else
-		rbtdb->origin_node->locknum =
-			dns_name_hash(&name, ISC_TRUE) %
-			rbtdb->node_lock_count;
-#endif
 		/*
 		 * Add an apex node to the NSEC3 tree so that NSEC3 searches
 		 * return partial matches when there is only a single NSEC3
@@ -8479,15 +8465,9 @@ dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 		 */
 		dns_name_init(&name, NULL);
 		dns_rbt_namefromnode(rbtdb->nsec3_origin_node, &name);
-#ifdef DNS_RBT_USEHASH
 		rbtdb->nsec3_origin_node->locknum =
 			rbtdb->nsec3_origin_node->hashval %
 			rbtdb->node_lock_count;
-#else
-		rbtdb->nsec3_origin_node->locknum =
-			dns_name_hash(&name, ISC_TRUE) %
-			rbtdb->node_lock_count;
-#endif
 	}
 
 	/*

lib/dns/request.c

@@ -9,7 +9,6 @@
  * information regarding copyright ownership.
  */
 
-
 /*! \file */
 
 #include <config.h>
@@ -507,10 +506,12 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) {
 	blackhole = dns_dispatchmgr_getblackhole(dispatchmgr);
 	if (blackhole != NULL) {
 		isc_netaddr_fromsockaddr(&netaddr, destaddr);
-		if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, blackhole,
-				  NULL, &match, NULL) == ISC_R_SUCCESS &&
+		if (dns_acl_match(&netaddr, NULL, blackhole, NULL,
+				  &match, NULL) == ISC_R_SUCCESS &&
 		    match > 0)
+		{
 			drop = ISC_TRUE;
+		}
 	}
 	if (drop) {
 		isc_netaddr_format(&netaddr, netaddrstr, sizeof(netaddrstr));

lib/dns/resolver.c

@@ -29,7 +29,7 @@
 #ifdef AES_CC
 #include <isc/aes.h>
 #else
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #endif
 
 #include <dns/acl.h>
@@ -3756,11 +3756,13 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) {
 	if (blackhole != NULL) {
 		int match;
 
-		if (dns_acl_match(&ipaddr, NULL, NULL, 0, NULL, blackhole,
-				  &res->view->aclenv,
-				  &match, NULL) == ISC_R_SUCCESS &&
+		if ((dns_acl_match(&ipaddr, NULL, blackhole,
+				   &res->view->aclenv, &match,
+				   NULL) == ISC_R_SUCCESS) &&
 		    match > 0)
+		{
 			aborted = ISC_TRUE;
+		}
 	}
 
 	if (peer != NULL &&
@@ -6517,10 +6519,8 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 			isc_netaddr_fromin6(&netaddr, &in6a);
 		}
 
-		result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
-				       view->denyansweracl, &view->aclenv,
-				       &match, NULL);
-
+		result = dns_acl_match(&netaddr, NULL, view->denyansweracl,
+				       &view->aclenv, &match, NULL);
 		if (result == ISC_R_SUCCESS && match > 0) {
 			isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf));
 			dns_name_format(name, namebuf, sizeof(namebuf));

lib/dns/rrl.c

@@ -1022,9 +1022,8 @@ dns_rrl(dns_view_t *view,
 	rrl = view->rrl;
 	if (rrl->exempt != NULL) {
 		isc_netaddr_fromsockaddr(&netclient, client_addr);
-		result = dns_acl_match(&netclient, NULL, NULL, 0, NULL,
-				       rrl->exempt, &view->aclenv,
-				       &exempt_match, NULL);
+		result = dns_acl_match(&netclient, NULL, rrl->exempt,
+				       &view->aclenv, &exempt_match, NULL);
 		if (result == ISC_R_SUCCESS && exempt_match > 0)
 			return (DNS_RRL_RESULT_OK);
 	}

lib/dns/ssu.c

@@ -417,9 +417,8 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			if (!dns_name_issubdomain(name, rule->name)) {
 				continue;
 			}
-				dns_acl_match(addr, NULL, NULL, 0, NULL,
-					      env->localhost, NULL, &match,
-					      NULL);
+			dns_acl_match(addr, NULL, env->localhost,
+				      NULL, &match, NULL);
 			if (match == 0) {
 				if (signer != NULL) {
 					isc_log_write(dns_lctx,

lib/dns/tests/acl_test.c

@@ -9,7 +9,6 @@
  * information regarding copyright ownership.
  */
 
-
 /*! \file */
 
 #include <config.h>
@@ -38,45 +37,11 @@ ATF_TC_HEAD(dns_acl_isinsecure, tc) {
 }
 ATF_TC_BODY(dns_acl_isinsecure, tc) {
 	isc_result_t result;
-	unsigned int pass;
-	struct {
-		isc_boolean_t first;
-		isc_boolean_t second;
-	} ecs[] = {
-		{ ISC_FALSE, ISC_FALSE },
-		{ ISC_TRUE, ISC_TRUE },
-		{ ISC_TRUE, ISC_FALSE },
-		{ ISC_FALSE, ISC_TRUE }
-	};
-
 	dns_acl_t *any = NULL;
 	dns_acl_t *none = NULL;
 	dns_acl_t *notnone = NULL;
 	dns_acl_t *notany = NULL;
 
-	dns_acl_t *pos4pos6 = NULL;
-	dns_acl_t *notpos4pos6 = NULL;
-	dns_acl_t *neg4pos6 = NULL;
-	dns_acl_t *notneg4pos6 = NULL;
-	dns_acl_t *pos4neg6 = NULL;
-	dns_acl_t *notpos4neg6 = NULL;
-	dns_acl_t *neg4neg6 = NULL;
-	dns_acl_t *notneg4neg6 = NULL;
-
-	dns_acl_t *loop4 = NULL;
-	dns_acl_t *notloop4 = NULL;
-
-	dns_acl_t *loop6 = NULL;
-	dns_acl_t *notloop6 = NULL;
-
-	dns_acl_t *loop4pos6 = NULL;
-	dns_acl_t *notloop4pos6 = NULL;
-	dns_acl_t *loop4neg6 = NULL;
-	dns_acl_t *notloop4neg6 = NULL;
-
-	struct in_addr inaddr;
-	isc_netaddr_t addr;
-
 	UNUSED(tc);
 
 	result = dns_test_begin(NULL, ISC_FALSE);
@@ -110,219 +75,6 @@ ATF_TC_BODY(dns_acl_isinsecure, tc) {
 	dns_acl_detach(&notany);
 	dns_acl_detach(&notnone);
 
-	for (pass = 0; pass < sizeof(ecs)/sizeof(ecs[0]); pass++) {
-		result = dns_acl_create(mctx, 1, &pos4pos6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &notpos4pos6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &neg4pos6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &notneg4pos6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &pos4neg6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &notpos4neg6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &neg4neg6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &notneg4neg6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		inaddr.s_addr = htonl(0x0a000000);	/* 10.0.0.0 */
-		isc_netaddr_fromin(&addr, &inaddr);
-		result = dns_iptable_addprefix(pos4pos6->iptable, &addr, 8,
-					       ISC_TRUE, ecs[pass].first);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		addr.family = AF_INET6;			/* 0a00:: */
-		result = dns_iptable_addprefix(pos4pos6->iptable, &addr, 8,
-					       ISC_TRUE, ecs[pass].second);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_merge(notpos4pos6, pos4pos6, ISC_FALSE);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		inaddr.s_addr = htonl(0x0a000000);	/* !10.0.0.0/8 */
-		isc_netaddr_fromin(&addr, &inaddr);
-		result = dns_iptable_addprefix(neg4pos6->iptable, &addr, 8,
-					       ISC_FALSE, ecs[pass].first);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		addr.family = AF_INET6;			/* 0a00::/8 */
-		result = dns_iptable_addprefix(neg4pos6->iptable, &addr, 8,
-					       ISC_TRUE, ecs[pass].second);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_merge(notneg4pos6, neg4pos6, ISC_FALSE);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		inaddr.s_addr = htonl(0x0a000000);	/* 10.0.0.0/8 */
-		isc_netaddr_fromin(&addr, &inaddr);
-		result = dns_iptable_addprefix(pos4neg6->iptable, &addr, 8,
-					       ISC_TRUE, ecs[pass].first);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		addr.family = AF_INET6;			/* !0a00::/8 */
-		result = dns_iptable_addprefix(pos4neg6->iptable, &addr, 8,
-					       ISC_FALSE, ecs[pass].second);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_merge(notpos4neg6, pos4neg6, ISC_FALSE);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		inaddr.s_addr = htonl(0x0a000000);	/* !10.0.0.0/8 */
-		isc_netaddr_fromin(&addr, &inaddr);
-		result = dns_iptable_addprefix(neg4neg6->iptable, &addr, 8,
-					       ISC_FALSE, ecs[pass].first);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		addr.family = AF_INET6;			/* !0a00::/8 */
-		result = dns_iptable_addprefix(neg4neg6->iptable, &addr, 8,
-					       ISC_FALSE, ecs[pass].second);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_merge(notneg4neg6, neg4neg6, ISC_FALSE);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		ATF_CHECK(dns_acl_isinsecure(pos4pos6));
-		ATF_CHECK(!dns_acl_isinsecure(notpos4pos6));
-		ATF_CHECK(dns_acl_isinsecure(neg4pos6));
-		ATF_CHECK(!dns_acl_isinsecure(notneg4pos6));
-		ATF_CHECK(dns_acl_isinsecure(pos4neg6));
-		ATF_CHECK(!dns_acl_isinsecure(notpos4neg6));
-		ATF_CHECK(!dns_acl_isinsecure(neg4neg6));
-		ATF_CHECK(!dns_acl_isinsecure(notneg4neg6));
-
-		dns_acl_detach(&pos4pos6);
-		dns_acl_detach(&notpos4pos6);
-		dns_acl_detach(&neg4pos6);
-		dns_acl_detach(&notneg4pos6);
-		dns_acl_detach(&pos4neg6);
-		dns_acl_detach(&notpos4neg6);
-		dns_acl_detach(&neg4neg6);
-		dns_acl_detach(&notneg4neg6);
-
-		result = dns_acl_create(mctx, 1, &loop4);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &notloop4);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &loop6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &notloop6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		inaddr.s_addr = htonl(0x7f000001);	/* 127.0.0.1 */
-		isc_netaddr_fromin(&addr, &inaddr);
-		result = dns_iptable_addprefix(loop4->iptable, &addr, 32,
-					       ISC_TRUE, ecs[pass].first);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_merge(notloop4, loop4, ISC_FALSE);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		isc_netaddr_fromin6(&addr, &in6addr_loopback);	/* ::1 */
-		result = dns_iptable_addprefix(loop6->iptable, &addr, 128,
-					       ISC_TRUE, ecs[pass].first);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_merge(notloop6, loop6, ISC_FALSE);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		if (!ecs[pass].first) {
-			ATF_CHECK(!dns_acl_isinsecure(loop4));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4));
-			ATF_CHECK(!dns_acl_isinsecure(loop6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop6));
-		} else if (ecs[pass].first) {
-			ATF_CHECK(dns_acl_isinsecure(loop4));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4));
-			ATF_CHECK(dns_acl_isinsecure(loop6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop6));
-		}
-
-		dns_acl_detach(&loop4);
-		dns_acl_detach(&notloop4);
-		dns_acl_detach(&loop6);
-		dns_acl_detach(&notloop6);
-
-		result = dns_acl_create(mctx, 1, &loop4pos6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &notloop4pos6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &loop4neg6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_create(mctx, 1, &notloop4neg6);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		inaddr.s_addr = htonl(0x7f000001);	/* 127.0.0.1 */
-		isc_netaddr_fromin(&addr, &inaddr);
-		result = dns_iptable_addprefix(loop4pos6->iptable, &addr, 32,
-					       ISC_TRUE, ecs[pass].first);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		addr.family = AF_INET6;			/* f700:0001::/32 */
-		result = dns_iptable_addprefix(loop4pos6->iptable, &addr, 32,
-					       ISC_TRUE, ecs[pass].second);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_merge(notloop4pos6, loop4pos6, ISC_FALSE);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		inaddr.s_addr = htonl(0x7f000001);	/* 127.0.0.1 */
-		isc_netaddr_fromin(&addr, &inaddr);
-		result = dns_iptable_addprefix(loop4neg6->iptable, &addr, 32,
-					       ISC_TRUE, ecs[pass].first);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		addr.family = AF_INET6;			/* !f700:0001::/32 */
-		result = dns_iptable_addprefix(loop4neg6->iptable, &addr, 32,
-					       ISC_FALSE, ecs[pass].second);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		result = dns_acl_merge(notloop4neg6, loop4neg6, ISC_FALSE);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-		if (!ecs[pass].first && !ecs[pass].second) {
-			ATF_CHECK(dns_acl_isinsecure(loop4pos6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4pos6));
-			ATF_CHECK(!dns_acl_isinsecure(loop4neg6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4neg6));
-		} else if (ecs[pass].first && !ecs[pass].second) {
-			ATF_CHECK(dns_acl_isinsecure(loop4pos6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4pos6));
-			ATF_CHECK(dns_acl_isinsecure(loop4neg6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4neg6));
-		} else if (!ecs[pass].first && ecs[pass].second) {
-			ATF_CHECK(dns_acl_isinsecure(loop4pos6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4pos6));
-			ATF_CHECK(!dns_acl_isinsecure(loop4neg6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4neg6));
-		} else {
-			ATF_CHECK(dns_acl_isinsecure(loop4pos6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4pos6));
-			ATF_CHECK(dns_acl_isinsecure(loop4neg6));
-			ATF_CHECK(!dns_acl_isinsecure(notloop4neg6));
-		}
-
-		dns_acl_detach(&loop4pos6);
-		dns_acl_detach(&notloop4pos6);
-		dns_acl_detach(&loop4neg6);
-		dns_acl_detach(&notloop4neg6);
-	}
-
 	dns_test_end();
 }
 

lib/dns/tests/geoip_test.c

@@ -9,7 +9,6 @@
  * information regarding copyright ownership.
  */
 
-
 /*! \file */
 
 #include <config.h>
@@ -132,8 +131,8 @@ load_geoip(const char *dir) {
 }
 
 static isc_boolean_t
-do_lookup_string(const char *addr, isc_uint8_t *scope,
-		 dns_geoip_subtype_t subtype, const char *string)
+do_lookup_string(const char *addr, dns_geoip_subtype_t subtype,
+		 const char *string)
 {
 	dns_geoip_elem_t elt;
 	struct in_addr in4;
@@ -145,12 +144,12 @@ do_lookup_string(const char *addr, isc_uint8_t *scope,
 	elt.subtype = subtype;
 	strlcpy(elt.as_string, string, sizeof(elt.as_string));
 
-	return (dns_geoip_match(&na, scope, &geoip, &elt));
+	return (dns_geoip_match(&na, &geoip, &elt));
 }
 
 static isc_boolean_t
-do_lookup_string_v6(const char *addr, isc_uint8_t *scope,
-		    dns_geoip_subtype_t subtype, const char *string)
+do_lookup_string_v6(const char *addr, dns_geoip_subtype_t subtype,
+		    const char *string)
 {
 	dns_geoip_elem_t elt;
 	struct in6_addr in6;
@@ -162,13 +161,11 @@ do_lookup_string_v6(const char *addr, isc_uint8_t *scope,
 	elt.subtype = subtype;
 	strlcpy(elt.as_string, string, sizeof(elt.as_string));
 
-	return (dns_geoip_match(&na, scope, &geoip, &elt));
+	return (dns_geoip_match(&na, &geoip, &elt));
 }
 
 static isc_boolean_t
-do_lookup_int(const char *addr, isc_uint8_t *scope,
-	      dns_geoip_subtype_t subtype, int id)
-{
+do_lookup_int(const char *addr, dns_geoip_subtype_t subtype, int id) {
 	dns_geoip_elem_t elt;
 	struct in_addr in4;
 	isc_netaddr_t na;
@@ -179,7 +176,7 @@ do_lookup_int(const char *addr, isc_uint8_t *scope,
 	elt.subtype = subtype;
 	elt.as_int = id;
 
-	return (dns_geoip_match(&na, scope, &geoip, &elt));
+	return (dns_geoip_match(&na, &geoip, &elt));
 }
 
 /*
@@ -194,7 +191,6 @@ ATF_TC_HEAD(country, tc) {
 ATF_TC_BODY(country, tc) {
 	isc_result_t result;
 	isc_boolean_t match;
-	isc_uint8_t scope;
 
 	UNUSED(tc);
 
@@ -209,30 +205,25 @@ ATF_TC_BODY(country, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string("10.53.0.1", &scope,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_country_code, "AU");
 	ATF_CHECK(match);
-	ATF_CHECK_EQ(scope, 32);
 
-	match = do_lookup_string("10.53.0.1", &scope,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_country_code3, "AUS");
 	ATF_CHECK(match);
-	ATF_CHECK_EQ(scope, 32);
 
-	match = do_lookup_string("10.53.0.1", &scope,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_country_name, "Australia");
 	ATF_CHECK(match);
-	ATF_CHECK_EQ(scope, 32);
 
-	match = do_lookup_string("192.0.2.128", &scope,
+	match = do_lookup_string("192.0.2.128",
 				 dns_geoip_country_code, "O1");
 	ATF_CHECK(match);
-	ATF_CHECK_EQ(scope, 24);
 
-	match = do_lookup_string("192.0.2.128", &scope,
+	match = do_lookup_string("192.0.2.128",
 				 dns_geoip_country_name, "Other");
 	ATF_CHECK(match);
-	ATF_CHECK_EQ(scope, 24);
 
 	dns_test_end();
 }
@@ -245,7 +236,6 @@ ATF_TC_HEAD(country_v6, tc) {
 ATF_TC_BODY(country_v6, tc) {
 	isc_result_t result;
 	isc_boolean_t match;
-	isc_uint8_t scope;
 
 	UNUSED(tc);
 
