+4152. [func] Implement DNS COOKIE option. This replaces the
+ experimental SIT option of BIND 9.10. The following
+ named.conf directives are avaliable: send-cookie,
+ cookie-secret, cookie-algorithm and nocookie-udp-size.
+ The following dig options are available:
+ +[no]cookie[=value] and +[no]badcookie. [RT #39928]
+
4151. [bug] 'rndc flush' could cause a deadlock. [RT #39835]
4150. [bug] win32: listen-on-v6 { any; }; was not working. Apply
#include <dns/masterdump.h>
#include <dns/message.h>
#include <dns/name.h>
+#include <dns/rcode.h>
#include <dns/rdata.h>
#include <dns/rdataset.h>
#include <dns/rdatatype.h>
static int addresscount = 0;
static char domainopt[DNS_NAME_MAXTEXT];
-#ifdef ISC_PLATFORM_USESIT
-static char sitvalue[256];
-#endif
+static char hexcookie[81];
static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
"RESERVED15"
};
-/*% return code text */
-static const char * const rcodetext[] = {
- "NOERROR",
- "FORMERR",
- "SERVFAIL",
- "NXDOMAIN",
- "NOTIMP",
- "REFUSED",
- "YXDOMAIN",
- "YXRRSET",
- "NXRRSET",
- "NOTAUTH",
- "NOTZONE",
- "RESERVED11",
- "RESERVED12",
- "RESERVED13",
- "RESERVED14",
- "RESERVED15",
- "BADVERS"
-};
+static const char *
+rcode_totext(dns_rcode_t rcode) {
+ static char buf[64];
+ isc_buffer_t b;
+ isc_result_t result;
-/*% safe rcodetext[] */
-static char *
-rcode_totext(dns_rcode_t rcode)
-{
- static char buf[sizeof("?65535")];
- union {
- const char *consttext;
- char *deconsttext;
- } totext;
-
- if (rcode >= (sizeof(rcodetext)/sizeof(rcodetext[0]))) {
- snprintf(buf, sizeof(buf), "?%u", rcode);
- totext.deconsttext = buf;
- } else
- totext.consttext = rcodetext[rcode];
- return totext.deconsttext;
+ memset(buf, 0, sizeof(buf));
+ isc_buffer_init(&b, buf + 1, sizeof(buf) - 2);
+ result = dns_rcode_totext(rcode, &b);
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
+ if (strspn(buf + 1, "0123456789") == strlen(buf + 1)) {
+ buf[0] = '?';
+ return(buf);
+ }
+ return (buf + 1);
}
/*% print usage */
" +[no]expire (Request time to expire)\n"
" +[no]nsid (Request Name Server ID)\n"
" +[no]header-only (Send query without a question section)\n"
-#ifdef ISC_PLATFORM_USESIT
-" +[no]sit (Request a Source Identity Token)\n"
-#endif
+" +[no]badcookie (Retry BADCOOKIE responses)\n"
+" +[no]cookie (Add a COOKIE option to the request)\n"
#ifdef DIG_SIGCHASE
" +[no]sigchase (Chase DNSSEC signatures)\n"
" +trusted-key=#### (Trusted Key when chasing DNSSEC sigs)\n"
char *cmd, *value, *ptr, *code;
isc_uint32_t num;
isc_boolean_t state = ISC_TRUE;
-#if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT)
size_t n;
-#endif
strncpy(option_store, option, sizeof(option_store));
option_store[sizeof(option_store)-1]=0;
break;
case 'b':
switch (cmd[1]) {
+ case 'a':/* badcookie */
+ FULLCHECK("badcookie");
+ lookup->besteffort = state;
+ break;
case 'e':/* besteffort */
FULLCHECK("besteffort");
lookup->besteffort = state;
printcmd = state;
break;
case 'o': /* comments */
- FULLCHECK("comments");
- lookup->comments = state;
- if (lookup == default_lookup)
- pluscomm = state;
+ switch (cmd[2]) {
+ case 'm':
+ FULLCHECK("comments");
+ lookup->comments = state;
+ if (lookup == default_lookup)
+ pluscomm = state;
+ break;
+ case 'o': /* cookie */
+ FULLCHECK("cookie");
+ if (state && lookup->edns == -1)
+ lookup->edns = 0;
+ lookup->sendcookie = state;
+ if (value != NULL) {
+ n = strlcpy(hexcookie, value,
+ sizeof(hexcookie));
+ if (n >= sizeof(hexcookie))
+ fatal("COOKIE data too large");
+ lookup->cookie = hexcookie;
+ } else
+ lookup->cookie = NULL;
