Evan Hunt [Wed, 30 Jan 2019 23:42:04 +0000 (15:42 -0800)]
Change #4148 wasn't complete
- there was a memory leak when using negotiated TSIG keys.
- TKEY responses could only be signed when using a newly negotiated
key; if an existent matching TSIG was found in in the keyring it
would not be used.
Evan Hunt [Mon, 21 Jan 2019 07:50:17 +0000 (23:50 -0800)]
Ancient named.conf options are now a fatal configuration error
- options that were flagged as obsolete or not implemented in 9.0.0
are now flagged as "ancient", and are a fatal error
- the ARM has been updated to remove these, along with other
obsolete descriptions of BIND 8 behavior
- the log message for obsolete options explicitly recommends removal
Matthijs Mekking [Thu, 24 Jan 2019 09:28:41 +0000 (10:28 +0100)]
Add tests for dumpdb stale ttl
This adds a test for rndc dumpdb to ensure the correct "stale
comment" is printed. It also adds a test for non-stale data to
ensure no "stale comment" is printed for active RRsets.
In addition, the serve-stale tests are hardened with more accurate
grep calls.
Matthijs Mekking [Thu, 24 Jan 2019 09:24:44 +0000 (10:24 +0100)]
Print in dump-file stale ttl
This change makes rndc dumpdb correctly print the "; stale" line.
It also provides extra information on how long this data may still
be served to clients (in other words how long the stale RRset may
still be used).
Evan Hunt [Tue, 29 Jan 2019 19:39:06 +0000 (11:39 -0800)]
allow TSIG key to be added to message structure after parsing
up until now, message->tsigkey could only be set during parsing
of the request, but gss-tsig allows one to be created afterward.
this commit adds a new flag to the message structure, `new_tsigkey`,
which indicates that in this case it's okay for `dns_message_settsigkey()`
to be run on a message after parsing, without hitting any assertions due
to the lack of a TSIG in the request. this allows us to keep the current
restriction in place generally, but add an exception for TKEY processing.
it's probably better to just remove the restriction entirely (see next
commit).
Matthijs Mekking [Tue, 29 Jan 2019 17:09:06 +0000 (18:09 +0100)]
Weak verification for signed TKEY response
The introduced grep call checks whether there was a
response that has an answer and an additional record.
There should be only one in the nsupdate output that is
for the TKEY response.
Matthijs Mekking [Tue, 29 Jan 2019 17:09:06 +0000 (18:09 +0100)]
Weak verification for signed TKEY response
The introduced grep call checks whether there was a
response that has an answer and an additional record.
There should be only one in the nsupdate output that is
for the TKEY response.
Evan Hunt [Sun, 20 Jan 2019 00:12:45 +0000 (16:12 -0800)]
added querytrace documentation in README
also:
- rearranged things a little, adding a "dependencies" section
- removed the documentation of 'enable-threads'. (this part of
the change should not be backported.)
Michał Kępień [Mon, 28 Jan 2019 12:37:39 +0000 (13:37 +0100)]
Update the list of supported platforms
- Change 5023 (present in BIND 9.13.3+) removed BIND's internal
implementation of the getifaddrs() function which was required for
iterating network interfaces on Solaris 10 as that system does not
support that function natively.
- As of January 2019, FreeBSD 10.x is neither supported upstream nor
regularly tested by ISC, so move it from the list of regularly tested
platforms to the "Best effort" section.
- Debian 10, OpenBSD 6.3, and Fedora 29 have been released and are now
tested regularly.
Witold Kręcicki [Thu, 24 Jan 2019 11:01:11 +0000 (12:01 +0100)]
- Make isc_quota use atomics instead of locks
- Use getters for isc_quota parameters, make fields private
- Fix a potential data race with recursion clients limits logging
Evan Hunt [Thu, 24 Jan 2019 02:32:36 +0000 (18:32 -0800)]
fix sfcache test
use a lame server configuration to force SERVFAILs instead of killing ns2.
this prevents test failures that occurred due to a different behavior of
the netowrking stack in windows.
Evan Hunt [Wed, 23 Jan 2019 06:24:24 +0000 (22:24 -0800)]
fix notify test
test the average delay between notifies instead of the minimum delay;
this helps avoid unnecessary test failures on systems with bursty
network performance.
Michał Kępień [Fri, 18 Jan 2019 10:15:19 +0000 (11:15 +0100)]
dig: return a non-zero exit code for failed TCP EOF retries
dig retries a TCP query when a server closes the connection prematurely.
However, dig's exit code remains unaffected even if the second attempt
to get a response also fails with the same error for the same lookup,
which should not be the case. Ensure the exit code is updated
appropriately when a retry triggered by a TCP EOF condition fails.
Evan Hunt [Mon, 21 Jan 2019 21:12:26 +0000 (13:12 -0800)]
improve handling of trailing dots in dnssec-keymgr and dnssec-coverage
- mishandling of trailing dots caused bad behavior with the
root zone or names like "example.com."
- fixing this exposed an error in dnssec-coverage caused the
wrong return value if there were KSK errors but no ZSK errors
- incidentally silenced the dnssec-keygen output in the coverage
system test
projects / thirdparty / bind9.git / log