@@ -260,20 +250,17 @@ ATF_TC_BODY(country_v6, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", &scope,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_country_code, "AU");
 	ATF_CHECK(match);
-	ATF_CHECK_EQ(scope, 128);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", &scope,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_country_code3, "AUS");
 	ATF_CHECK(match);
-	ATF_CHECK_EQ(scope, 128);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", &scope,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_country_name, "Australia");
 	ATF_CHECK(match);
-	ATF_CHECK_EQ(scope, 128);
 
 	dns_test_end();
 }
@@ -300,42 +287,42 @@ ATF_TC_BODY(city, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_city_continentcode, "NA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_city_countrycode, "US");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_city_countrycode3, "USA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_city_countryname, "United States");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_city_region, "CA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_city_regionname, "California");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_city_name, "Redwood City");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_city_postalcode, "94063");
 	ATF_CHECK(match);
 
-	match = do_lookup_int("10.53.0.1", NULL, dns_geoip_city_areacode, 650);
+	match = do_lookup_int("10.53.0.1", dns_geoip_city_areacode, 650);
 	ATF_CHECK(match);
 
-	match = do_lookup_int("10.53.0.1", NULL, dns_geoip_city_metrocode, 807);
+	match = do_lookup_int("10.53.0.1", dns_geoip_city_metrocode, 807);
 	ATF_CHECK(match);
 
 	dns_test_end();
@@ -363,36 +350,36 @@ ATF_TC_BODY(city_v6, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", NULL,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_city_continentcode, "NA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", NULL,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_city_countrycode, "US");
 	ATF_CHECK(match);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", NULL,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_city_countrycode3, "USA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", NULL,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_city_countryname,
 				    "United States");
 	ATF_CHECK(match);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", NULL,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_city_region, "CA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", NULL,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_city_regionname, "California");
 	ATF_CHECK(match);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", NULL,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_city_name, "Redwood City");
 	ATF_CHECK(match);
 
-	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1", NULL,
+	match = do_lookup_string_v6("fd92:7065:b8e:ffff::1",
 				    dns_geoip_city_postalcode, "94063");
 	ATF_CHECK(match);
 
@@ -422,15 +409,15 @@ ATF_TC_BODY(region, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_region_code, "CA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_region_name, "California");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.1", NULL,
+	match = do_lookup_string("10.53.0.1",
 				 dns_geoip_region_countrycode, "US");
 	ATF_CHECK(match);
 
@@ -464,30 +451,30 @@ ATF_TC_BODY(best, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countrycode, "US");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countrycode3, "USA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countryname, "United States");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_regionname, "Virginia");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_region, "VA");
 	ATF_CHECK(match);
 
 	GeoIP_delete(geoip.city_v4);
 	geoip.city_v4 = NULL;
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countrycode, "AU");
 	ATF_CHECK(match);
 
@@ -495,26 +482,26 @@ ATF_TC_BODY(best, tc) {
 	 * Note, region doesn't support code3 or countryname, so
 	 * the next two would be answered from the country database instead
 	 */
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countrycode3, "CAN");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countryname, "Canada");
 	ATF_CHECK(match);
 
 	GeoIP_delete(geoip.region);
 	geoip.region = NULL;
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countrycode, "CA");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countrycode3, "CAN");
 	ATF_CHECK(match);
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_countryname, "Canada");
 	ATF_CHECK(match);
 
@@ -545,7 +532,7 @@ ATF_TC_BODY(asnum, tc) {
 	}
 
 
-	match = do_lookup_string("10.53.0.3", NULL, dns_geoip_as_asnum,
+	match = do_lookup_string("10.53.0.3", dns_geoip_as_asnum,
 				 "AS100003 Three Network Labs");
 	ATF_CHECK(match);
 
@@ -574,7 +561,7 @@ ATF_TC_BODY(isp, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string("10.53.0.1", NULL, dns_geoip_isp_name,
+	match = do_lookup_string("10.53.0.1", dns_geoip_isp_name,
 				 "One Systems, Inc.");
 	ATF_CHECK(match);
 
@@ -603,7 +590,7 @@ ATF_TC_BODY(org, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string("10.53.0.2", NULL, dns_geoip_org_name,
+	match = do_lookup_string("10.53.0.2", dns_geoip_org_name,
 				 "Two Technology Ltd.");
 	ATF_CHECK(match);
 
@@ -632,7 +619,7 @@ ATF_TC_BODY(domain, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_string("10.53.0.4", NULL,
+	match = do_lookup_string("10.53.0.4",
 				 dns_geoip_domain_name, "four.com");
 	ATF_CHECK(match);
 
@@ -661,16 +648,16 @@ ATF_TC_BODY(netspeed, tc) {
 		atf_tc_skip("Database not available");
 	}
 
-	match = do_lookup_int("10.53.0.1", NULL, dns_geoip_netspeed_id, 0);
+	match = do_lookup_int("10.53.0.1", dns_geoip_netspeed_id, 0);
 	ATF_CHECK(match);
 
-	match = do_lookup_int("10.53.0.2", NULL, dns_geoip_netspeed_id, 1);
+	match = do_lookup_int("10.53.0.2", dns_geoip_netspeed_id, 1);
 	ATF_CHECK(match);
 
-	match = do_lookup_int("10.53.0.3", NULL, dns_geoip_netspeed_id, 2);
+	match = do_lookup_int("10.53.0.3", dns_geoip_netspeed_id, 2);
 	ATF_CHECK(match);
 
-	match = do_lookup_int("10.53.0.4", NULL, dns_geoip_netspeed_id, 3);
+	match = do_lookup_int("10.53.0.4", dns_geoip_netspeed_id, 3);
 	ATF_CHECK(match);
 
 	dns_test_end();

lib/dns/zone.c

@@ -13205,9 +13205,9 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	tsigkey = dns_message_gettsigkey(msg);
 	tsig = dns_tsigkey_identity(tsigkey);
 	if (i >= zone->masterscnt && zone->notify_acl != NULL &&
-	    dns_acl_match(&netaddr, tsig, NULL, 0, NULL, zone->notify_acl,
-			  &zone->view->aclenv, &match,
-			  NULL) == ISC_R_SUCCESS &&
+	    (dns_acl_match(&netaddr, tsig, zone->notify_acl,
+			   &zone->view->aclenv, &match,
+			   NULL) == ISC_R_SUCCESS) &&
 	    match > 0)
 	{
 		/* Accept notify. */

lib/isc/Makefile.in

@@ -52,11 +52,12 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
 		aes.@O@ assertions.@O@ backtrace.@O@ base32.@O@ base64.@O@ \
 		bind9.@O@ buffer.@O@ bufferlist.@O@ \
 		commandline.@O@ counter.@O@ crc64.@O@ error.@O@ event.@O@ \
-		hash.@O@ ht.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ \
-		hmacsha.@O@ httpd.@O@ iterated_hash.@O@ \
+		hash.@O@ ht.@O@ heap.@O@ hex.@O@ hmac.@O@ \
+		httpd.@O@ iterated_hash.@O@ \
 		lex.@O@ lfsr.@O@ lib.@O@ log.@O@ \
 		md5.@O@ mem.@O@ mutexblock.@O@ \
 		netaddr.@O@ netscope.@O@ pool.@O@ \
+		openssl_shim.@O@ \
 		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
 		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
 		rwlock.@O@ \
@@ -70,10 +71,11 @@ SYMTBLOBJS =	backtrace-emptytbl.@O@
 SRCS =		@ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
 		aes.c assertions.c backtrace.c base32.c base64.c bind9.c \
 		buffer.c bufferlist.c commandline.c counter.c crc64.c \
-		error.c event.c hash.c ht.c heap.c hex.c hmacmd5.c \
-		hmacsha.c httpd.c iterated_hash.c \
+		error.c event.c hash.c ht.c heap.c hex.c hmac.c \
+		httpd.c iterated_hash.c \
 		lex.c lfsr.c lib.c log.c \
 		md5.c mem.c mutexblock.c \
+		openssl_shim.c \
 		netaddr.c netscope.c pool.c \
 		parseint.c portset.c quota.c radix.c random.c \
 		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \

lib/isc/aes.c

@@ -27,18 +27,10 @@
 #include <openssl/opensslv.h>
 #include <openssl/evp.h>
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define EVP_CIPHER_CTX_new() &(_context), EVP_CIPHER_CTX_init(&_context)
-#define EVP_CIPHER_CTX_free(c) RUNTIME_CHECK(EVP_CIPHER_CTX_cleanup(c) == 1)
-#endif
-
 void
 isc_aes128_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out)
 {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif
 	EVP_CIPHER_CTX *c;
 	int len;
 
@@ -56,9 +48,6 @@ void
 isc_aes192_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out)
 {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif
 	EVP_CIPHER_CTX *c;
 	int len;
 
@@ -76,9 +65,6 @@ void
 isc_aes256_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out)
 {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif
 	EVP_CIPHER_CTX *c;
 	int len;
 

lib/isc/hmac.c

@@ -0,0 +1,386 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include "config.h"
+
+#include <isc/assertions.h>
+#include <isc/hmac.h>
+#include <isc/platform.h>
+#include <isc/safe.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
+#include <isc/string.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+static size_t
+isc_hmac_digestlength(isc_hmac_algo_t algo) {
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return 64;
+	case ISC_HMAC_ALGO_SHA1: return ISC_SHA1_BLOCK_LENGTH;
+	case ISC_HMAC_ALGO_SHA224: return ISC_SHA224_BLOCK_LENGTH;
+	case ISC_HMAC_ALGO_SHA256: return ISC_SHA256_BLOCK_LENGTH;
+	case ISC_HMAC_ALGO_SHA384: return ISC_SHA384_BLOCK_LENGTH;
+	case ISC_HMAC_ALGO_SHA512: return ISC_SHA512_BLOCK_LENGTH;
+	default:
+		REQUIRE(0);
+	}
+}	
+
+#define isc_hmac_blocklength(algo) isc_hmac_digestlength(algo)
+
+#ifdef OPENSSL
+
+#include <isc/openssl_shim.h>
+
+static const EVP_MD *
+isc_hmac_evp_md(isc_hmac_algo_t algo) {
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return EVP_md5(); break;
+	case ISC_HMAC_ALGO_SHA1: return EVP_sha1(); break;
+	case ISC_HMAC_ALGO_SHA224: return EVP_sha224(); break;
+	case ISC_HMAC_ALGO_SHA256: return EVP_sha256(); break;
+	case ISC_HMAC_ALGO_SHA384: return EVP_sha384(); break;
+	case ISC_HMAC_ALGO_SHA512: return EVP_sha512(); break;
+	default:
+		REQUIRE(0);
+	}
+}
+
+void
+isc_hmac_init_openssl(isc_hmac_t *ctx, const unsigned char *key, unsigned int len, isc_hmac_algo_t algo) {
+	ctx->ctx = HMAC_CTX_new();
+	RUNTIME_CHECK(ctx->ctx != NULL);
+	RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *)key, (int)len,
+				   isc_hmac_evp_md(algo), NULL) == 1);
+}
+
+void
+isc_hmac_invalidate_openssl(isc_hmac_t *ctx, isc_hmac_algo_t algo)
+{
+	UNUSED(algo);
+	if (ctx->ctx == NULL) {
+		return;
+	}
+	HMAC_CTX_free(ctx->ctx);
+	ctx->ctx = NULL;
+}
+
+void
+isc_hmac_update_openssl(isc_hmac_t *ctx, const unsigned char *buf, unsigned int len,
+		isc_hmac_algo_t algo)
+{
+	UNUSED(algo);
+	if (len == 0) {
+		return;
+	}
+	RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int)len) == 1);
+}
+
+
+void
+isc_hmac_sign_openssl(isc_hmac_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo)
+{
+	size_t digestlen = isc_hmac_digestlength(algo);
+	REQUIRE(len <= digestlen);
+
+	unsigned char newdigest[digestlen];
+
+	RUNTIME_CHECK(HMAC_Final(ctx->ctx, newdigest, NULL));
+	isc_hmac_invalidate_openssl(ctx, algo);
+	memcpy(digest, newdigest, len);
+	isc_safe_memwipe(newdigest, sizeof(newdigest));
+}
+
+isc_boolean_t
+isc_hmac_verify_openssl(isc_hmac_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo) {
+	size_t digestlen = isc_hmac_digestlength(algo);
+	unsigned char newdigest[digestlen];
+
+	REQUIRE(len <= digestlen);
+	isc_hmac_sign_openssl(ctx, newdigest, digestlen, algo);
+	return (isc_safe_memequal(digest, newdigest, len));
+}
+
+#elif PKCS11CRYPTO
+
+#include <pk11/internal.h>
+#include <pk11/pk11.h>
+#include <pkcs11/pkcs11.h>
+
+static CK_BBOOL truevalue = TRUE;
+static CK_BBOOL falsevalue = FALSE;
+
+static CK_MECHANISM_TYPE
+isc_hmac_mechanism_type_pkcs11(isc_hmac_algo_t algo)
+{
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return CKM_MD5_HMAC;
+	case ISC_HMAC_ALGO_SHA1: return CKM_SHA_1_HMAC;
+	case ISC_HMAC_ALGO_SHA224: return CKM_SHA224_HMAC;
+	case ISC_HMAC_ALGO_SHA256: return CKM_SHA256_HMAC;
+	case ISC_HMAC_ALGO_SHA384: return CKM_SHA384_HMAC;
+	case ISC_HMAC_ALGO_SHA512: return CKM_SHA512_HMAC;
+	default:
+		REQUIRE(0);
+	}
+}
+
+static CK_KEY_TYPE
+isc_hmac_key_type_pkcs11(isc_hmac_algo_t algo)
+{
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return CKK_MD5_HMAC;
+	case ISC_HMAC_ALGO_SHA1: return CKK_SHA_1_HMAC;
+	case ISC_HMAC_ALGO_SHA224: return CKK_SHA224_HMAC;
+	case ISC_HMAC_ALGO_SHA256: return CKK_SHA256_HMAC;
+	case ISC_HMAC_ALGO_SHA384: return CKK_SHA384_HMAC;
+	case ISC_HMAC_ALGO_SHA512: return CKK_SHA512_HMAC;
+	default:
+		REQUIRE(0);
+	}
+}
+
+void
+isc_hmac_init_pkcs11(isc_hmac_t *ctx, const unsigned char *key,
+	      unsigned int len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	CK_MECHANISM mech = { isc_hmac_mechanism_type_pkcs11(algo), NULL, 0 };
+	CK_OBJECT_CLASS keyClass = CKO_SECRET_KEY;
+	CK_KEY_TYPE keyType = isc_hmac_key_type_pkcs11(algo);
+	CK_ATTRIBUTE keyTemplate[] =
+	{
+		{ CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },
+		{ CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
+		{ CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
+		{ CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
+		{ CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },
+		{ CKA_VALUE, NULL, (CK_ULONG) len }
+	};
+#ifdef PK11_PAD_HMAC_KEYS
+	size_t digestlen = isc_hmac_digestlength(algo);
+	CK_BYTE keypad[digestlen];
+
+	if (len < digestlen) {
+		memset(keypad, 0, digestlen);
+		memcpy(keypad, key, len);
+		keyTemplate[5].pValue = keypad;
+		keyTemplate[5].ulValueLen = digestlen;
+	} else {
+		DE_CONST(key, keyTemplate[5].pValue);
+	}
+#else
+	DE_CONST(key, keyTemplate[5].pValue);
+#endif
+	RUNTIME_CHECK(pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
+				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS);
+	ctx->object = CK_INVALID_HANDLE;
+	PK11_FATALCHECK(pkcs_C_CreateObject,
+			(ctx->session, keyTemplate,
+			 (CK_ULONG) 6, &ctx->object));
+	INSIST(ctx->object != CK_INVALID_HANDLE);
+	PK11_FATALCHECK(pkcs_C_SignInit, (ctx->session, &mech, ctx->object));
+}
+
+void
+isc_hmac_invalidate_pkcs11(isc_hmac_t *ctx, isc_hmac_algo_t algo) {
+	CK_ULONG digestlen = (CK_ULONG)isc_hmac_digestlength(algo);
+	CK_BYTE garbage[digestlen];
+
+	if (ctx->handle == NULL) {
+		return;
+	}
+	(void) pkcs_C_SignFinal(ctx->session, garbage, &digestlen);
+	isc_safe_memwipe(garbage, sizeof(garbage));
+	if (ctx->object != CK_INVALID_HANDLE) {
+		(void) pkcs_C_DestroyObject(ctx->session, ctx->object);
+	}
+	ctx->object = CK_INVALID_HANDLE;
+	pk11_return_session(ctx);
+}
+
+void
+isc_hmac_update_pkcs11(isc_hmac_t *ctx, const unsigned char *buf,
+		    unsigned int len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	CK_BYTE_PTR pPart;
+
+	UNUSED(algo);
+	
+	DE_CONST(buf, pPart);
+	PK11_FATALCHECK(pkcs_C_SignUpdate,
+			(ctx->session, pPart, (CK_ULONG) len));
+}
+
+void
+isc_hmac_sign_pkcs11(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo) {
+	CK_RV rv;
+	size_t digestlen = isc_hmac_digestlength(algo);
+	CK_BYTE newdigest[digestlen];
+	CK_ULONG psl = digestlen;
+
+	REQUIRE(len <= digestlen);
+
+	PK11_FATALCHECK(pkcs_C_SignFinal, (ctx->session, newdigest, &psl));
+	if (ctx->object != CK_INVALID_HANDLE)
+		(void) pkcs_C_DestroyObject(ctx->session, ctx->object);
+	ctx->object = CK_INVALID_HANDLE;
+	pk11_return_session(ctx);
+	memmove(digest, newdigest, len);
+	isc_safe_memwipe(newdigest, sizeof(newdigest));
+}
+
+isc_boolean_t
+isc_hmac_verify_pkcs11(isc_hmac_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo) {
+	size_t digestlen = isc_hmac_digestlength(algo);
+	unsigned char newdigest[digestlen];
+
+	REQUIRE(len <= digestlen);
+	isc_hmac_sign_pkcs11(ctx, newdigest, digestlen, algo);
+	return (isc_safe_memequal(digest, newdigest, len));
+}
+
+#define PADLEN 64
+#define IPAD 0x36
+#define OPAD 0x5C
+
+static CK_MECHANISM_TYPE
+isc_hmac_mechanism_type_pkcs11_replace(isc_hmac_algo_t algo)
+{
+	switch (algo) {
+	case ISC_HMAC_ALGO_MD5: return CKM_MD5;
+	case ISC_HMAC_ALGO_SHA1: return CKM_SHA_1;
+	case ISC_HMAC_ALGO_SHA224: return CKM_SHA224;
+	case ISC_HMAC_ALGO_SHA256: return CKM_SHA256;
+	case ISC_HMAC_ALGO_SHA384: return CKM_SHA384;
+	case ISC_HMAC_ALGO_SHA512: return CKM_SHA512;
+	default:
+		REQUIRE(0);
+	}
+}
+
+void
+isc_hmac_init_pkcs11_replace(isc_hmacsha1_t *ctx, const unsigned char *key,
+	      unsigned int len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	CK_MECHANISM mech = { isc_hmac_mechanism_type_pkcs11_replace(algo), NULL, 0 };
+	size_t blocklen = isc_hmac_blocklength(algo);
+	unsigned char ipad[blocklen];
+	unsigned int i;
+
+	RUNTIME_CHECK(pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
+				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS);
+	RUNTIME_CHECK((ctx->key = pk11_mem_get(blocklen)) != NULL);
+	if (len > blocklen) {
+		CK_BYTE_PTR kPart;
+		CK_ULONG kl;
+
+		PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
+		DE_CONST(key, kPart);
+		PK11_FATALCHECK(pkcs_C_DigestUpdate,
+				(ctx->session, kPart, (CK_ULONG) len));
+		kl = blocklen;
+		PK11_FATALCHECK(pkcs_C_DigestFinal,
+				(ctx->session, (CK_BYTE_PTR) ctx->key, &kl));
+	} else {
+		memcpy(ctx->key, key, len);
+	}
+	PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
+	memset(ipad, IPAD, blocklen);
+	for (i = 0; i < blocklen; i++) {
+		ipad[i] ^= ctx->key[i];
+	}
+	PK11_FATALCHECK(pkcs_C_DigestUpdate,
+			(ctx->session, ipad,
+			 (CK_ULONG) blocklen));
+}
+
+void
+isc_hmac_invalidate_pkcs11_replace(isc_hmac_t *ctx, isc_hmac_algo_t algo) {
+	size_t blocklen = isc_hmac_blocklength(algo);
+	CK_BYTE garbage[blocklen];
+	CK_ULONG len = blocklen;
+
+	if (ctx->key != NULL) {
+		pk11_mem_put(ctx->key, blocklen);
+		ctx->key = NULL;
+	}
+
+	if (ctx->handle == NULL) {
+		return;
+	}
+	(void) pkcs_C_DigestFinal(ctx->session, garbage, &len);
+	isc_safe_memwipe(garbage, sizeof(garbage));
+	pk11_return_session(ctx);
+}
+
+void
+isc_hmac_update_pkcs11_replace(isc_hmac_t *ctx, const unsigned char *buf,
+			       unsigned int len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	CK_BYTE_PTR pPart;
+
+	UNUSED(algo);
+	
+	DE_CONST(buf, pPart);
+	PK11_FATALCHECK(pkcs_C_DigestUpdate,
+			(ctx->session, pPart, (CK_ULONG) len));
+}
+
+void
+isc_hmac_sign_pkcs11_replace(isc_hmacsha1_t *ctx, unsigned char *digest,
+			      size_t len, isc_hmac_algo_t algo)
+{
+	CK_RV rv;
+	size_t digestlen = isc_hmac_digestlength(algo);
+	size_t blocklen = isc_hmac_blocklength(algo);
+	CK_BYTE newdigest[digestlen];
+	CK_ULONG psl = digestlen;
+	CK_MECHANISM mech = { isc_hmac_mechanism_type_pkcs11_replace(algo), NULL, 0 };
+	CK_BYTE opad[blocklen];
+	unsigned int i;
+
+	REQUIRE(len <= digestlen);
+
+	PK11_FATALCHECK(pkcs_C_DigestFinal, (ctx->session, newdigest, &psl));
+	memset(opad, OPAD, blocklen);
+	for (i = 0; i < blocklen; i++) {
+		opad[i] ^= ctx->key[i];
+	}
+	pk11_mem_put(ctx->key, blocklen);
+	ctx->key = NULL;
+	PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
+	PK11_FATALCHECK(pkcs_C_DigestUpdate,
+			(ctx->session, opad,
+			 (CK_ULONG) blocklen));
+	PK11_FATALCHECK(pkcs_C_DigestUpdate,
+			(ctx->session, (CK_BYTE_PTR) newdigest, psl));
+	PK11_FATALCHECK(pkcs_C_DigestFinal, (ctx->session, newdigest, &psl));
+	pk11_return_session(ctx);
+	memmove(digest, newdigest, len);
+	isc_safe_memwipe(newdigest, sizeof(newdigest));
+}
+
+isc_boolean_t
+isc_hmac_verify_pkcs11_replace(isc_hmac_t *ctx, unsigned char *digest, size_t len, isc_hmac_algo_t algo) {
+	size_t digestlen = isc_hmac_digestlength(algo);
+	unsigned char newdigest[digestlen];
+
+	REQUIRE(len <= digestlen);
+	isc_hmac_sign_pkcs11_replace(ctx, newdigest, digestlen, algo);
+	return (isc_safe_memequal(digest, newdigest, len));
+}
+
+#endif /* OPENSSL || PKCS11CRYPTO */