+ break;
+ default:
+ goto invalid_option;
+ }
break;
case 'r':
FULLCHECK("crypto");
goto invalid_option;
}
break;
-#if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT)
- case 'i':
- switch (cmd[2]) {
#ifdef DIG_SIGCHASE
- case 'g': /* sigchase */
- FULLCHECK("sigchase");
- lookup->sigchase = state;
- if (lookup->sigchase)
- lookup->dnssec = ISC_TRUE;
- break;
-#endif
-#ifdef ISC_PLATFORM_USESIT
- case 't': /* sit */
- FULLCHECK("sit");
- if (state && lookup->edns == -1)
- lookup->edns = 0;
- lookup->sit = state;
- if (value != NULL) {
- n = strlcpy(sitvalue, value,
- sizeof(sitvalue));
- if (n >= sizeof(sitvalue))
- fatal("SIT data too large");
- lookup->sitvalue = sitvalue;
- } else
- lookup->sitvalue = NULL;
- break;
-#endif
- default:
- goto invalid_option;
- }
+ case 'i': /* sigchase */
+ FULLCHECK("sigchase");
+ lookup->sigchase = state;
+ if (lookup->sigchase)
+ lookup->dnssec = ISC_TRUE;
break;
#endif
case 'p': /* split */
lookup->section_authority = ISC_TRUE;
lookup->section_question = ISC_FALSE;
lookup->dnssec = ISC_TRUE;
+ lookup->sendcookie = ISC_TRUE;
usesearch = ISC_FALSE;
}
break;
default_lookup = make_empty_lookup();
default_lookup->adflag = ISC_TRUE;
default_lookup->edns = 0;
+ default_lookup->sendcookie = ISC_TRUE;
#ifndef NOPOSIX
/*
<variablelist>
<varlistentry>
- <term>-4</term>
- <listitem>
+ <term>-4</term>
+ <listitem>
<para>
Use IPv4 only.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-6</term>
- <listitem>
+ <term>-6</term>
+ <listitem>
<para>
Use IPv6 only.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-b <replaceable class="parameter">address<optional>#port</optional></replaceable></term>
- <listitem>
+ <term>-b <replaceable class="parameter">address<optional>#port</optional></replaceable></term>
+ <listitem>
<para>
Set the source IP address of the query.
The <parameter>address</parameter> must be a valid address on
one of the host's network interfaces, or "0.0.0.0" or "::". An
optional port may be specified by appending "#<port>"
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-c <replaceable class="parameter">class</replaceable></term>
- <listitem>
+ <term>-c <replaceable class="parameter">class</replaceable></term>
+ <listitem>
<para>
Set the query class. The
default <parameter>class</parameter> is IN; other classes
are HS for Hesiod records or CH for Chaosnet records.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-f <replaceable class="parameter">file</replaceable></term>
- <listitem>
+ <term>-f <replaceable class="parameter">file</replaceable></term>
+ <listitem>
<para>
Batch mode: <command>dig</command> reads a list of lookup
requests to process from the
presented as queries to
<command>dig</command> using the command-line interface.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-i</term>
- <listitem>
+ <term>-i</term>
+ <listitem>
<para>
Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT
domain, which is no longer in use. Obsolete bit string
label queries (RFC2874) are not attempted.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-k <replaceable class="parameter">keyfile</replaceable></term>
- <listitem>
+ <term>-k <replaceable class="parameter">keyfile</replaceable></term>
+ <listitem>
<para>
Sign queries using TSIG using a key read from the given file.
Key files can be generated using
and <command>server</command> statements in
<filename>named.conf</filename>.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-m</term>
- <listitem>
+ <term>-m</term>
+ <listitem>
<para>
Enable memory usage debugging.