lib/isc/hmacmd5.c

@@ -1,419 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file
- * This code implements the HMAC-MD5 keyed hash algorithm
- * described in RFC2104.
- */
-
-#include "config.h"
-
-#include <pk11/site.h>
-
-#ifndef PK11_MD5_DISABLE
-
-#include <isc/assertions.h>
-#include <isc/hmacmd5.h>
-#include <isc/md5.h>
-#include <isc/platform.h>
-#include <isc/safe.h>
-#include <isc/string.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#if HAVE_PKCS11
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-#endif
-
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define HMAC_CTX_new() &(ctx->_ctx), HMAC_CTX_init(&(ctx->_ctx))
-#define HMAC_CTX_free(ptr) HMAC_CTX_cleanup(ptr)
-#endif
-
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len)
-{
-	ctx->ctx = HMAC_CTX_new();
-	RUNTIME_CHECK(ctx->ctx != NULL);
-	RUNTIME_CHECK(HMAC_Init_ex(ctx->ctx, (const void *) key,
-				   (int) len, EVP_md5(), NULL) == 1);
-}
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
-	if (ctx->ctx == NULL)
-		return;
-	HMAC_CTX_free(ctx->ctx);
-	ctx->ctx = NULL;
-}
-
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len)
-{
-	RUNTIME_CHECK(HMAC_Update(ctx->ctx, buf, (int) len) == 1);
-}
-
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	RUNTIME_CHECK(HMAC_Final(ctx->ctx, digest, NULL) == 1);
-	HMAC_CTX_free(ctx->ctx);
-	ctx->ctx = NULL;
-}
-
-#elif HAVE_PKCS11
-
-#ifndef PK11_MD5_HMAC_REPLACE
-
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len)
-{
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_MD5_HMAC, NULL, 0 };
-	CK_OBJECT_CLASS keyClass = CKO_SECRET_KEY;
-	CK_KEY_TYPE keyType = CKK_MD5_HMAC;
-	CK_ATTRIBUTE keyTemplate[] =
-	{
-		{ CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },
-		{ CKA_VALUE, NULL, (CK_ULONG) len }
-	};
-#ifdef PK11_PAD_HMAC_KEYS
-	CK_BYTE keypad[ISC_MD5_DIGESTLENGTH];
-
-	if (len < ISC_MD5_DIGESTLENGTH) {
-		memset(keypad, 0, ISC_MD5_DIGESTLENGTH);
-		memmove(keypad, key, len);
-		keyTemplate[5].pValue = keypad;
-		keyTemplate[5].ulValueLen = ISC_MD5_DIGESTLENGTH;
-	} else
-		DE_CONST(key, keyTemplate[5].pValue);
-#else
-	DE_CONST(key, keyTemplate[5].pValue);
-#endif
-	RUNTIME_CHECK(pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
-				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS);
-	ctx->object = CK_INVALID_HANDLE;
-	PK11_FATALCHECK(pkcs_C_CreateObject,
-			(ctx->session, keyTemplate,
-			 (CK_ULONG) 6, &ctx->object));
-	INSIST(ctx->object != CK_INVALID_HANDLE);
-	PK11_FATALCHECK(pkcs_C_SignInit, (ctx->session, &mech, ctx->object));
-}
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
-	CK_BYTE garbage[ISC_MD5_DIGESTLENGTH];
-	CK_ULONG len = ISC_MD5_DIGESTLENGTH;
-
-	if (ctx->handle == NULL)
-		return;
-	(void) pkcs_C_SignFinal(ctx->session, garbage, &len);
-	isc_safe_memwipe(garbage, sizeof(garbage));
-	if (ctx->object != CK_INVALID_HANDLE)
-		(void) pkcs_C_DestroyObject(ctx->session, ctx->object);
-	ctx->object = CK_INVALID_HANDLE;
-	pk11_return_session(ctx);
-}
-
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len)
-{
-	CK_RV rv;
-	CK_BYTE_PTR pPart;
-
-	DE_CONST(buf, pPart);
-	PK11_FATALCHECK(pkcs_C_SignUpdate,
-			(ctx->session, pPart, (CK_ULONG) len));
-}
-
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	CK_RV rv;
-	CK_ULONG len = ISC_MD5_DIGESTLENGTH;
-
-	PK11_FATALCHECK(pkcs_C_SignFinal,
-			(ctx->session, (CK_BYTE_PTR) digest, &len));
-	if (ctx->object != CK_INVALID_HANDLE)
-		(void) pkcs_C_DestroyObject(ctx->session, ctx->object);
-	ctx->object = CK_INVALID_HANDLE;
-	pk11_return_session(ctx);
-}
-#else
-/* Replace missing CKM_MD5_HMAC PKCS#11 mechanism */
-
-#define PADLEN 64
-#define IPAD 0x36
-#define OPAD 0x5C
-
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len)
-{
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_MD5, NULL, 0 };
-	unsigned char ipad[PADLEN];
-	unsigned int i;
-
-	RUNTIME_CHECK(pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
-				       ISC_FALSE, NULL, 0) == ISC_R_SUCCESS);
-	RUNTIME_CHECK((ctx->key = pk11_mem_get(PADLEN)) != NULL);
-	if (len > PADLEN) {
-		CK_BYTE_PTR kPart;
-		CK_ULONG kl;
-
-		PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
-		DE_CONST(key, kPart);
-		PK11_FATALCHECK(pkcs_C_DigestUpdate,
-				(ctx->session, kPart, (CK_ULONG) len));
-		kl = ISC_MD5_DIGESTLENGTH;
-		PK11_FATALCHECK(pkcs_C_DigestFinal,
-				(ctx->session, (CK_BYTE_PTR) ctx->key, &kl));
-	} else
-		memmove(ctx->key, key, len);
-	PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
-	memset(ipad, IPAD, PADLEN);
-	for (i = 0; i < PADLEN; i++)
-		ipad[i] ^= ctx->key[i];
-	PK11_FATALCHECK(pkcs_C_DigestUpdate,
-			(ctx->session, ipad, (CK_ULONG) PADLEN));
-}
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
-	if (ctx->key != NULL)
-		pk11_mem_put(ctx->key, PADLEN);
-	ctx->key = NULL;
-	isc_md5_invalidate(ctx);
-}
-
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len)
-{
-	CK_RV rv;
-	CK_BYTE_PTR pPart;
-
-	DE_CONST(buf, pPart);
-	PK11_FATALCHECK(pkcs_C_DigestUpdate,
-			(ctx->session, pPart, (CK_ULONG) len));
-}
-
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_MD5, NULL, 0 };
-	CK_ULONG len = ISC_MD5_DIGESTLENGTH;
-	CK_BYTE opad[PADLEN];
-	unsigned int i;
-
-	PK11_FATALCHECK(pkcs_C_DigestFinal,
-			(ctx->session, (CK_BYTE_PTR) digest,
-			 (CK_ULONG_PTR) &len));
-	memset(opad, OPAD, PADLEN);
-	for (i = 0; i < PADLEN; i++)
-		opad[i] ^= ctx->key[i];
-	pk11_mem_put(ctx->key, PADLEN);
-	ctx->key = NULL;
-	PK11_FATALCHECK(pkcs_C_DigestInit, (ctx->session, &mech));
-	PK11_FATALCHECK(pkcs_C_DigestUpdate,
-			(ctx->session, opad, (CK_ULONG) PADLEN));
-	PK11_FATALCHECK(pkcs_C_DigestUpdate,
-			(ctx->session, (CK_BYTE_PTR) digest, len));
-	PK11_FATALCHECK(pkcs_C_DigestFinal,
-			(ctx->session,
-			 (CK_BYTE_PTR) digest,
-			 (CK_ULONG_PTR) &len));
-	pk11_return_session(ctx);
-}
-#endif
-
-#else
-
-#define PADLEN 64
-#define IPAD 0x36
-#define OPAD 0x5C
-
-/*!
- * Start HMAC-MD5 process.  Initialize an md5 context and digest the key.
- */
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len)
-{
-	unsigned char ipad[PADLEN];
-	int i;
-
-	memset(ctx->key, 0, sizeof(ctx->key));
-	if (len > sizeof(ctx->key)) {
-		isc_md5_t md5ctx;
-		isc_md5_init(&md5ctx);
-		isc_md5_update(&md5ctx, key, len);
-		isc_md5_final(&md5ctx, ctx->key);
-	} else
-		memmove(ctx->key, key, len);
-
-	isc_md5_init(&ctx->md5ctx);
-	memset(ipad, IPAD, sizeof(ipad));
-	for (i = 0; i < PADLEN; i++)
-		ipad[i] ^= ctx->key[i];
-	isc_md5_update(&ctx->md5ctx, ipad, sizeof(ipad));
-}
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
-	isc_md5_invalidate(&ctx->md5ctx);
-	isc_safe_memwipe(ctx->key, sizeof(ctx->key));
-}
-
-/*!
- * Update context to reflect the concatenation of another buffer full
- * of bytes.
- */
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len)
-{
-	isc_md5_update(&ctx->md5ctx, buf, len);
-}
-
-/*!
- * Compute signature - finalize MD5 operation and reapply MD5.
- */
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	unsigned char opad[PADLEN];
-	int i;
-
-	isc_md5_final(&ctx->md5ctx, digest);
-
-	memset(opad, OPAD, sizeof(opad));
-	for (i = 0; i < PADLEN; i++)
-		opad[i] ^= ctx->key[i];
-
-	isc_md5_init(&ctx->md5ctx);
-	isc_md5_update(&ctx->md5ctx, opad, sizeof(opad));
-	isc_md5_update(&ctx->md5ctx, digest, ISC_MD5_DIGESTLENGTH);
-	isc_md5_final(&ctx->md5ctx, digest);
-	isc_hmacmd5_invalidate(ctx);
-}
-
-#endif /* !ISC_PLATFORM_OPENSSLHASH */
-
-/*!
- * Verify signature - finalize MD5 operation and reapply MD5, then
- * compare to the supplied digest.
- */
-isc_boolean_t
-isc_hmacmd5_verify(isc_hmacmd5_t *ctx, unsigned char *digest) {
-	return (isc_hmacmd5_verify2(ctx, digest, ISC_MD5_DIGESTLENGTH));
-}
-
-isc_boolean_t
-isc_hmacmd5_verify2(isc_hmacmd5_t *ctx, unsigned char *digest, size_t len) {
-	unsigned char newdigest[ISC_MD5_DIGESTLENGTH];
-
-	REQUIRE(len <= ISC_MD5_DIGESTLENGTH);
-	isc_hmacmd5_sign(ctx, newdigest);
-	return (isc_safe_memequal(digest, newdigest, len));
-}
-
-/*
- * Check for MD5 support; if it does not work, raise a fatal error.
- *
- * Use the first test vector from RFC 2104, with a second round using
- * a too-short key.
- *
- * Standard use is testing 0 and expecting result true.
- * Testing use is testing 1..4 and expecting result false.
- */
-isc_boolean_t
-isc_hmacmd5_check(int testing) {
-	isc_hmacmd5_t ctx;
-	unsigned char key[] = { /* 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b */
-		0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
-		0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b
-	};
-	unsigned char input[] = { /* "Hi There" */
-		0x48, 0x69, 0x20, 0x54, 0x68, 0x65, 0x72, 0x65
-	};
-	unsigned char expected[] = {
-		0x92, 0x94, 0x72, 0x7a, 0x36, 0x38, 0xbb, 0x1c,
-		0x13, 0xf4, 0x8e, 0xf8, 0x15, 0x8b, 0xfc, 0x9d
-	};
-	unsigned char expected2[] = {
-		0xad, 0xb8, 0x48, 0x05, 0xb8, 0x8d, 0x03, 0xe5,
-		0x90, 0x1e, 0x4b, 0x05, 0x69, 0xce, 0x35, 0xea
-	};
-	isc_boolean_t result;
-
-	/*
-	 * Introduce a fault for testing.
-	 */
-	switch (testing) {
-	case 0:
-	default:
-		break;
-	case 1:
-		key[0] ^= 0x01;
-		break;
-	case 2:
-		input[0] ^= 0x01;
-		break;
-	case 3:
-		expected[0] ^= 0x01;
-		break;
-	case 4:
-		expected2[0] ^= 0x01;
-		break;
-	}
-
-	/*
-	 * These functions do not return anything; any failure will be fatal.
-	 */
-	isc_hmacmd5_init(&ctx, key, 16U);
-	isc_hmacmd5_update(&ctx, input, 8U);
-	result = isc_hmacmd5_verify2(&ctx, expected, sizeof(expected));
-	if (!result) {
-		return (result);
-	}
-
-	/* Second round using a byte key */
-	isc_hmacmd5_init(&ctx, key, 1U);
-	isc_hmacmd5_update(&ctx, input, 8U);
-	return (isc_hmacmd5_verify2(&ctx, expected2, sizeof(expected2)));
-}
-
-#else /* !PK11_MD5_DISABLE */
-#ifdef WIN32
-/* Make the Visual Studio linker happy */
-#include <isc/util.h>
-
-void isc_hmacmd5_init() { INSIST(0); }
-void isc_hmacmd5_invalidate() { INSIST(0); }
-void isc_hmacmd5_sign() { INSIST(0); }
-void isc_hmacmd5_update() { INSIST(0); }
-void isc_hmacmd5_verify() { INSIST(0); }
-void isc_hmacmd5_verify2() { INSIST(0); }
-void isc_hmacmd5_check() { INSIST(0); }
-#endif
-#endif /* PK11_MD5_DISABLE */

lib/isc/include/isc/Makefile.in

@@ -23,7 +23,7 @@ HEADERS =	aes.h app.h assertions.h backtrace.h base32.h base64.h \
 		commandline.h counter.h crc64.h deprecated.h \
 		entropy.h errno.h error.h event.h eventclass.h \
 		file.h formatcheck.h fsaccess.h fuzz.h \
-		hash.h heap.h hex.h hmacmd5.h hmacsha.h ht.h httpd.h \
+		hash.h heap.h hex.h hmac.h ht.h httpd.h \
 		interfaceiter.h @ISC_IPV6_H@ iterated_hash.h \
 		json.h lang.h lex.h lfsr.h lib.h likely.h list.h log.h \
 		magic.h md5.h mem.h meminfo.h msgcat.h msgs.h mutexblock.h \

lib/isc/include/isc/hmac.h

@@ -0,0 +1,237 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#ifndef ISC_HMAC_H
+#define ISC_HMAC_H
+
+#include <config.h>
+
+#include <isc/types.h>
+#include <isc/platform.h>
+#include <isc/md5.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
+
+typedef enum {
+	ISC_HMAC_MD5_DIGESTLENGTH	= ISC_MD5_BLOCK_LENGTH,
+	ISC_HMAC_SHA1_DIGESTLENGTH	= ISC_SHA1_BLOCK_LENGTH,
+	ISC_HMAC_SHA224_DIGESTLENGTH	= ISC_SHA224_BLOCK_LENGTH,
+	ISC_HMAC_SHA256_DIGESTLENGTH	= ISC_SHA256_BLOCK_LENGTH,
+	ISC_HMAC_SHA384_DIGESTLENGTH	= ISC_SHA384_BLOCK_LENGTH,
+	ISC_HMAC_SHA512_DIGESTLENGTH	= ISC_SHA512_BLOCK_LENGTH
+} isc_hmac_digestlen_t;
+
+typedef enum {
+	ISC_HMAC_ALGO_MD5,
+	ISC_HMAC_ALGO_SHA1,
+	ISC_HMAC_ALGO_SHA224,
+	ISC_HMAC_ALGO_SHA256,
+	ISC_HMAC_ALGO_SHA384,
+	ISC_HMAC_ALGO_SHA512,
+	ISC_HMAC_ALOG_MAX = ISC_HMAC_ALGO_SHA512
+} isc_hmac_algo_t;
+
+#define isc_hmacmd5_t isc_hmac_t
+#define isc_hmacsha1_t isc_hmac_t
+#define isc_hmacsha224_t isc_hmac_t
+#define isc_hmacsha256_t isc_hmac_t
+#define isc_hmacsha384_t isc_hmac_t
+#define isc_hmacsha512_t isc_hmac_t
+
+#ifdef OPENSSL
+#include <openssl/hmac.h>
+
+/* OpenSSL 1.1 compatibility wrappers */
+typedef struct {
+	HMAC_CTX *ctx;
+} isc_hmac_t;
+
+#define isc_hmacmd5_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+
+#define isc_hmacsha1_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+
+#define isc_hmacsha224_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+
+#define isc_hmacsha256_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+
+#define isc_hmacsha384_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+
+#define isc_hmacsha512_init(ctx, key, len) isc_hmac_init_openssl(ctx, key, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_invalidate(ctx) isc_hmac_invalidate_openssl(ctx, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_update(ctx, buf, len) isc_hmac_update_openssl(ctx, buf, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_sign(ctx, digest, len) isc_hmac_sign_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_verify(ctx, digest, len) isc_hmac_verify_openssl(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+
+void
+isc_hmac_init_openssl(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_invalidate_openssl(isc_hmac_t *, isc_hmac_algo_t)
+	__attribute__((nonnull(1)));
+
+void
+isc_hmac_update_openssl(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t)
+	__attribute__((nonnull(1)));
+
+void
+isc_hmac_sign_openssl(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t)
+	__attribute__((nonnull(1)));
+
+isc_boolean_t
+isc_hmac_verify_openssl(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t)
+	__attribute__((nonnull(1)));
+
+#elif PKCS11CRYPTO
+
+typedef pk11_context_t isc_hmac_t;
+
+#ifdef PK11_MD5_HMAC_REPLACE
+#define isc_hmacmd5_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#else
+#define isc_hmacmd5_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#define isc_hmacmd5_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_MD5)
+#endif
+
+#ifdef PK11_SHA_1_HMAC_REPLACE
+#define isc_hmacsha1_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#else
+#define isc_hmacsha1_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#define isc_hmacsha1_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA1)
+#endif	
+
+#ifdef PK11_SHA224_HMAC_REPLACE
+#define isc_hmacsha224_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#else
+#define isc_hmacsha224_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#define isc_hmacsha224_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA224)
+#endif
+
+#ifdef PK11_SHA256_HMAC_REPLACE
+#define isc_hmacsha256_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#else
+#define isc_hmacsha256_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#define isc_hmacsha256_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA256)
+#endif
+
+#ifdef PK11_SHA384_HMAC_REPLACE
+#define isc_hmacsha384_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#else
+#define isc_hmacsha384_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#define isc_hmacsha384_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA384)
+#endif
+
+#ifdef PK11_SHA512_HMAC_REPLACE
+#define isc_hmacsha512_init(ctx, key, len) isc_hmac_init_pkcs11_replace(ctx, key, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_invalidate(ctx) isc_hmac_invalidate_pkcs11_replace(ctx, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_update(ctx, buf, len) isc_hmac_update_pkcs11_replace(ctx, buf, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_sign(ctx, digest, len) isc_hmac_sign_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_verify(ctx, digest, len) isc_hmac_verify_pkcs11_replace(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#else
+#define isc_hmacsha512_init(ctx, key, len) isc_hmac_init_pkcs11(ctx, key, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_invalidate(ctx) isc_hmac_invalidate_pkcs11(ctx, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_update(ctx, buf, len) isc_hmac_update_pkcs11(ctx, buf, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_sign(ctx, digest, len) isc_hmac_sign_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#define isc_hmacsha512_verify(ctx, digest, len) isc_hmac_verify_pkcs11(ctx, digest, len, ISC_HMAC_ALGO_SHA512)
+#endif
+
+void
+isc_hmac_init_pkcs11(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_invalidate_pkcs11(isc_hmac_t *, isc_hmac_algo_t);
+
+void
+isc_hmac_update_pkcs11(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_sign_pkcs11(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t);
+
+isc_boolean_t
+isc_hmac_verify_pkcs11(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t);
+
+void
+isc_hmac_init_pkcs11_replace(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_invalidate_pkcs11_replace(isc_hmac_t *, isc_hmac_algo_t);
+
+void
+isc_hmac_update_pkcs11_replace(isc_hmac_t *, const unsigned char *, unsigned int, isc_hmac_algo_t);
+
+void
+isc_hmac_sign_pkcs11_replace(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t);
+
+isc_boolean_t
+isc_hmac_verify_pkcs11_replace(isc_hmac_t *, unsigned char *, size_t, isc_hmac_algo_t);
+
+#else
+
+#error Either OpenSSL or PKCS#11 cryptographic provider is mandatory.
+
+#endif
+
+
+#endif /* ISC_HMAC_H */

lib/isc/include/isc/hmacmd5.h

@@ -1,85 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-
-/*! \file isc/hmacmd5.h
- * \brief This is the header file for the HMAC-MD5 keyed hash algorithm
- * described in RFC2104.
- */
-
-#ifndef ISC_HMACMD5_H
-#define ISC_HMACMD5_H 1
-
-#include <pk11/site.h>
-
-#ifndef PK11_MD5_DISABLE
-
-#include <isc/lang.h>
-#include <isc/md5.h>
-#include <isc/platform.h>
-#include <isc/types.h>
-
-#define ISC_HMACMD5_KEYLENGTH 64
-
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#include <openssl/opensslv.h>
-#include <openssl/hmac.h>
-
-typedef struct {
-	HMAC_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	HMAC_CTX _ctx;
-#endif
-} isc_hmacmd5_t;
-
-#elif HAVE_PKCS11
-#include <pk11/pk11.h>
-
-typedef pk11_context_t isc_hmacmd5_t;
-
-#else
-
-typedef struct {
-	isc_md5_t md5ctx;
-	unsigned char key[ISC_HMACMD5_KEYLENGTH];
-} isc_hmacmd5_t;
-#endif
-
-ISC_LANG_BEGINDECLS
-
-void
-isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key,
-		 unsigned int len);
-
-void
-isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx);
-
-void
-isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
-		   unsigned int len);
-
-void
-isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest);
-
-isc_boolean_t
-isc_hmacmd5_verify(isc_hmacmd5_t *ctx, unsigned char *digest);
-
-isc_boolean_t
-isc_hmacmd5_verify2(isc_hmacmd5_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacmd5_check(int testing);
-
-ISC_LANG_ENDDECLS
-
-#endif /* !PK11_MD5_DISABLE */
-
-#endif /* ISC_HMACMD5_H */

lib/isc/include/isc/hmacsha.h

@@ -1,183 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-
-/*! \file isc/hmacsha.h
- * This is the header file for the HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
- * HMAC-SHA334 and HMAC-SHA512 hash algorithm described in RFC 2104.
- */
-
-#ifndef ISC_HMACSHA_H
-#define ISC_HMACSHA_H 1
-
-#include <isc/lang.h>
-#include <isc/platform.h>
-#include <isc/sha1.h>
-#include <isc/sha2.h>
-#include <isc/types.h>
-
-#define ISC_HMACSHA1_KEYLENGTH ISC_SHA1_BLOCK_LENGTH
-#define ISC_HMACSHA224_KEYLENGTH ISC_SHA224_BLOCK_LENGTH
-#define ISC_HMACSHA256_KEYLENGTH ISC_SHA256_BLOCK_LENGTH
-#define ISC_HMACSHA384_KEYLENGTH ISC_SHA384_BLOCK_LENGTH
-#define ISC_HMACSHA512_KEYLENGTH ISC_SHA512_BLOCK_LENGTH
-
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#include <openssl/opensslv.h>
-#include <openssl/hmac.h>
-
-typedef struct {
-	HMAC_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	HMAC_CTX _ctx;
-#endif
-} isc_hmacsha_t;
-
-typedef isc_hmacsha_t isc_hmacsha1_t;
-typedef isc_hmacsha_t isc_hmacsha224_t;
-typedef isc_hmacsha_t isc_hmacsha256_t;
-typedef isc_hmacsha_t isc_hmacsha384_t;
-typedef isc_hmacsha_t isc_hmacsha512_t;
-
-#elif HAVE_PKCS11
-#include <pk11/pk11.h>
-
-typedef pk11_context_t isc_hmacsha1_t;
-typedef pk11_context_t isc_hmacsha224_t;
-typedef pk11_context_t isc_hmacsha256_t;
-typedef pk11_context_t isc_hmacsha384_t;
-typedef pk11_context_t isc_hmacsha512_t;
-
-#else
-
-typedef struct {
-	isc_sha1_t sha1ctx;
-	unsigned char key[ISC_HMACSHA1_KEYLENGTH];
-} isc_hmacsha1_t;
-
-typedef struct {
-	isc_sha224_t sha224ctx;
-	unsigned char key[ISC_HMACSHA224_KEYLENGTH];
-} isc_hmacsha224_t;
-
-typedef struct {
-	isc_sha256_t sha256ctx;
-	unsigned char key[ISC_HMACSHA256_KEYLENGTH];
-} isc_hmacsha256_t;
-
-typedef struct {
-	isc_sha384_t sha384ctx;
-	unsigned char key[ISC_HMACSHA384_KEYLENGTH];
-} isc_hmacsha384_t;
-
-typedef struct {
-	isc_sha512_t sha512ctx;
-	unsigned char key[ISC_HMACSHA512_KEYLENGTH];
-} isc_hmacsha512_t;
-#endif
-
-ISC_LANG_BEGINDECLS
-
-void
-isc_hmacsha1_init(isc_hmacsha1_t *ctx, const unsigned char *key,
-		  unsigned int len);
-
-void
-isc_hmacsha1_invalidate(isc_hmacsha1_t *ctx);
-
-void
-isc_hmacsha1_update(isc_hmacsha1_t *ctx, const unsigned char *buf,
-		    unsigned int len);
-
-void
-isc_hmacsha1_sign(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha1_verify(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha1_check(int testing);
-
-
-void
-isc_hmacsha224_init(isc_hmacsha224_t *ctx, const unsigned char *key,
-		    unsigned int len);
-
-void
-isc_hmacsha224_invalidate(isc_hmacsha224_t *ctx);
-
-void
-isc_hmacsha224_update(isc_hmacsha224_t *ctx, const unsigned char *buf,
-		      unsigned int len);
-
-void
-isc_hmacsha224_sign(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha224_verify(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len);
-
-
-void
-isc_hmacsha256_init(isc_hmacsha256_t *ctx, const unsigned char *key,
-		    unsigned int len);
-
-void
-isc_hmacsha256_invalidate(isc_hmacsha256_t *ctx);
-
-void
-isc_hmacsha256_update(isc_hmacsha256_t *ctx, const unsigned char *buf,
-		      unsigned int len);
-
-void
-isc_hmacsha256_sign(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha256_verify(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len);
-
-
-void
-isc_hmacsha384_init(isc_hmacsha384_t *ctx, const unsigned char *key,
-		    unsigned int len);
-
-void
-isc_hmacsha384_invalidate(isc_hmacsha384_t *ctx);
-
-void
-isc_hmacsha384_update(isc_hmacsha384_t *ctx, const unsigned char *buf,
-		      unsigned int len);
-
-void
-isc_hmacsha384_sign(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha384_verify(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len);
-
-
-void
-isc_hmacsha512_init(isc_hmacsha512_t *ctx, const unsigned char *key,
-		    unsigned int len);
-
-void
-isc_hmacsha512_invalidate(isc_hmacsha512_t *ctx);
-
-void
-isc_hmacsha512_update(isc_hmacsha512_t *ctx, const unsigned char *buf,
-		      unsigned int len);
-
-void
-isc_hmacsha512_sign(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len);
-
-isc_boolean_t
-isc_hmacsha512_verify(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len);
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_HMACSHA_H */

lib/isc/include/isc/md5.h

@@ -53,9 +53,6 @@
 
 typedef struct {
 	EVP_MD_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_MD_CTX _ctx;
-#endif
 } isc_md5_t;
 
 #elif HAVE_PKCS11

lib/isc/include/isc/openssl_shim.h

@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#ifndef ISC_OPENSSL_P_H
+#define ISC_OPENSSL_P_H
+
+#include <config.h>
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+
+#include <openssl/engine.h>
+#include <openssl/hmac.h>
+
+void *OPENSSL_zalloc(size_t size);
+EVP_CIPHER_CTX* EVP_CIPHER_CTX_new(void);
+void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx);
+EVP_MD_CTX *EVP_MD_CTX_new(void);
+void EVP_MD_CTX_free(EVP_MD_CTX *ctx);
+int EVP_MD_CTX_reset(EVP_MD_CTX *ctx);
+HMAC_CTX *HMAC_CTX_new(void);
+void HMAC_CTX_free(HMAC_CTX *ctx);
+int HMAC_CTX_reset(HMAC_CTX *ctx);
+
+#endif /* ISC_OPENSSL_P_H */
+
+#endif /* ISC_OPENSSL_P_H */

lib/isc/include/isc/radix.h

@@ -9,13 +9,6 @@
  * information regarding copyright ownership.
  */
 
-/*
- * This source was adapted from MRT's RCS Ids:
- * Id: radix.h,v 1.6 1999/08/03 03:32:53 masaki Exp
- * Id: mrt.h,v 1.57.2.6 1999/12/28 23:41:27 labovit Exp
- * Id: defs.h,v 1.5.2.2 2000/01/15 14:19:16 masaki Exp
- */
-
 #include <isc/magic.h>
 #include <isc/types.h>
 #include <isc/mutex.h>
@@ -27,7 +20,7 @@
 #ifndef _RADIX_H
 #define _RADIX_H
 
-#define NETADDR_TO_PREFIX_T(na,pt,bits,is_ecs)	\
+#define NETADDR_TO_PREFIX_T(na,pt,bits)	\
 	do { \
 		const void *p = na; \
 		memset(&(pt), 0, sizeof(pt)); \
@@ -44,7 +37,6 @@
 			(pt).family = AF_UNSPEC; \
 			(pt).bitlen = 0; \
 		} \
-		(pt).ecs = is_ecs; \
 		isc_refcount_init(&(pt).refcount, 0); \
 	} while(0)
 