<!-- It enables ISC_MEM_DEBUGTRACE and ISC_MEM_DEBUGRECORD
documented in include/isc/mem.h -->
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-p <replaceable class="parameter">port</replaceable></term>
- <listitem>
+ <term>-p <replaceable class="parameter">port</replaceable></term>
+ <listitem>
<para>
Send the query to a non-standard port on the server,
instead of the defaut port 53. This option would be used
to test a name server that has been configured to listen
for queries on a non-standard port number.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-q <replaceable class="parameter">name</replaceable></term>
- <listitem>
+ <term>-q <replaceable class="parameter">name</replaceable></term>
+ <listitem>
<para>
The domain name to query. This is useful to distinguish
the <parameter>name</parameter> from other arguments.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-t <replaceable class="parameter">type</replaceable></term>
- <listitem>
+ <term>-t <replaceable class="parameter">type</replaceable></term>
+ <listitem>
<para>
The resource record type to query. It can be any valid query type
which is
record was
<parameter>N</parameter>.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-v</term>
- <listitem>
+ <term>-v</term>
+ <listitem>
<para>
Print the version number and exit.
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-x <replaceable class="parameter">addr</replaceable></term>
- <listitem>
+ <term>-x <replaceable class="parameter">addr</replaceable></term>
+ <listitem>
<para>
Simplified reverse lookups, for mapping addresses to
names. The <parameter>addr</parameter> is an IPv4 address
IP6.ARPA domain (but see also the <option>-i</option>
option).
</para>
- </listitem>
+ </listitem>
</varlistentry>
<varlistentry>
- <term>-y <replaceable class="parameter"><optional>hmac:</optional>keyname:secret</replaceable></term>
- <listitem>
+ <term>-y <replaceable class="parameter"><optional>hmac:</optional>keyname:secret</replaceable></term>
+ <listitem>
<para>
Sign queries using TSIG with the given authentication key.
<parameter>keyname</parameter> is the name of the key, and
a command line argument in clear text. This may be visible
in the output from
<citerefentry>
- <refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum>
+ <refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>
or in a history file maintained by the user's shell.
</para>
- </listitem>
+ </listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><option>+[no]badcookie</option></term>
+ <listitem>
+ <para>
+ Retry lookup with the new server cookie if a
+ BADCOOKIE response is received.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><option>+[no]besteffort</option></term>
<listitem>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><option>+[no]cookie<optional>=####</optional></option></term>
+ <listitem>
+ <para>
+ Send a COOKIE EDNS option, with optional
+ value. Replaying a COOKIE from a previous response will
+ allow the server to identify a previous client. The
+ default is <option>+cookie</option>.
+ </para>
+ <para>
+ <command>+cookie</command> is also set when +trace
+ is set to better emulate the default queries from a
+ nameserver.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><option>+[no]crypto</option></term>
<listitem>
</listitem>
</varlistentry>
- <varlistentry>
- <term><option>+[no]sit<optional>=####</optional></option></term>
- <listitem>
- <para>
- Send a Source Identity Token EDNS option, with optional
- value. Replaying a SIT from a previous response will
- allow the server to identify a previous client. The
- default is <option>+nosit</option>. Currently using
- experimental value 65001 for the option code.
- </para>
- </listitem>
- </varlistentry>
-
<varlistentry>
<term><option>+split=W</option></term>
<listitem>
int tries = 3;
int lookup_counter = 0;
-#ifdef ISC_PLATFORM_USESIT
-static char sitvalue[256];
-#endif
+static char servercookie[256];
#ifdef WITH_IDN
static void initialize_idn(void);
looknew->expire = ISC_FALSE;
looknew->nsid = ISC_FALSE;
looknew->header_only = ISC_FALSE;
-#ifdef ISC_PLATFORM_USESIT
- looknew->sit = ISC_FALSE;
-#endif
+ looknew->sendcookie = ISC_FALSE;
+ looknew->seenbadcookie = ISC_FALSE;
+ looknew->badcookie = ISC_TRUE;
#ifdef DIG_SIGCHASE
looknew->sigchase = ISC_FALSE;
#if DIG_SIGCHASE_TD
looknew->done_as_is = ISC_FALSE;
looknew->need_search = ISC_FALSE;
looknew->ecs_addr = NULL;
-#ifdef ISC_PLATFORM_USESIT
- looknew->sitvalue = NULL;
-#endif
+ looknew->cookie = NULL;
looknew->ednsopts = NULL;
looknew->ednsoptscnt = 0;
looknew->ednsneg = ISC_TRUE;
looknew->expire = lookold->expire;
looknew->nsid = lookold->nsid;
looknew->header_only = lookold->header_only;
-#ifdef ISC_PLATFORM_USESIT
- looknew->sit = lookold->sit;
- looknew->sitvalue = lookold->sitvalue;
-#endif
+ looknew->sendcookie = lookold->sendcookie;
+ looknew->seenbadcookie = lookold->seenbadcookie;
+ looknew->badcookie = lookold->badcookie;
+ looknew->cookie = lookold->cookie;
looknew->ednsopts = lookold->ednsopts;
looknew->ednsoptscnt = lookold->ednsoptscnt;
looknew->ednsneg = lookold->ednsneg;
/*%
* Add EDNS0 option record to a message. Currently, the only supported
* options are UDP buffer size, the DO bit, and EDNS options
- * (e.g., NSID, SIT, client-subnet)
+ * (e.g., NSID, COOKIE, client-subnet)
*/
static void
add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
dns_message_addname(lookup->sendmsg, soaname, DNS_SECTION_AUTHORITY);
}
-#ifdef ISC_PLATFORM_USESIT
static void
compute_cookie(unsigned char *clientcookie, size_t len) {
/* XXXMPA need to fix, should be per server. */
INSIST(len >= 8U);
memmove(clientcookie, cookie_secret, 8);
}
-#endif
/*%
* Setup the supplied lookup structure, making it ready to start sending
dns_compress_t cctx;
char store[MXNAME];
char ecsbuf[20];
-#ifdef ISC_PLATFORM_USESIT
- char sitbuf[256];
-#endif
+ char cookiebuf[256];
#ifdef WITH_IDN
idn_result_t mr;
char utf8_textname[MXNAME], utf8_origin[MXNAME], idn_textname[MXNAME];
i++;
}
-#ifdef ISC_PLATFORM_USESIT
- if (lookup->sit) {
+ if (lookup->sendcookie) {
INSIST(i < DNS_EDNSOPTIONS);
- opts[i].code = DNS_OPT_SIT;
- if (lookup->sitvalue != NULL) {
- isc_buffer_init(&b, sitbuf, sizeof(sitbuf));
- result = isc_hex_decodestring(lookup->sitvalue,
+ opts[i].code = DNS_OPT_COOKIE;
+ if (lookup->cookie != NULL) {
+ isc_buffer_init(&b, cookiebuf,
+ sizeof(cookiebuf));
+ result = isc_hex_decodestring(lookup->cookie,
&b);
check_result(result, "isc_hex_decodestring");
opts[i].value = isc_buffer_base(&b);
}
i++;
}
-#endif
if (lookup->expire) {
INSIST(i < DNS_EDNSOPTIONS);
return (ISC_TRUE);
}
-#ifdef ISC_PLATFORM_USESIT
static void
-process_sit(dig_lookup_t *l, dns_message_t *msg,
- isc_buffer_t *optbuf, size_t optlen)
+process_cookie(dig_lookup_t *l, dns_message_t *msg,
+ isc_buffer_t *optbuf, size_t optlen)
{
char bb[256];
isc_buffer_t hexbuf;
size_t len;