@@ -52,7 +44,6 @@ typedef struct isc_prefix {
 	isc_mem_t *mctx;
 	unsigned int family;	/* AF_INET | AF_INET6, or AF_UNSPEC for "any" */
 	unsigned int bitlen;	/* 0 for "any" */
-	isc_boolean_t ecs;	/* ISC_TRUE for an EDNS client subnet address */
 	isc_refcount_t refcount;
 	union {
 		struct in_addr sin;
@@ -77,23 +68,21 @@ typedef void (*isc_radix_processfunc_t)(isc_prefix_t *, void **);
  * return the one that was added first.
  *
  * An IPv4 prefix and an IPv6 prefix may share a radix tree node if they
- * have the same length and bit pattern (e.g., 127/8 and 7f::/8).  Also,
- * a node that matches a client address may also match an EDNS client
- * subnet address.  To disambiguate between these, node_num and data
- * are four-element arrays;
+ * have the same length and bit pattern (e.g., 127/8 and 7f::/8).  To
+ * disambiguate between them, node_num and data are two-element arrays:
  *
  *   - node_num[0] and data[0] are used for IPv4 client addresses
- *   - node_num[1] and data[1] for IPv4 client subnet addresses
- *   - node_num[2] and data[2] are used for IPv6 client addresses
- *   - node_num[3] and data[3] for IPv6 client subnet addresses
+ *   - node_num[1] and data[1] are used for IPv6 client addresses
  *
  * A prefix of 0/0 (aka "any" or "none"), is always stored as IPv4,
- * but matches IPv6 addresses too, as well as all client subnet
- * addresses.
+ * but matches all IPv6 addresses too.
  */
 
-#define ISC_RADIX_OFF(p) \
-	((((p)->family == AF_INET6) ? 1 : 0) + ((p)->ecs ? 2 : 0))
+#define RADIX_V4 0
+#define RADIX_V6 1
+#define RADIX_FAMILIES 2
+
+#define ISC_RADIX_FAMILY(p) (((p)->family == AF_INET6) ? RADIX_V6 : RADIX_V4)
 
 typedef struct isc_radix_node {
 	isc_mem_t *mctx;
@@ -101,8 +90,8 @@ typedef struct isc_radix_node {
 	isc_prefix_t *prefix;		/* who we are in radix tree */
 	struct isc_radix_node *l, *r;	/* left and right children */
 	struct isc_radix_node *parent;	/* may be used */
-	void *data[4];			/* pointers to IPv4 and IPV6 data */
-	int node_num[4];		/* which node this was in the tree,
+	void *data[RADIX_FAMILIES];	/* pointers to IPv4 and IPV6 data */
+	int node_num[RADIX_FAMILIES];	/* which node this was in the tree,
 					   or -1 for glue nodes */
 } isc_radix_node_t;
 
@@ -201,9 +190,6 @@ isc_radix_process(isc_radix_tree_t *radix, isc_radix_processfunc_t func);
 #define RADIX_NBIT(x)        (0x80 >> ((x) & 0x7f))
 #define RADIX_NBYTE(x)       ((x) >> 3)
 
-#define RADIX_DATA_GET(node, type) (type *)((node)->data)
-#define RADIX_DATA_SET(node, value) ((node)->data = (void *)(value))
-
 #define RADIX_WALK(Xhead, Xnode) \
     do { \
 	isc_radix_node_t *Xstack[RADIX_MAXBITS+1]; \
@@ -212,22 +198,6 @@ isc_radix_process(isc_radix_tree_t *radix, isc_radix_processfunc_t func);
 	while ((Xnode = Xrn)) { \
 	    if (Xnode->prefix)
 
-#define RADIX_WALK_ALL(Xhead, Xnode) \
-do { \
-	isc_radix_node_t *Xstack[RADIX_MAXBITS+1]; \
-	isc_radix_node_t **Xsp = Xstack; \
-	isc_radix_node_t *Xrn = (Xhead); \
-	while ((Xnode = Xrn)) { \
-	    if (1)
-
-#define RADIX_WALK_BREAK { \
-	    if (Xsp != Xstack) { \
-		Xrn = *(--Xsp); \
-	     } else { \
-		Xrn = (radix_node_t *) 0; \
-	    } \
-	    continue; }
-
 #define RADIX_WALK_END \
 	    if (Xrn->l) { \
 		if (Xrn->r) { \

lib/isc/include/isc/sha1.h

@@ -34,9 +34,6 @@
 
 typedef struct {
 	EVP_MD_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_MD_CTX _ctx;
-#endif
 } isc_sha1_t;
 
 #elif HAVE_PKCS11

lib/isc/include/isc/sha2.h

@@ -72,19 +72,12 @@
 
 /*** SHA-256/384/512 Context Structures *******************************/
 
-#if defined(ISC_PLATFORM_OPENSSLHASH)
+#if OPENSSL
 #include <openssl/opensslv.h>
 #include <openssl/evp.h>
-#endif
-
-#if defined(ISC_PLATFORM_OPENSSLHASH) && !defined(LIBRESSL_VERSION_NUMBER)
-
 
 typedef struct {
 	EVP_MD_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_MD_CTX _ctx;
-#endif
 } isc_sha2_t;
 
 typedef isc_sha2_t isc_sha256_t;
@@ -96,25 +89,6 @@ typedef isc_sha2_t isc_sha512_t;
 typedef pk11_context_t isc_sha256_t;
 typedef pk11_context_t isc_sha512_t;
 
-#else
-
-/*
- * Keep buffer immediately after bitcount to preserve alignment.
- */
-typedef struct {
-	isc_uint32_t	state[8];
-	isc_uint64_t	bitcount;
-	isc_uint8_t	buffer[ISC_SHA256_BLOCK_LENGTH];
-} isc_sha256_t;
-
-/*
- * Keep buffer immediately after bitcount to preserve alignment.
- */
-typedef struct {
-	isc_uint64_t	state[8];
-	isc_uint64_t	bitcount[2];
-	isc_uint8_t	buffer[ISC_SHA512_BLOCK_LENGTH];
-} isc_sha512_t;
 #endif
 
 typedef isc_sha256_t isc_sha224_t;

lib/isc/md5.c

@@ -47,11 +47,9 @@
 
 #include <isc/util.h>
 
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define EVP_MD_CTX_new() &(ctx->_ctx)
-#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
-#endif
+#ifdef OPENSSL
+
+#include <isc/openssl_shim.h>
 
 void
 isc_md5_init(isc_md5_t *ctx) {
@@ -127,216 +125,6 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
 			(ctx->session, (CK_BYTE_PTR) digest, &len));
 	pk11_return_session(ctx);
 }
-
-#else
-
-static void
-byteSwap(isc_uint32_t *buf, unsigned words)
-{
-	unsigned char *p = (unsigned char *)buf;
-
-	do {
-		*buf++ = (isc_uint32_t)((unsigned)p[3] << 8 | p[2]) << 16 |
-			((unsigned)p[1] << 8 | p[0]);
-		p += 4;
-	} while (--words);
-}
-
-/*!
- * Start MD5 accumulation.  Set bit count to 0 and buffer to mysterious
- * initialization constants.
- */
-void
-isc_md5_init(isc_md5_t *ctx) {
-	ctx->buf[0] = 0x67452301;
-	ctx->buf[1] = 0xefcdab89;
-	ctx->buf[2] = 0x98badcfe;
-	ctx->buf[3] = 0x10325476;
-
-	ctx->bytes[0] = 0;
-	ctx->bytes[1] = 0;
-}
-
-void
-isc_md5_invalidate(isc_md5_t *ctx) {
-	isc_safe_memwipe(ctx, sizeof(*ctx));
-}
-
-/*@{*/
-/*! The four core functions - F1 is optimized somewhat */
-
-/* #define F1(x, y, z) (x & y | ~x & z) */
-#define F1(x, y, z) (z ^ (x & (y ^ z)))
-#define F2(x, y, z) F1(z, x, y)
-#define F3(x, y, z) (x ^ y ^ z)
-#define F4(x, y, z) (y ^ (x | ~z))
-/*@}*/
-
-/*! This is the central step in the MD5 algorithm. */
-#define MD5STEP(f,w,x,y,z,in,s) \
-	 (w += f(x,y,z) + in, w = (w<<s | w>>(32-s)) + x)
-
-/*!
- * The core of the MD5 algorithm, this alters an existing MD5 hash to
- * reflect the addition of 16 longwords of new data.  MD5Update blocks
- * the data and converts bytes into longwords for this routine.
- */
-static void
-transform(isc_uint32_t buf[4], isc_uint32_t const in[16]) {
-	register isc_uint32_t a, b, c, d;
-
-	a = buf[0];
-	b = buf[1];
-	c = buf[2];
-	d = buf[3];
-
-	MD5STEP(F1, a, b, c, d, in[0] + 0xd76aa478, 7);
-	MD5STEP(F1, d, a, b, c, in[1] + 0xe8c7b756, 12);
-	MD5STEP(F1, c, d, a, b, in[2] + 0x242070db, 17);
-	MD5STEP(F1, b, c, d, a, in[3] + 0xc1bdceee, 22);
-	MD5STEP(F1, a, b, c, d, in[4] + 0xf57c0faf, 7);
-	MD5STEP(F1, d, a, b, c, in[5] + 0x4787c62a, 12);
-	MD5STEP(F1, c, d, a, b, in[6] + 0xa8304613, 17);
-	MD5STEP(F1, b, c, d, a, in[7] + 0xfd469501, 22);
-	MD5STEP(F1, a, b, c, d, in[8] + 0x698098d8, 7);
-	MD5STEP(F1, d, a, b, c, in[9] + 0x8b44f7af, 12);
-	MD5STEP(F1, c, d, a, b, in[10] + 0xffff5bb1, 17);
-	MD5STEP(F1, b, c, d, a, in[11] + 0x895cd7be, 22);
-	MD5STEP(F1, a, b, c, d, in[12] + 0x6b901122, 7);
-	MD5STEP(F1, d, a, b, c, in[13] + 0xfd987193, 12);
-	MD5STEP(F1, c, d, a, b, in[14] + 0xa679438e, 17);
-	MD5STEP(F1, b, c, d, a, in[15] + 0x49b40821, 22);
-
-	MD5STEP(F2, a, b, c, d, in[1] + 0xf61e2562, 5);
-	MD5STEP(F2, d, a, b, c, in[6] + 0xc040b340, 9);
-	MD5STEP(F2, c, d, a, b, in[11] + 0x265e5a51, 14);
-	MD5STEP(F2, b, c, d, a, in[0] + 0xe9b6c7aa, 20);
-	MD5STEP(F2, a, b, c, d, in[5] + 0xd62f105d, 5);
-	MD5STEP(F2, d, a, b, c, in[10] + 0x02441453, 9);
-	MD5STEP(F2, c, d, a, b, in[15] + 0xd8a1e681, 14);
-	MD5STEP(F2, b, c, d, a, in[4] + 0xe7d3fbc8, 20);
-	MD5STEP(F2, a, b, c, d, in[9] + 0x21e1cde6, 5);
-	MD5STEP(F2, d, a, b, c, in[14] + 0xc33707d6, 9);
-	MD5STEP(F2, c, d, a, b, in[3] + 0xf4d50d87, 14);
-	MD5STEP(F2, b, c, d, a, in[8] + 0x455a14ed, 20);
-	MD5STEP(F2, a, b, c, d, in[13] + 0xa9e3e905, 5);
-	MD5STEP(F2, d, a, b, c, in[2] + 0xfcefa3f8, 9);
-	MD5STEP(F2, c, d, a, b, in[7] + 0x676f02d9, 14);
-	MD5STEP(F2, b, c, d, a, in[12] + 0x8d2a4c8a, 20);
-
-	MD5STEP(F3, a, b, c, d, in[5] + 0xfffa3942, 4);
-	MD5STEP(F3, d, a, b, c, in[8] + 0x8771f681, 11);
-	MD5STEP(F3, c, d, a, b, in[11] + 0x6d9d6122, 16);
-	MD5STEP(F3, b, c, d, a, in[14] + 0xfde5380c, 23);
-	MD5STEP(F3, a, b, c, d, in[1] + 0xa4beea44, 4);
-	MD5STEP(F3, d, a, b, c, in[4] + 0x4bdecfa9, 11);
-	MD5STEP(F3, c, d, a, b, in[7] + 0xf6bb4b60, 16);
-	MD5STEP(F3, b, c, d, a, in[10] + 0xbebfbc70, 23);
-	MD5STEP(F3, a, b, c, d, in[13] + 0x289b7ec6, 4);
-	MD5STEP(F3, d, a, b, c, in[0] + 0xeaa127fa, 11);
-	MD5STEP(F3, c, d, a, b, in[3] + 0xd4ef3085, 16);
-	MD5STEP(F3, b, c, d, a, in[6] + 0x04881d05, 23);
-	MD5STEP(F3, a, b, c, d, in[9] + 0xd9d4d039, 4);
-	MD5STEP(F3, d, a, b, c, in[12] + 0xe6db99e5, 11);
-	MD5STEP(F3, c, d, a, b, in[15] + 0x1fa27cf8, 16);
-	MD5STEP(F3, b, c, d, a, in[2] + 0xc4ac5665, 23);
-
-	MD5STEP(F4, a, b, c, d, in[0] + 0xf4292244, 6);
-	MD5STEP(F4, d, a, b, c, in[7] + 0x432aff97, 10);
-	MD5STEP(F4, c, d, a, b, in[14] + 0xab9423a7, 15);
-	MD5STEP(F4, b, c, d, a, in[5] + 0xfc93a039, 21);
-	MD5STEP(F4, a, b, c, d, in[12] + 0x655b59c3, 6);
-	MD5STEP(F4, d, a, b, c, in[3] + 0x8f0ccc92, 10);
-	MD5STEP(F4, c, d, a, b, in[10] + 0xffeff47d, 15);
-	MD5STEP(F4, b, c, d, a, in[1] + 0x85845dd1, 21);
-	MD5STEP(F4, a, b, c, d, in[8] + 0x6fa87e4f, 6);
-	MD5STEP(F4, d, a, b, c, in[15] + 0xfe2ce6e0, 10);
-	MD5STEP(F4, c, d, a, b, in[6] + 0xa3014314, 15);
-	MD5STEP(F4, b, c, d, a, in[13] + 0x4e0811a1, 21);
-	MD5STEP(F4, a, b, c, d, in[4] + 0xf7537e82, 6);
-	MD5STEP(F4, d, a, b, c, in[11] + 0xbd3af235, 10);
-	MD5STEP(F4, c, d, a, b, in[2] + 0x2ad7d2bb, 15);
-	MD5STEP(F4, b, c, d, a, in[9] + 0xeb86d391, 21);
-
-	buf[0] += a;
-	buf[1] += b;
-	buf[2] += c;
-	buf[3] += d;
-}
-
-/*!
- * Update context to reflect the concatenation of another buffer full
- * of bytes.
- */
-void
-isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) {
-	isc_uint32_t t;
-
-	/* Update byte count */
-
-	t = ctx->bytes[0];
-	if ((ctx->bytes[0] = t + len) < t)
-		ctx->bytes[1]++;	/* Carry from low to high */
-
-	t = 64 - (t & 0x3f);	/* Space available in ctx->in (at least 1) */
-	if (t > len) {
-		memmove((unsigned char *)ctx->in + 64 - t, buf, len);
-		return;
-	}
-	/* First chunk is an odd size */
-	memmove((unsigned char *)ctx->in + 64 - t, buf, t);
-	byteSwap(ctx->in, 16);
-	transform(ctx->buf, ctx->in);
-	buf += t;
-	len -= t;
-
-	/* Process data in 64-byte chunks */
-	while (len >= 64) {
-		memmove(ctx->in, buf, 64);
-		byteSwap(ctx->in, 16);
-		transform(ctx->buf, ctx->in);
-		buf += 64;
-		len -= 64;
-	}
-
-	/* Handle any remaining bytes of data. */
-	memmove(ctx->in, buf, len);
-}
-
-/*!
- * Final wrapup - pad to 64-byte boundary with the bit pattern
- * 1 0* (64-bit count of bits processed, MSB-first)
- */
-void
-isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
-	int count = ctx->bytes[0] & 0x3f;    /* Number of bytes in ctx->in */
-	unsigned char *p = (unsigned char *)ctx->in + count;
-
-	/* Set the first char of padding to 0x80.  There is always room. */
-	*p++ = 0x80;
-
-	/* Bytes of padding needed to make 56 bytes (-8..55) */
-	count = 56 - 1 - count;
-
-	if (count < 0) {	/* Padding forces an extra block */
-		memset(p, 0, count + 8);
-		byteSwap(ctx->in, 16);
-		transform(ctx->buf, ctx->in);
-		p = (unsigned char *)ctx->in;
-		count = 56;
-	}
-	memset(p, 0, count);
-	byteSwap(ctx->in, 14);
-
-	/* Append length in bits and transform */
-	ctx->in[14] = ctx->bytes[0] << 3;
-	ctx->in[15] = ctx->bytes[1] << 3 | ctx->bytes[0] >> 29;
-	transform(ctx->buf, ctx->in);
-
-	byteSwap(ctx->buf, 4);
-	memmove(digest, ctx->buf, 16);
-	isc_safe_memwipe(ctx, sizeof(*ctx));	/* In case it's sensitive */
-}
 #endif
 
 /*

lib/isc/openssl_shim.c

@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#if defined(OPENSSL) && (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER))
+
+#include "config.h"
+#include <stdlib.h>
+#include <string.h>
+#include <isc/openssl_shim.h>
+#include <openssl/engine.h>
+#include <openssl/hmac.h>
+#include <openssl/crypto.h>
+
+void *OPENSSL_zalloc(size_t size)
+{
+	void *ret = OPENSSL_malloc(size);
+	if (ret != NULL) {
+		memset(ret, 0, size);
+	}
+	return ret;
+}
+
+EVP_CIPHER_CTX* EVP_CIPHER_CTX_new(void)
+{
+	EVP_CIPHER_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
+	return ctx;
+}
+
+void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)
+{
+	if (ctx != NULL) {
+		EVP_CIPHER_CTX_cleanup(ctx);
+		OPENSSL_free(ctx);
+	}
+}
+
+EVP_MD_CTX *EVP_MD_CTX_new(void)
+{
+	EVP_MD_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
+	if (ctx != NULL) {
+		memset(ctx, 0, sizeof(*ctx));
+	}
+	return ctx;
+}
+
+void EVP_MD_CTX_free(EVP_MD_CTX *ctx)
+{
+	if (ctx != NULL) {
+		EVP_MD_CTX_cleanup(ctx);
+		OPENSSL_free(ctx);
+	}
+}
+
+int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
+{
+	return EVP_MD_CTX_cleanup(ctx);
+}
+
+HMAC_CTX *HMAC_CTX_new(void)
+{
+	HMAC_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
+	if (ctx != NULL) {
+		if (!HMAC_CTX_reset(ctx)) {
+			HMAC_CTX_free(ctx);
+			return NULL;
+		}
+	}
+	return ctx;
+}
+
+void HMAC_CTX_free(HMAC_CTX *ctx)
+{
+	if (ctx != NULL) {
+		HMAC_CTX_cleanup(ctx);
+		OPENSSL_free(ctx);
+	}
+}
+
+int HMAC_CTX_reset(HMAC_CTX *ctx) {
+	HMAC_CTX_cleanup(ctx);
+	return 1;
+}
+		
+#endif

lib/isc/radix.c

@@ -9,7 +9,6 @@
  * information regarding copyright ownership.
  */
 
-
 /*
  * This source was adapted from MRT's RCS Ids:
  * Id: radix.c,v 1.10.2.1 1999/11/29 05:16:24 masaki Exp
@@ -64,7 +63,6 @@ _new_prefix(isc_mem_t *mctx, isc_prefix_t **target, int family, void *dest,
 	}
 
 	prefix->family = family;
-	prefix->ecs = ISC_FALSE;
 	prefix->mctx = NULL;
 	isc_mem_attach(mctx, &prefix->mctx);
 