- const unsigned char *sit;
- isc_boolean_t copysit;
+ const unsigned char *sent;
+ isc_boolean_t copy = ISC_TRUE;
isc_result_t result;
- if (l->sitvalue != NULL) {
+ if (l->cookie != NULL) {
isc_buffer_init(&hexbuf, bb, sizeof(bb));
- result = isc_hex_decodestring(l->sitvalue, &hexbuf);
+ result = isc_hex_decodestring(l->cookie, &hexbuf);
check_result(result, "isc_hex_decodestring");
- sit = isc_buffer_base(&hexbuf);
+ sent = isc_buffer_base(&hexbuf);
len = isc_buffer_usedlength(&hexbuf);
- copysit = ISC_FALSE;
} else {
- sit = cookie;
+ sent = cookie;
len = sizeof(cookie);
- copysit = ISC_TRUE;
}
- INSIST(msg->sitok == 0 && msg->sitbad == 0);
+ INSIST(msg->cc_ok == 0 && msg->cc_bad == 0);
if (optlen >= len && optlen >= 8U) {
- if (memcmp(isc_buffer_current(optbuf), sit, 8) == 0) {
- msg->sitok = 1;
+ if (memcmp(isc_buffer_current(optbuf), sent, 8) == 0) {
+ msg->cc_ok = 1;
} else {
- printf(";; Warning: SIT client cookie mismatch\n");
- msg->sitbad = 1;
- copysit = ISC_FALSE;
+ printf(";; Warning: Client COOKIE mismatch\n");
+ msg->cc_bad = 1;
+ copy = ISC_FALSE;
}
} else {
- printf(";; Warning: SIT bad token (too short)\n");
- msg->sitbad = 1;
- copysit = ISC_FALSE;
+ printf(";; Warning: COOKIE bad token (too short)\n");
+ msg->cc_bad = 1;
+ copy = ISC_FALSE;
}
- if (copysit) {
+ if (copy) {
isc_region_t r;
r.base = isc_buffer_current(optbuf);
r.length = (unsigned int)optlen;
- isc_buffer_init(&hexbuf, sitvalue, sizeof(sitvalue));
+ isc_buffer_init(&hexbuf, servercookie, sizeof(servercookie));
result = isc_hex_totext(&r, 2, "", &hexbuf);
check_result(result, "isc_hex_totext");
if (isc_buffer_availablelength(&hexbuf) > 0) {
isc_buffer_putuint8(&hexbuf, 0);
- l->sitvalue = sitvalue;
+ l->cookie = servercookie;
}
}
isc_buffer_forward(optbuf, (unsigned int)optlen);
optcode = isc_buffer_getuint16(&optbuf);
optlen = isc_buffer_getuint16(&optbuf);
switch (optcode) {
- case DNS_OPT_SIT:
- process_sit(l, msg, &optbuf, optlen);
+ case DNS_OPT_COOKIE:
+ process_cookie(l, msg, &optbuf, optlen);
break;
default:
isc_buffer_forward(&optbuf, optlen);
}
}
}
-#endif
static int
ednsvers(dns_rdataset_t *opt) {
}
if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
!l->ignore && !l->tcp_mode) {
-#ifdef ISC_PLATFORM_USESIT
- if (l->sitvalue == NULL && l->sit && msg->opt != NULL)
+ if (l->cookie == NULL && l->sendcookie && msg->opt != NULL)
process_opt(l, msg);
-#endif
if (l->comments)
printf(";; Truncated, retrying in TCP mode.\n");
n = requeue_lookup(l, ISC_TRUE);
UNLOCK_LOOKUP;
return;
}
+ if (msg->rcode == dns_rcode_badcookie && !l->tcp_mode &&
+ l->sendcookie && l->badcookie) {
+ process_opt(l, msg);
+ if (msg->cc_ok) {
+ if (l->comments)
+ printf(";; BADCOOKIE, retrying%s.\n",
+ l->seenbadcookie ? " in TCP mode" : "");
+ n = requeue_lookup(l, ISC_TRUE);
+ if (l->seenbadcookie)
+ n->tcp_mode = ISC_TRUE;
+ n->seenbadcookie = ISC_TRUE;
+ n->origin = query->lookup->origin;
+ dns_message_destroy(&msg);
+ isc_event_free(&event);
+ clear_query(query);
+ cancel_lookup(l);
+ check_next_lookup(l);
+ UNLOCK_LOOKUP;
+ return;
+ }
+ }
if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
(check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