@@ -180,10 +178,8 @@ _clear_radix(isc_radix_tree_t *radix, isc_radix_destroyfunc_t func) {
 				if (func != NULL)
 					func(Xrn->data);
 			} else {
-				INSIST(Xrn->data[0] == NULL &&
-				       Xrn->data[1] == NULL &&
-				       Xrn->data[2] == NULL &&
-				       Xrn->data[3] == NULL);
+				INSIST(Xrn->data[RADIX_V4] == NULL &&
+				       Xrn->data[RADIX_V6] == NULL);
 			}
 
 			isc_mem_put(radix->mctx, Xrn, sizeof(*Xrn));
@@ -238,7 +234,7 @@ isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target,
 	isc_radix_node_t *stack[RADIX_MAXBITS + 1];
 	u_char *addr;
 	isc_uint32_t bitlen;
-	int toff = -1, cnt = 0;
+	int tfam = -1, cnt = 0;
 
 	REQUIRE(radix != NULL);
 	REQUIRE(prefix != NULL);
@@ -281,13 +277,13 @@ isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target,
 				    isc_prefix_tochar(prefix),
 				    node->prefix->bitlen))
 		{
-			int off = ISC_RADIX_OFF(prefix);
-			if (node->node_num[off] != -1 &&
+			int fam = ISC_RADIX_FAMILY(prefix);
+			if (node->node_num[fam] != -1 &&
 			    ((*target == NULL) ||
-			     (*target)->node_num[toff] > node->node_num[off]))
+			     (*target)->node_num[tfam] > node->node_num[fam]))
 			{
 				*target = node;
-				toff = off;
+				tfam = fam;
 			}
 		}
 	}
@@ -327,8 +323,9 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 		if (node == NULL)
 			return (ISC_R_NOMEMORY);
 		node->bit = bitlen;
-		for (i = 0; i < 4; i++)
+		for (i = 0; i < RADIX_FAMILIES; i++) {
 			node->node_num[i] = -1;
+		}
 		node->prefix = NULL;
 		result = _ref_prefix(radix->mctx, &node->prefix, prefix);
 		if (result != ISC_R_SUCCESS) {
@@ -347,21 +344,23 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 			 * added to num_added_node at the end of
 			 * the merge operation--we don't do it here.
 			 */
-			for (i = 0; i < 4; i++) {
-				if (source->node_num[i] != -1)
+			for (i = 0; i < RADIX_FAMILIES; i++) {
+				if (source->node_num[i] != -1) {
 					node->node_num[i] =
 						radix->num_added_node +
 						source->node_num[i];
+				}
 				node->data[i] = source->data[i];
 			}
 		} else {
 			int next = ++radix->num_added_node;
 			if (fam == AF_UNSPEC) {
 				/* "any" or "none" */
-				for (i = 0; i < 4; i++)
+				for (i = 0; i < RADIX_FAMILIES; i++) {
 					node->node_num[i] = next;
+				}
 			} else {
-				node->node_num[ISC_RADIX_OFF(prefix)] = next;
+				node->node_num[ISC_RADIX_FAMILY(prefix)] = next;
 			}
 
 			memset(node->data, 0, sizeof(node->data));
@@ -397,14 +396,14 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 	/* Find the first bit different. */
 	check_bit = (node->bit < bitlen) ? node->bit : bitlen;
 	differ_bit = 0;
-	for (i = 0; i*8 < check_bit; i++) {
+	for (i = 0; i * 8 < check_bit; i++) {
 		if ((r = (addr[i] ^ test_addr[i])) == 0) {
 			differ_bit = (i + 1) * 8;
 			continue;
 		}
 		/* I know the better way, but for now. */
 		for (j = 0; j < 8; j++) {
-			if (BIT_TEST (r, (0x80 >> j)))
+			if (BIT_TEST(r, (0x80 >> j)))
 				break;
 		}
 		/* Must be found. */
@@ -427,9 +426,10 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 			/* Set node_num only if it hasn't been set before */
 			if (source != NULL) {
 				/* Merging nodes */
-				for (i = 0; i < 4; i++) {
+				for (i = 0; i < RADIX_FAMILIES; i++) {
 					if (node->node_num[i] == -1 &&
-					    source->node_num[i] != -1) {
+					    source->node_num[i] != -1)
+					{
 						node->node_num[i] =
 							radix->num_added_node +
 							source->node_num[i];
@@ -440,7 +440,8 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 				if (fam == AF_UNSPEC) {
 					/* "any" or "none" */
 					int next = radix->num_added_node + 1;
-					for (i = 0; i < 4; i++)  {
+					for (i = 0; i < RADIX_FAMILIES; i++)
+					{
 						if (node->node_num[i] == -1) {
 							node->node_num[i] =
 								next;
@@ -449,10 +450,11 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 						}
 					}
 				} else {
-					int off = ISC_RADIX_OFF(prefix);
-					if (node->node_num[off] == -1)
-						node->node_num[off] =
+					int foff = ISC_RADIX_FAMILY(prefix);
+					if (node->node_num[foff] == -1) {
+						node->node_num[foff] =
 							++radix->num_added_node;
+					}
 				}
 			}
 			*target = node;
@@ -463,13 +465,13 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 			if (result != ISC_R_SUCCESS)
 				return (result);
 		}
-		INSIST(node->data[0] == NULL && node->node_num[0] == -1 &&
-		       node->data[1] == NULL && node->node_num[1] == -1 &&
-		       node->data[2] == NULL && node->node_num[2] == -1 &&
-		       node->data[3] == NULL && node->node_num[3] == -1);
+		INSIST(node->data[RADIX_V4] == NULL &&
+		       node->node_num[RADIX_V4] == -1 &&
+		       node->data[RADIX_V4] == NULL &&
+		       node->node_num[RADIX_V4] == -1);
 		if (source != NULL) {
 			/* Merging node */
-			for (i = 0; i < 4; i++) {
+			for (i = 0; i < RADIX_FAMILIES; i++) {
 				int cur = radix->num_added_node;
 				if (source->node_num[i] != -1) {
 					node->node_num[i] =
@@ -481,10 +483,11 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 			int next = ++radix->num_added_node;
 			if (fam == AF_UNSPEC) {
 				/* "any" or "none" */
-				for (i = 0; i < 4; i++)
+				for (i = 0; i < RADIX_FAMILIES; i++) {
 					node->node_num[i] = next;
+				}
 			} else {
-				node->node_num[ISC_RADIX_OFF(prefix)] = next;
+				node->node_num[ISC_RADIX_FAMILY(prefix)] = next;
 			}
 		}
 		*target = node;
@@ -514,7 +517,7 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 	}
 	new_node->parent = NULL;
 	new_node->l = new_node->r = NULL;
-	for (i = 0; i < 4; i++) {
+	for (i = 0; i < RADIX_FAMILIES; i++) {
 		new_node->node_num[i] = -1;
 		new_node->data[i] = NULL;
 	}
@@ -522,7 +525,7 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 
 	if (source != NULL) {
 		/* Merging node */
-		for (i = 0; i < 4; i++) {
+		for (i = 0; i < RADIX_FAMILIES; i++) {
 			int cur = radix->num_added_node;
 			if (source->node_num[i] != -1) {
 				new_node->node_num[i] =
@@ -534,10 +537,10 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 		int next = ++radix->num_added_node;
 		if (fam == AF_UNSPEC) {
 			/* "any" or "none" */
-			for (i = 0; i < 4; i++)
+			for (i = 0; i < RADIX_FAMILIES; i++)
 				new_node->node_num[i] = next;
 		} else {
-			new_node->node_num[ISC_RADIX_OFF(prefix)] = next;
+			new_node->node_num[ISC_RADIX_FAMILY(prefix)] = next;
 		}
 		memset(new_node->data, 0, sizeof(new_node->data));
 	}
@@ -581,7 +584,7 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 		glue->bit = differ_bit;
 		glue->prefix = NULL;
 		glue->parent = node->parent;
-		for (i = 0; i < 4; i++) {
+		for (i = 0; i < RADIX_FAMILIES; i++) {
 			glue->data[i] = NULL;
 			glue->node_num[i] = -1;
 		}

lib/isc/random.c

@@ -175,7 +175,7 @@ isc_random_buf(void *buf, size_t buflen) {
 	}
 # elif HAVE_PKCS11
 	RUNTIME_CHECK(pk11_rand_bytes(buf, buflen) == ISC_R_SUCCESS);
-# endif /* if defined(HAVE_ARC4RANDOM_BUF) */	
+# endif /* if defined(HAVE_ARC4RANDOM_BUF) */
 
 #endif
 }

lib/isc/sha1.c

@@ -42,11 +42,9 @@
 #include <pk11/pk11.h>
 #endif
 
-#ifdef ISC_PLATFORM_OPENSSLHASH
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define EVP_MD_CTX_new() &(context->_ctx)
-#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
-#endif
+#ifdef OPENSSL
+
+#include <isc/openssl_shim.h>
 
 void
 isc_sha1_init(isc_sha1_t *context)
@@ -134,281 +132,7 @@ isc_sha1_final(isc_sha1_t *ctx, unsigned char *digest) {
 	pk11_return_session(ctx);
 }
 
-#else
-
-#define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
-
-/*@{*/
-/*!
- * blk0() and blk() perform the initial expand.
- * I got the idea of expanding during the round function from SSLeay
- */
-#if !defined(WORDS_BIGENDIAN)
-# define blk0(i) \
-	(block->l[i] = (rol(block->l[i], 24) & 0xFF00FF00) \
-	 | (rol(block->l[i], 8) & 0x00FF00FF))
-#else
-# define blk0(i) block->l[i]
-#endif
-#define blk(i) \
-	(block->l[i & 15] = rol(block->l[(i + 13) & 15] \
-				^ block->l[(i + 8) & 15] \
-				^ block->l[(i + 2) & 15] \
-				^ block->l[i & 15], 1))
-
-/*@}*/
-/*@{*/
-/*!
- * (R0+R1), R2, R3, R4 are the different operations (rounds) used in SHA1
- */
-#define R0(v,w,x,y,z,i) \
-	z += ((w & (x ^ y)) ^ y) + blk0(i) + 0x5A827999 + rol(v, 5); \
-	w = rol(w, 30);
-#define R1(v,w,x,y,z,i) \
-	z += ((w & (x ^ y)) ^ y) + blk(i) + 0x5A827999 + rol(v, 5); \
-	w = rol(w, 30);
-#define R2(v,w,x,y,z,i) \
-	z += (w ^ x ^ y) + blk(i) + 0x6ED9EBA1 + rol(v, 5); \
-	w = rol(w, 30);
-#define R3(v,w,x,y,z,i) \
-	z += (((w | x) & y) | (w & x)) + blk(i) + 0x8F1BBCDC + rol(v, 5); \
-	w = rol(w, 30);
-#define R4(v,w,x,y,z,i) \
-	z += (w ^ x ^ y) + blk(i) + 0xCA62C1D6 + rol(v, 5); \
-	w = rol(w, 30);
-
-/*@}*/
-
-typedef union {
-	unsigned char c[64];
-	unsigned int l[16];
-} CHAR64LONG16;
-
-#ifdef __sparc_v9__
-static void do_R01(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c,
-		   isc_uint32_t *d, isc_uint32_t *e, CHAR64LONG16 *);
-static void do_R2(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c,
-		  isc_uint32_t *d, isc_uint32_t *e, CHAR64LONG16 *);
-static void do_R3(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c,
-		  isc_uint32_t *d, isc_uint32_t *e, CHAR64LONG16 *);
-static void do_R4(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c,
-		  isc_uint32_t *d, isc_uint32_t *e, CHAR64LONG16 *);
-
-#define nR0(v,w,x,y,z,i) R0(*v,*w,*x,*y,*z,i)
-#define nR1(v,w,x,y,z,i) R1(*v,*w,*x,*y,*z,i)
-#define nR2(v,w,x,y,z,i) R2(*v,*w,*x,*y,*z,i)
-#define nR3(v,w,x,y,z,i) R3(*v,*w,*x,*y,*z,i)
-#define nR4(v,w,x,y,z,i) R4(*v,*w,*x,*y,*z,i)
-
-static void
-do_R01(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
-       isc_uint32_t *e, CHAR64LONG16 *block)
-{
-	nR0(a,b,c,d,e, 0); nR0(e,a,b,c,d, 1); nR0(d,e,a,b,c, 2);
-	nR0(c,d,e,a,b, 3); nR0(b,c,d,e,a, 4); nR0(a,b,c,d,e, 5);
-	nR0(e,a,b,c,d, 6); nR0(d,e,a,b,c, 7); nR0(c,d,e,a,b, 8);
-	nR0(b,c,d,e,a, 9); nR0(a,b,c,d,e,10); nR0(e,a,b,c,d,11);
-	nR0(d,e,a,b,c,12); nR0(c,d,e,a,b,13); nR0(b,c,d,e,a,14);
-	nR0(a,b,c,d,e,15); nR1(e,a,b,c,d,16); nR1(d,e,a,b,c,17);
-	nR1(c,d,e,a,b,18); nR1(b,c,d,e,a,19);
-}
-
-static void
-do_R2(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
-      isc_uint32_t *e, CHAR64LONG16 *block)
-{
-	nR2(a,b,c,d,e,20); nR2(e,a,b,c,d,21); nR2(d,e,a,b,c,22);
-	nR2(c,d,e,a,b,23); nR2(b,c,d,e,a,24); nR2(a,b,c,d,e,25);
-	nR2(e,a,b,c,d,26); nR2(d,e,a,b,c,27); nR2(c,d,e,a,b,28);
-	nR2(b,c,d,e,a,29); nR2(a,b,c,d,e,30); nR2(e,a,b,c,d,31);
-	nR2(d,e,a,b,c,32); nR2(c,d,e,a,b,33); nR2(b,c,d,e,a,34);
-	nR2(a,b,c,d,e,35); nR2(e,a,b,c,d,36); nR2(d,e,a,b,c,37);
-	nR2(c,d,e,a,b,38); nR2(b,c,d,e,a,39);
-}
-
-static void
-do_R3(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
-      isc_uint32_t *e, CHAR64LONG16 *block)
-{
-	nR3(a,b,c,d,e,40); nR3(e,a,b,c,d,41); nR3(d,e,a,b,c,42);
-	nR3(c,d,e,a,b,43); nR3(b,c,d,e,a,44); nR3(a,b,c,d,e,45);
-	nR3(e,a,b,c,d,46); nR3(d,e,a,b,c,47); nR3(c,d,e,a,b,48);
-	nR3(b,c,d,e,a,49); nR3(a,b,c,d,e,50); nR3(e,a,b,c,d,51);
-	nR3(d,e,a,b,c,52); nR3(c,d,e,a,b,53); nR3(b,c,d,e,a,54);
-	nR3(a,b,c,d,e,55); nR3(e,a,b,c,d,56); nR3(d,e,a,b,c,57);
-	nR3(c,d,e,a,b,58); nR3(b,c,d,e,a,59);
-}
-
-static void
-do_R4(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
-      isc_uint32_t *e, CHAR64LONG16 *block)
-{
-	nR4(a,b,c,d,e,60); nR4(e,a,b,c,d,61); nR4(d,e,a,b,c,62);
-	nR4(c,d,e,a,b,63); nR4(b,c,d,e,a,64); nR4(a,b,c,d,e,65);
-	nR4(e,a,b,c,d,66); nR4(d,e,a,b,c,67); nR4(c,d,e,a,b,68);
-	nR4(b,c,d,e,a,69); nR4(a,b,c,d,e,70); nR4(e,a,b,c,d,71);
-	nR4(d,e,a,b,c,72); nR4(c,d,e,a,b,73); nR4(b,c,d,e,a,74);
-	nR4(a,b,c,d,e,75); nR4(e,a,b,c,d,76); nR4(d,e,a,b,c,77);
-	nR4(c,d,e,a,b,78); nR4(b,c,d,e,a,79);
-}
-#endif
-
-/*!
- * Hash a single 512-bit block. This is the core of the algorithm.
- */
-static void
-transform(isc_uint32_t state[5], const unsigned char buffer[64]) {
-	isc_uint32_t a, b, c, d, e;
-	CHAR64LONG16 *block;
-	CHAR64LONG16 workspace;
-
-	INSIST(buffer != NULL);
-	INSIST(state != NULL);
-
-	block = &workspace;
-	(void)memmove(block, buffer, 64);
-
-	/* Copy context->state[] to working vars */
-	a = state[0];
-	b = state[1];
-	c = state[2];
-	d = state[3];
-	e = state[4];
-
-#ifdef __sparc_v9__
-	do_R01(&a, &b, &c, &d, &e, block);
-	do_R2(&a, &b, &c, &d, &e, block);
-	do_R3(&a, &b, &c, &d, &e, block);
-	do_R4(&a, &b, &c, &d, &e, block);
-#else
-	/* 4 rounds of 20 operations each. Loop unrolled. */
-	R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
-	R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
-	R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
-	R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
-	R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
-	R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
-	R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
-	R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
-	R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
-	R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
-	R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
-	R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
-	R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
-	R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
-	R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
-	R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
-	R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
-	R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
-	R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
-	R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
-#endif
-
-	/* Add the working vars back into context.state[] */
-	state[0] += a;
-	state[1] += b;
-	state[2] += c;
-	state[3] += d;
-	state[4] += e;
-
-	/* Wipe variables */
-	a = b = c = d = e = 0;
-	/* Avoid compiler warnings */
-	POST(a); POST(b); POST(c); POST(d); POST(e);
-}
-
-
-/*!
- * isc_sha1_init - Initialize new context
- */
-void
-isc_sha1_init(isc_sha1_t *context)
-{
-	INSIST(context != NULL);
-
-	/* SHA1 initialization constants */
-	context->state[0] = 0x67452301;
-	context->state[1] = 0xEFCDAB89;
-	context->state[2] = 0x98BADCFE;
-	context->state[3] = 0x10325476;
-	context->state[4] = 0xC3D2E1F0;
-	context->count[0] = 0;
-	context->count[1] = 0;
-}
-
-void
-isc_sha1_invalidate(isc_sha1_t *context) {
-	isc_safe_memwipe(context, sizeof(*context));
-}
-
-/*!
- * Run your data through this.
- */
-void
-isc_sha1_update(isc_sha1_t *context, const unsigned char *data,
-		unsigned int len)
-{
-	unsigned int i, j;
-
-	INSIST(context != 0);
-	INSIST(data != 0);
-
-	j = context->count[0];
-	if ((context->count[0] += len << 3) < j)
-		context->count[1] += (len >> 29) + 1;
-	j = (j >> 3) & 63;
-	if ((j + len) > 63) {
-		(void)memmove(&context->buffer[j], data, (i = 64 - j));
-		transform(context->state, context->buffer);
-		for (; i + 63 < len; i += 64)
-			transform(context->state, &data[i]);
-		j = 0;
-	} else {
-		i = 0;
-	}
-
-	(void)memmove(&context->buffer[j], &data[i], len - i);
-}
-
-
-/*!
- * Add padding and return the message digest.
- */
-
-static const unsigned char final_200 = 128;
-static const unsigned char final_0 = 0;
-
-void
-isc_sha1_final(isc_sha1_t *context, unsigned char *digest) {
-	unsigned int i;
-	unsigned char finalcount[8];
-
-	INSIST(digest != 0);
-	INSIST(context != 0);
-
-	for (i = 0; i < 8; i++) {
-		/* Endian independent */
-		finalcount[i] = (unsigned char)
-			((context->count[(i >= 4 ? 0 : 1)]
-			  >> ((3 - (i & 3)) * 8)) & 255);
-	}
-
-	isc_sha1_update(context, &final_200, 1);
-	while ((context->count[0] & 504) != 448)
-		isc_sha1_update(context, &final_0, 1);
-	/* The next Update should cause a transform() */
-	isc_sha1_update(context, finalcount, 8);
-
-	if (digest) {
-		for (i = 0; i < 20; i++)
-			digest[i] = (unsigned char)
-				((context->state[i >> 2]
-				  >> ((3 - (i & 3)) * 8)) & 255);
-	}
-
-	isc_safe_memwipe(context, sizeof(*context));
-}
-#endif
+#endif /* OPENSSL || PKCS11CRYPTO */
 
 /*
  * Check for SHA-1 support; if it does not work, raise a fatal error.

lib/isc/tests/hash_test.c

@@ -21,8 +21,7 @@
 #include <isc/hash.h>
 
 #include <isc/crc64.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/md5.h>
 #include <isc/sha1.h>
 #include <isc/util.h>
@@ -1773,7 +1772,7 @@ ATF_TC_BODY(isc_hmacmd5, tc) {
 		isc_hmacmd5_update(&hmacmd5,
 				   (const isc_uint8_t *) testcase->input,
 				   testcase->input_len);
-		isc_hmacmd5_sign(&hmacmd5, digest);
+		isc_hmacmd5_sign(&hmacmd5, digest, ISC_MD5_DIGESTLENGTH);
 		tohexstr(digest, ISC_MD5_DIGESTLENGTH, str, sizeof(str));
 		ATF_CHECK_STREQ(str, testcase->result);
 
@@ -1973,12 +1972,6 @@ ATF_TC_BODY(md5_check, tc) {
 
 	ATF_REQUIRE(isc_md5_check(ISC_FALSE));
 	ATF_CHECK(!isc_md5_check(ISC_TRUE));
-
-	ATF_REQUIRE(isc_hmacmd5_check(0));
-	ATF_CHECK(!isc_hmacmd5_check(1));
-	ATF_CHECK(!isc_hmacmd5_check(2));
-	ATF_CHECK(!isc_hmacmd5_check(3));
-	ATF_CHECK(!isc_hmacmd5_check(4));
 }
 #endif
 
@@ -1991,12 +1984,6 @@ ATF_TC_BODY(sha1_check, tc) {
 
 	ATF_REQUIRE(isc_sha1_check(ISC_FALSE));
 	ATF_CHECK(!isc_sha1_check(ISC_TRUE));
-
-	ATF_REQUIRE(isc_hmacsha1_check(0));
-	ATF_CHECK(!isc_hmacsha1_check(1));
-	ATF_CHECK(!isc_hmacsha1_check(2));
-	ATF_CHECK(!isc_hmacsha1_check(3));
-	ATF_CHECK(!isc_hmacsha1_check(4));
 }
 
 /*

lib/isc/tests/radix_test.c

@@ -46,7 +46,7 @@ ATF_TC_BODY(isc_radix_search, tc) {
 
 	in_addr.s_addr = inet_addr("3.3.3.0");
 	isc_netaddr_fromin(&netaddr, &in_addr);
-	NETADDR_TO_PREFIX_T(&netaddr, prefix, 24, ISC_FALSE);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 24);
 
 	node = NULL;
 	result = isc_radix_insert(radix, &node, NULL, &prefix);
@@ -56,7 +56,7 @@ ATF_TC_BODY(isc_radix_search, tc) {
 
 	in_addr.s_addr = inet_addr("3.3.0.0");
 	isc_netaddr_fromin(&netaddr, &in_addr);
-	NETADDR_TO_PREFIX_T(&netaddr, prefix, 16, ISC_FALSE);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 16);
 
 	node = NULL;
 	result = isc_radix_insert(radix, &node, NULL, &prefix);
@@ -66,7 +66,7 @@ ATF_TC_BODY(isc_radix_search, tc) {
 
 	in_addr.s_addr = inet_addr("3.3.3.3");
 	isc_netaddr_fromin(&netaddr, &in_addr);
-	NETADDR_TO_PREFIX_T(&netaddr, prefix, 22, ISC_FALSE);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 22);
 
 	node = NULL;
 	result = isc_radix_search(radix, &node, &prefix);

lib/isc/win32/libisc.def.in

@@ -259,39 +259,25 @@ isc_heap_insert
 isc_hex_decodestring
 isc_hex_tobuffer
 isc_hex_totext
-isc_hmacmd5_check
-isc_hmacmd5_init
-isc_hmacmd5_invalidate
-isc_hmacmd5_sign
-isc_hmacmd5_update
-isc_hmacmd5_verify
-isc_hmacmd5_verify2
-isc_hmacsha1_check
-isc_hmacsha1_init
-isc_hmacsha1_invalidate
-isc_hmacsha1_sign
-isc_hmacsha1_update
-isc_hmacsha1_verify
-isc_hmacsha224_init
-isc_hmacsha224_invalidate
-isc_hmacsha224_sign
-isc_hmacsha224_update
-isc_hmacsha224_verify
-isc_hmacsha256_init
-isc_hmacsha256_invalidate
-isc_hmacsha256_sign
-isc_hmacsha256_update
-isc_hmacsha256_verify
-isc_hmacsha384_init
-isc_hmacsha384_invalidate
-isc_hmacsha384_sign
-isc_hmacsha384_update
-isc_hmacsha384_verify
-isc_hmacsha512_init
-isc_hmacsha512_invalidate
-isc_hmacsha512_sign
-isc_hmacsha512_update
-isc_hmacsha512_verify
+@IF OPENSSL
+isc_hmac_init_openssl
+isc_hmac_invalidate_openssl
+isc_hmac_sign_openssl
+isc_hmac_update_openssl
+isc_hmac_verify_openssl
+@END OPENSSL
+@IF PKCS11CRYPTO
+isc_hmac_init_pkcs11
+isc_hmac_invalidate_pkcs11
+isc_hmac_sign_pkcs11
+isc_hmac_update_pkcs11
+isc_hmac_verify_pkcs11
+isc_hmac_init_pkcs11_replace
+isc_hmac_invalidate_pkcs11_replace
+isc_hmac_sign_pkcs11_replace
+isc_hmac_update_pkcs11_replace
+isc_hmac_verify_pkcs11_replace
+@END PKCS11CRYPTO
 isc_ht_add
 isc_ht_count
 isc_ht_delete

lib/isc/win32/libisc.vcxproj.filters.in

@@ -97,10 +97,7 @@
     <ClInclude Include="..\include\isc\hex.h">
       <Filter>Library Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="..\include\isc\hmacmd5.h">
-      <Filter>Library Header Files</Filter>
-    </ClInclude>
-    <ClInclude Include="..\include\isc\hmacsha.h">
+    <ClInclude Include="..\include\isc\hmac.h">
       <Filter>Library Header Files</Filter>
     </ClInclude>
     <ClInclude Include="..\include\isc\ht.h">
@@ -525,10 +522,7 @@
     <ClCompile Include="..\hex.c">
       <Filter>Library Source Files</Filter>
     </ClCompile>
-    <ClCompile Include="..\hmacmd5.c">
-      <Filter>Library Source Files</Filter>
-    </ClCompile>
-    <ClCompile Include="..\hmacsha.c">
+    <ClCompile Include="..\hmac.c">
       <Filter>Library Source Files</Filter>
     </ClCompile>
     <ClCompile Include="..\ht.c">

lib/isc/win32/libisc.vcxproj.in

@@ -319,8 +319,7 @@ copy InstallFiles ..\Build\Release\
     <ClInclude Include="..\include\isc\hash.h" />
     <ClInclude Include="..\include\isc\heap.h" />
     <ClInclude Include="..\include\isc\hex.h" />
-    <ClInclude Include="..\include\isc\hmacmd5.h" />
-    <ClInclude Include="..\include\isc\hmacsha.h" />
+    <ClInclude Include="..\include\isc\hmac.h" />
     <ClInclude Include="..\include\isc\ht.h" />
     <ClInclude Include="..\include\isc\httpd.h" />
     <ClInclude Include="..\include\isc\interfaceiter.h" />
@@ -441,8 +440,7 @@ copy InstallFiles ..\Build\Release\
     <ClCompile Include="..\hash.c" />
     <ClCompile Include="..\heap.c" />
     <ClCompile Include="..\hex.c" />
-    <ClCompile Include="..\hmacmd5.c" />
-    <ClCompile Include="..\hmacsha.c" />
+    <ClCompile Include="..\hmac.c" />
     <ClCompile Include="..\ht.c" />
     <ClCompile Include="..\httpd.c" />
     <ClCompile Include="..\inet_ntop.c" />

lib/isccc/cc.c

@@ -32,8 +32,7 @@
 #include <errno.h>
 
 #include <isc/assertions.h>
-#include <isc/hmacmd5.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/print.h>
 #include <isc/safe.h>
 #include <isc/stdlib.h>
@@ -273,7 +272,7 @@ sign(unsigned char *data, unsigned int length, unsigned char *hmac,
 		isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
 				 REGION_SIZE(*secret));
 		isc_hmacmd5_update(&ctx.hmd5, data, length);
-		isc_hmacmd5_sign(&ctx.hmd5, digest);
+		isc_hmacmd5_sign(&ctx.hmd5, digest, ISC_MD5_DIGESTLENGTH);
 		source.rend = digest + ISC_MD5_DIGESTLENGTH;
 		break;
 #endif
@@ -458,7 +457,7 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
 		isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
 				 REGION_SIZE(*secret));
 		isc_hmacmd5_update(&ctx.hmd5, data, length);
-		isc_hmacmd5_sign(&ctx.hmd5, digest);
+		isc_hmacmd5_sign(&ctx.hmd5, digest, ISC_MD5_DIGESTLENGTH);
 		source.rend = digest + ISC_MD5_DIGESTLENGTH;
 		break;
 #endif

lib/isccfg/aclconf.c

@@ -711,7 +711,6 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 			/* Network prefix */
 			isc_netaddr_t	addr;
 			unsigned int	bitlen;
-			isc_boolean_t	setecs;
 
 			cfg_obj_asnetprefix(ce, &addr, &bitlen);
 			if (family != 0 && family != addr.family) {
@@ -739,9 +738,8 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 			 * the nestedacl element, not the iptable entry.
 			 */
 			setpos = ISC_TF(nest_level != 0 || !neg);
-			setecs = cfg_obj_istype(ce, &cfg_type_ecsprefix);
 			result = dns_iptable_addprefix(iptab, &addr, bitlen,
-						       setpos, setecs);
+						       setpos);
 			if (result != ISC_R_SUCCESS)
 				goto cleanup;
 
@@ -815,8 +813,7 @@ nested_acl:
 				/* Iptable entry with zero bit length. */
 				setpos = ISC_TF(nest_level != 0 || !neg);
 				result = dns_iptable_addprefix(iptab, NULL, 0,
-							       setpos,
-							       ISC_FALSE);
+							       setpos);
 				if (result != ISC_R_SUCCESS)
 					goto cleanup;
 
@@ -836,8 +833,7 @@ nested_acl:
 				 */
 				setpos = ISC_TF(nest_level != 0 || neg);
 				result = dns_iptable_addprefix(iptab, NULL, 0,
-							       setpos,
-							       ISC_FALSE);
+							       setpos);
 				if (result != ISC_R_SUCCESS)
 					goto cleanup;
 

lib/isccfg/include/isccfg/namedconf.h

@@ -9,7 +9,6 @@
  * information regarding copyright ownership.
  */
 
-
 #ifndef ISCCFG_NAMEDCONF_H
 #define ISCCFG_NAMEDCONF_H 1
 
@@ -47,9 +46,6 @@ LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sessionkey;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_keyref;
 /*%< A key reference, used as an ACL element */
 
-/*%< An EDNS client subnet address, used as an ACL element */
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_ecsprefix;
-
 /*%< Zone options */
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_zoneopts;
 

lib/isccfg/namedconf.c

@@ -1084,12 +1084,11 @@ options_clauses[] = {
 #endif /* HAVE_DNSTAP */
 #ifdef HAVE_GEOIP
 	{ "geoip-directory", &cfg_type_qstringornone, 0 },
-	{ "geoip-use-ecs", &cfg_type_boolean, 0 },
 #else
 	{ "geoip-directory", &cfg_type_qstringornone,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED },
-	{ "geoip-use-ecs", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED },
 #endif /* HAVE_GEOIP */
+	{ "geoip-use-ecs", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "has-old-clients", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "heartbeat-interval", &cfg_type_uint32, 0 },
 	{ "host-statistics", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTIMP },
@@ -3045,16 +3044,6 @@ doc_geoip(cfg_printer_t *pctx, const cfg_type_t *type) {
 }
 #endif /* HAVE_GEOIP */
 
-/*%
- * An EDNS client subnet address
- */
-
-static keyword_type_t ecs_kw = { "ecs", &cfg_type_netprefix };
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_ecsprefix = {
-	"edns_client_subnet", parse_keyvalue, print_keyvalue, doc_keyvalue,
-	&cfg_rep_netprefix, &ecs_kw
-};
-
 /*%
  * A "controls" statement is represented as a map with the multivalued
  * "inet" and "unix" clauses.
@@ -3394,9 +3383,6 @@ parse_addrmatchelt(cfg_parser_t *pctx, const cfg_type_t *type,
 		if (pctx->token.type == isc_tokentype_string &&
 		    (strcasecmp(TOKEN_STRING(pctx), "key") == 0)) {
 			CHECK(cfg_parse_obj(pctx, &cfg_type_keyref, ret));
-		} else if (pctx->token.type == isc_tokentype_string &&
-			   (strcasecmp(TOKEN_STRING(pctx), "ecs") == 0)) {
-			CHECK(cfg_parse_obj(pctx, &cfg_type_ecsprefix, ret));
 		} else if (pctx->token.type == isc_tokentype_string &&
 			   (strcasecmp(TOKEN_STRING(pctx), "geoip") == 0)) {
 #ifdef HAVE_GEOIP

lib/ns/client.c

@@ -14,7 +14,7 @@
 #include <isc/aes.h>
 #include <isc/formatcheck.h>
 #include <isc/fuzz.h>
-#include <isc/hmacsha.h>
+#include <isc/hmac.h>
 #include <isc/mutex.h>
 #include <isc/once.h>
 #include <isc/platform.h>
@@ -950,11 +950,12 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 		if (client->sctx->blackholeacl != NULL &&
-		    dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
-				  client->sctx->blackholeacl,
-				  env, &match, NULL) == ISC_R_SUCCESS &&
+		    (dns_acl_match(&netaddr, NULL, client->sctx->blackholeacl,
+				   env, &match, NULL) == ISC_R_SUCCESS) &&
 		    match > 0)
+		{
 			return (DNS_R_BLACKHOLED);
+		}
 		sockflags |= ISC_SOCKFLAG_NORETRY;
 	}
 
@@ -1146,7 +1147,7 @@ client_send(ns_client_t *client) {
 			name = &client->message->tsigkey->name;
 
 		if (client->view->nocasecompress == NULL ||
-		    !dns_acl_allowed(&netaddr, name, NULL, 0, NULL,
+		    !dns_acl_allowed(&netaddr, name,
 				     client->view->nocasecompress, env))
 		{
 			dns_compress_setsensitive(&cctx, ISC_TRUE);
@@ -1755,9 +1756,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		int match;
 
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-		result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
-				       view->pad_acl, env, &match,
-				       NULL);
+		result = dns_acl_match(&netaddr, NULL, view->pad_acl,
+				       env, &match, NULL);
 		if (result == ISC_R_SUCCESS && match > 0) {
 			INSIST(count < DNS_EDNSOPTIONS);
 
@@ -2266,7 +2266,6 @@ ns__client_request(isc_task_t *task, isc_event_t *event) {
 	isc_boolean_t notimp;
 	size_t reqsize;
 	dns_aclenv_t *env;
-	dns_ecs_t *ecs = NULL;
 #ifdef HAVE_DNSTAP
 	dns_dtmsgtype_t dtmsgtype;
 #endif
@@ -2379,9 +2378,8 @@ ns__client_request(isc_task_t *task, isc_event_t *event) {
 	env = ns_interfacemgr_getaclenv(client->interface->mgr);
 	if (!TCP_CLIENT(client)) {
 		if (client->sctx->blackholeacl != NULL &&
-			dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
-				      client->sctx->blackholeacl, env, &match,
-				      NULL) == ISC_R_SUCCESS &&
+		    (dns_acl_match(&netaddr, NULL, client->sctx->blackholeacl,
+				   env, &match, NULL) == ISC_R_SUCCESS) &&
 		    match > 0)
 		{
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
@@ -2632,11 +2630,8 @@ ns__client_request(isc_task_t *task, isc_event_t *event) {
 
 	isc_sockaddr_fromnetaddr(&client->destsockaddr, &client->destaddr, 0);
 
-	if ((client->attributes & NS_CLIENTATTR_HAVEECS) != 0) {
-		ecs = &client->ecs;
-	}
 	result = client->sctx->matchingview(&netaddr, &client->destaddr,
-					    client->message, env, ecs,
+					    client->message, env,
 					    &sigresult, &client->view);
 	if (result != ISC_R_SUCCESS) {
 		char classname[DNS_RDATACLASS_FORMATSIZE];
@@ -3200,9 +3195,8 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 
 		if (client->sctx->blackholeacl != NULL &&
-			dns_acl_match(&netaddr, NULL, NULL, 0, NULL,
-				      client->sctx->blackholeacl,
-				      env, &match, NULL) == ISC_R_SUCCESS &&
+		    (dns_acl_match(&netaddr, NULL, client->sctx->blackholeacl,
+				   env, &match, NULL) == ISC_R_SUCCESS) &&
 		    match > 0)
 		{
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
@@ -3235,7 +3229,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
 				      "no more TCP clients(accept): %s",
 				      isc_result_totext(result));
 		} else if (client->sctx->keepresporder == NULL ||
-			   !dns_acl_allowed(&netaddr, NULL, NULL, 0, NULL,
+			   !dns_acl_allowed(&netaddr, NULL,
 					    client->sctx->keepresporder, env))
 		{
 			client->pipelined = ISC_TRUE;
@@ -3733,8 +3727,6 @@ ns_client_checkaclsilent(ns_client_t *client, isc_netaddr_t *netaddr,
 	isc_result_t result;
 	dns_aclenv_t *env = ns_interfacemgr_getaclenv(client->interface->mgr);
 	isc_netaddr_t tmpnetaddr;
-	isc_netaddr_t *ecs_addr = NULL;
-	isc_uint8_t ecs_addrlen = 0;
 	int match;
 
 	if (acl == NULL) {
@@ -3749,15 +3741,8 @@ ns_client_checkaclsilent(ns_client_t *client, isc_netaddr_t *netaddr,
 		netaddr = &tmpnetaddr;
 	}
 
-	if ((client->attributes & NS_CLIENTATTR_HAVEECS) != 0) {
-		ecs_addr = &client->ecs.addr;
-		ecs_addrlen = client->ecs.source;
-	}
-
-	result = dns_acl_match(netaddr, client->signer,
-			       ecs_addr, ecs_addrlen, NULL, acl,
+	result = dns_acl_match(netaddr, client->signer, acl,
 			       env, &match, NULL);
-
 	if (result != ISC_R_SUCCESS)
 		goto deny; /* Internal error, already logged. */
 

lib/ns/include/ns/log.h

@@ -28,6 +28,7 @@ LIBNS_EXTERNAL_DATA extern isc_logmodule_t ns_modules[];
 #define NS_LOGCATEGORY_UPDATE_SECURITY	(&ns_categories[4])
 #define NS_LOGCATEGORY_QUERY_ERRORS	(&ns_categories[5])
 #define NS_LOGCATEGORY_TAT		(&ns_categories[6])
+#define NS_LOGCATEGORY_SERVE_STALE	(&ns_categories[7])
 
 /*
  * Backwards compatibility.

lib/ns/include/ns/server.h

@@ -59,7 +59,7 @@ typedef void
  */
 typedef isc_result_t
 (*ns_matchview_t)(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-		  dns_message_t *message, dns_aclenv_t *env, dns_ecs_t *ecs,
+		  dns_message_t *message, dns_aclenv_t *env,
 		  isc_result_t *sigresultp, dns_view_t **viewp);
 
 /*%

lib/ns/interfacemgr.c

@@ -760,7 +760,7 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 	/* First add localhost address */
 	prefixlen = (netaddr->family == AF_INET) ? 32 : 128;
 	result = dns_iptable_addprefix(mgr->aclenv.localhost->iptable,
-				       netaddr, prefixlen, ISC_TRUE, ISC_FALSE);
+				       netaddr, prefixlen, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -790,7 +790,7 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 	}
 
 	result = dns_iptable_addprefix(mgr->aclenv.localnets->iptable,
-				       netaddr, prefixlen, ISC_TRUE, ISC_FALSE);
+				       netaddr, prefixlen, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -1049,11 +1049,11 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 			 * See if the address matches the listen-on statement;
 			 * if not, ignore the interface.
 			 */
-			(void)dns_acl_match(&listen_netaddr, NULL, NULL, 0,
-					    NULL, le->acl, &mgr->aclenv,
-					    &match, NULL);
-			if (match <= 0)
+			(void)dns_acl_match(&listen_netaddr, NULL, le->acl,
+					    &mgr->aclenv, &match, NULL);
+			if (match <= 0) {
 				continue;
+			}
 
 			if (adjusting == ISC_FALSE && dolistenon == ISC_TRUE) {
 				setup_listenon(mgr, &interface, le->port);
@@ -1081,18 +1081,20 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 				match = 0;
 				for (ele = ISC_LIST_HEAD(ext_listen->elts);
 				     ele != NULL;
-				     ele = ISC_LIST_NEXT(ele, link)) {
+				     ele = ISC_LIST_NEXT(ele, link))
+				{
 					(void)dns_acl_match(&listen_netaddr,
-							    NULL, NULL, 0,
 							    NULL, ele->acl,
 							    NULL, &match,
-							     NULL);
+							    NULL);
 					if (match > 0 &&
 					    (ele->port == le->port ||
 					    ele->port == 0))
+					{
 						break;
-					else
+					} else {
 						match = 0;
+					}
 				}
 				if (ipv6_wildcard == ISC_TRUE && match == 0)
 					continue;

lib/ns/log.c

@@ -34,6 +34,7 @@ LIBNS_EXTERNAL_DATA isc_logcategory_t ns_categories[] = {
 	{ "update-security",            0 },
 	{ "query-errors",               0 },
 	{ "trust-anchor-telemetry",     0 },
+	{ "serve-stale",                0 },
 	{ NULL, 			0 }
 };
 

lib/ns/query.c

@@ -5172,7 +5172,7 @@ root_key_sentinel_detect(query_ctx_t *qctx) {
 			      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
 			      "root-key-sentinel-is-ta query label found");
 	} else if (qctx->client->query.qname->length > 31 && ndata[0] == 30 &&
-	           strncasecmp(ndata + 1, "root-key-sentinel-not-ta-", 25) == 0)
+		   strncasecmp(ndata + 1, "root-key-sentinel-not-ta-", 25) == 0)
 	{
 		if (!get_root_key_sentinel_id(qctx, ndata + 26)) {
 			return;
@@ -5493,7 +5493,7 @@ query_lookup(query_ctx_t *qctx) {
 
 		dns_name_format(qctx->client->query.qname,
 				namebuf, sizeof(namebuf));
-		isc_log_write(ns_lctx, NS_LOGCATEGORY_GENERAL,
+		isc_log_write(ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
 			      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
 			      "%s resolver failure, stale answer %s",
 			      namebuf, success ? "used" : "unavailable");

lib/ns/sortlist.c

@@ -64,8 +64,8 @@ ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env,
 			try_elt = e;
 		}
 
-		if (dns_aclelement_match(clientaddr, NULL, NULL, 0, NULL,
-					 try_elt, env, &matched_elt))
+		if (dns_aclelement_match(clientaddr, NULL, try_elt,
+					 env, &matched_elt))
 		{
 			if (order_elt != NULL) {
 				if (order_elt->type ==
@@ -115,14 +115,14 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
 	const dns_acl_t *sortacl = sla->acl;
 	int match;
 
-	(void)dns_acl_match(addr, NULL, NULL, 0, NULL, sortacl, env, &match,
-			     NULL);
-	if (match > 0)
+	(void)dns_acl_match(addr, NULL, sortacl, env, &match, NULL);
+	if (match > 0) {
 		return (match);
-	else if (match < 0)
+	} else if (match < 0) {
 		return (INT_MAX - (-match));
-	else
+	} else {
 		return (INT_MAX / 2);
+	}
 }
 
 int
@@ -131,8 +131,7 @@ ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
 	const dns_aclenv_t *env = sla->env;
 	const dns_aclelement_t *element = sla->element;
 
-	if (dns_aclelement_match(addr, NULL, NULL, 0, NULL, element, env,
-				 NULL)) {
+	if (dns_aclelement_match(addr, NULL, element, env, NULL)) {
 		return (0);
 	}
 

lib/ns/tests/nstest.c

@@ -87,14 +87,13 @@ static isc_logcategory_t categories[] = {
 
 static isc_result_t
 matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-	  dns_message_t *message, dns_aclenv_t *env, dns_ecs_t *ecs,
+	  dns_message_t *message, dns_aclenv_t *env,
 	  isc_result_t *sigresultp, dns_view_t **viewp)
 {
 	UNUSED(srcaddr);
 	UNUSED(destaddr);
 	UNUSED(message);
 	UNUSED(env);
-	UNUSED(ecs);
 	UNUSED(sigresultp);
 	UNUSED(viewp);
 

util/check-changes

@@ -24,11 +24,11 @@ $\ = "\n";		# set output record separator
 
 $change = 0;
 $status = 0;
+$wasblank = 1;
 
 line: while (<>) {
     ($Fld1,$Fld2,$Fld3,$Fld4) = split(' ', $_, 9999);
-    $change = 0 if (!$master && $Fld1 eq "---" &&
-		    $Fld3 eq "released" && $Fld4 eq "---");
+    $change = 0 if (!$master && /^\s+--- .* ---$/);
     if ($Fld1 =~ /^[1-9][0-9]*\.$/ && $Fld2 =~ /^\[.*\]$/) {
 	if ($change != 0 && $Fld1 >= $change) {
 	    print 'bad change number', $Fld1;
@@ -39,6 +39,21 @@ line: while (<>) {
 	    $status = 1;
 	}
 	$change = $Fld1;
+	if (!$wasblank) {
+	    print 'missing blank line before change', $Fld1;
+	    $status = 1;
+	}
+    }
+    if (/^\s+--- .* ---$/) {
+	if (!$wasblank) {
+	    print 'missing blank line before release marker for', $Fld2;
+	    $status = 1;
+	}
+    }
+    if ($Fld1 eq "") {
+	$wasblank = 1;
+    } else {
+	$wasblank = 0;
     }
 }
 

util/copyrights

@@ -1,4 +1,3 @@
-./.clang-format					X	2018
 ./.gitattributes				X	2015,2017,2018
 ./.gitignore					X	2012,2013,2014,2015,2016,2017,2018
 ./.gitlab-ci.yml				X	2018
@@ -411,8 +410,6 @@
 ./bin/tests/system/acl/ns2/named3.conf.in	CONF-C	2008,2016,2018
 ./bin/tests/system/acl/ns2/named4.conf.in	CONF-C	2008,2016,2018
 ./bin/tests/system/acl/ns2/named5.conf.in	CONF-C	2013,2016,2018
-./bin/tests/system/acl/ns2/named6.conf.in	CONF-C	2014,2016,2018
-./bin/tests/system/acl/ns2/named7.conf.in	CONF-C	2014,2016,2018
 ./bin/tests/system/acl/ns3/example.db		ZONE	2017,2018
 ./bin/tests/system/acl/ns3/named.conf.in	CONF-C	2017,2018
 ./bin/tests/system/acl/ns4/example.db		ZONE	2017,2018
@@ -633,6 +630,7 @@
 ./bin/tests/system/checkconf/bad-catz-zone.conf	CONF-C	2016,2018
 ./bin/tests/system/checkconf/bad-dnskey-validity.conf	CONF-C	2018
 ./bin/tests/system/checkconf/bad-dnssec.conf	CONF-C	2012,2013,2016,2018
+./bin/tests/system/checkconf/bad-geoip-use-ecs.conf	CONF-C	2018
 ./bin/tests/system/checkconf/bad-glue-cache-bogus.conf	CONF-C	2017,2018
 ./bin/tests/system/checkconf/bad-hint.conf	CONF-C	2014,2016,2018
 ./bin/tests/system/checkconf/bad-in-view-dup.conf	CONF-C	2018
@@ -755,6 +753,7 @@
 ./bin/tests/system/checkconf/view-class-in2.conf	CONF-C	2016,2018
 ./bin/tests/system/checkconf/warn-dlv-auto.conf	CONF-C	2017,2018
 ./bin/tests/system/checkconf/warn-dlv-dlv.isc.org.conf	CONF-C	2017,2018
+./bin/tests/system/checkconf/warn-geoip-use-ecs.conf	CONF-C	2018
 ./bin/tests/system/checkconf/warn-keydir.conf	CONF-C	2013,2016,2018
 ./bin/tests/system/checkds/clean.sh		SH	2012,2013,2014,2016,2017,2018
 ./bin/tests/system/checkds/dig.bat		BAT	2016,2018
@@ -2788,6 +2787,7 @@
 ./doc/arm/notes.conf				X	2015,2018
 ./doc/arm/notes.html				X	2014,2015,2016,2017,2018
 ./doc/arm/notes.pdf				X	2014,2015,2016,2017,2018
+./doc/arm/notes.txt				X	2018
 ./doc/arm/notes.xml				SGML	2014,2015,2016,2017,2018
 ./doc/arm/noteversion.xml.in			SGML	2015,2016,2018
 ./doc/arm/options.grammar.xml			SGML	2018
@@ -3309,7 +3309,6 @@
 ./lib/dns/tests/dnstest.c			C	2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/dns/tests/dnstest.h			C	2011,2012,2014,2015,2016,2017,2018
 ./lib/dns/tests/dst_test.c			C	2018
-./lib/dns/tests/dstrandom_test.c		C	2017,2018
 ./lib/dns/tests/geoip_test.c			C	2013,2014,2015,2016,2017,2018
 ./lib/dns/tests/gost_test.c			C	2014,2015,2016,2017,2018
 ./lib/dns/tests/keytable_test.c			C	2014,2015,2016,2017,2018
@@ -3480,7 +3479,6 @@
 ./lib/isc/bind9.c				C	2013,2016,2018
 ./lib/isc/buffer.c				C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2008,2012,2014,2015,2016,2017,2018
 ./lib/isc/bufferlist.c				C	1999,2000,2001,2004,2005,2007,2016,2018
-./lib/isc/chacha_private.h			X	2014,2018
 ./lib/isc/commandline.c				C.PORTION	1999,2000,2001,2004,2005,2007,2008,2014,2015,2016,2018
 ./lib/isc/counter.c				C	2014,2016,2018
 ./lib/isc/crc64.c				C	2013,2016,2018
@@ -3490,8 +3488,7 @@
 ./lib/isc/hash.c				C	2003,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017,2018
 ./lib/isc/heap.c				C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2010,2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/isc/hex.c					C	2000,2001,2002,2003,2004,2005,2007,2008,2013,2014,2015,2016,2018
-./lib/isc/hmacmd5.c				C	2000,2001,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017,2018
-./lib/isc/hmacsha.c				C	2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018
+./lib/isc/hmac.c				C	2000,2001,2004,2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/isc/ht.c					C	2016,2017,2018
 ./lib/isc/httpd.c				C	2006,2007,2008,2010,2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/isc/ia64/Makefile.in			MAKE	2007,2012,2016,2018
@@ -3525,8 +3522,7 @@
 ./lib/isc/include/isc/hash.h			C	2003,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017,2018
 ./lib/isc/include/isc/heap.h			C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2009,2012,2016,2018
 ./lib/isc/include/isc/hex.h			C	2000,2001,2004,2005,2006,2007,2008,2016,2018
-./lib/isc/include/isc/hmacmd5.h			C	2000,2001,2004,2005,2006,2007,2009,2014,2016,2017,2018
-./lib/isc/include/isc/hmacsha.h			C	2005,2006,2007,2009,2014,2016,2017,2018
+./lib/isc/include/isc/hmac.h			C	2000,2001,2004,2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018
 ./lib/isc/include/isc/ht.h			C	2016,2017,2018
 ./lib/isc/include/isc/httpd.h			C	2006,2007,2008,2014,2016,2018
 ./lib/isc/include/isc/interfaceiter.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018

win32utils/Configure

@@ -1965,14 +1965,6 @@ if ($cryptolib ne "") {
     die "No cryptography library has been found or provided."
 }
 
-# enable-openssl-hash
-if ($enable_openssl_hash eq "yes") {
-    if ($use_openssl eq "no") {
-        die "No OpenSSL for hash functions\n";
-    }
-    $configdefp{"ISC_PLATFORM_OPENSSLHASH"} = 1;
-}
-
 # with-pkcs11
 if ($use_pkcs11 ne "no") {
     $configcond{"PKCS11"} = 1;