{
}
}
-#ifdef ISC_PLATFORM_USESIT
- if (l->sitvalue != NULL) {
+ if (l->cookie != NULL) {
if (msg->opt == NULL)
printf(";; expected opt record in response\n");
else
process_opt(l, msg);
- } else if (l->sit && msg->opt != NULL)
+ } else if (l->sendcookie && msg->opt != NULL)
process_opt(l, msg);
-#endif
-
if (!l->doing_xfr || l->xfr_q == query) {
if (msg->rcode == dns_rcode_nxdomain &&
(l->origin != NULL || l->need_search)) {
besteffort,
dnssec,
expire,
-#ifdef ISC_PLATFORM_USESIT
- sit,
-#endif
+ sendcookie,
+ seenbadcookie,
+ badcookie,
nsid, /*% Name Server ID (RFC 5001) */
header_only,
ednsneg;
isc_uint32_t msgcounter;
dns_fixedname_t fdomain;
isc_sockaddr_t *ecs_addr;
-#ifdef ISC_PLATFORM_USESIT
- char *sitvalue;
-#endif
+ char *cookie;
dns_ednsopt_t *ednsopts;
unsigned int ednsoptscnt;
isc_dscp_t dscp;
#include <config.h>
+#include <isc/aes.h>
#include <isc/formatcheck.h>
+#include <isc/hmacsha.h>
#include <isc/mutex.h>
#include <isc/once.h>
#include <isc/platform.h>
#include <isc/timer.h>
#include <isc/util.h>
-#ifdef AES_SIT
-#include <isc/aes.h>
-#else
-#include <isc/hmacsha.h>
-#endif
-
#include <dns/badcache.h>
#include <dns/db.h>
#include <dns/dispatch.h>
*/
#endif
-#define SIT_SIZE 24U /* 8 + 4 + 4 + 8 */
+#define COOKIE_SIZE 24U /* 8 + 4 + 4 + 8 */
#define ECS_SIZE 20U /* 2 + 1 + 1 + [0..16] */
/*% nameserver client manager structure */
static inline isc_boolean_t
allowed(isc_netaddr_t *addr, dns_name_t *signer, isc_netaddr_t *ecs_addr,
isc_uint8_t ecs_addrlen, isc_uint8_t *ecs_scope, dns_acl_t *acl);
-#ifdef ISC_PLATFORM_USESIT
-static void compute_sit(ns_client_t *client, isc_uint32_t when,
- isc_uint32_t nonce, isc_buffer_t *buf);
-#endif
+static void compute_cookie(ns_client_t *client, isc_uint32_t when,
+ isc_uint32_t nonce, isc_buffer_t *buf);
void
ns_client_recursing(ns_client_t *client) {
}
} else {
data = sendbuf;
-#ifdef ISC_PLATFORM_USESIT
- if ((client->attributes & NS_CLIENTATTR_HAVESIT) == 0) {
+ if ((client->attributes & NS_CLIENTATTR_HAVECOOKIE) == 0) {
if (client->view != NULL)
- bufsize = client->view->situdp;
+ bufsize = client->view->nocookieudp;
else
bufsize = 512;
} else
bufsize = client->udpsize;
if (bufsize > SEND_BUFFER_SIZE)
bufsize = SEND_BUFFER_SIZE;
-#else
- if (client->udpsize < SEND_BUFFER_SIZE)
- bufsize = client->udpsize;
- else
- bufsize = SEND_BUFFER_SIZE;
-#endif
if (length > bufsize) {
result = ISC_R_NOSPACE;
goto done;
{
unsigned char ecs[ECS_SIZE];
char nsid[BUFSIZ], *nsidp;
-#ifdef ISC_PLATFORM_USESIT
- unsigned char sit[SIT_SIZE];
-#endif
+ unsigned char cookie[COOKIE_SIZE];
isc_result_t result;
dns_view_t *view;
dns_resolver_t *resolver;
count++;
}
no_nsid:
-#ifdef ISC_PLATFORM_USESIT
- if ((client->attributes & NS_CLIENTATTR_WANTSIT) != 0) {
+ if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0) {
isc_buffer_t buf;
isc_stdtime_t now;
isc_uint32_t nonce;
- isc_buffer_init(&buf, sit, sizeof(sit));
+ isc_buffer_init(&buf, cookie, sizeof(cookie));
isc_stdtime_get(&now);
isc_random_get(&nonce);
- compute_sit(client, now, nonce, &buf);
+ compute_cookie(client, now, nonce, &buf);
INSIST(count < DNS_EDNSOPTIONS);
- ednsopts[count].code = DNS_OPT_SIT;
- ednsopts[count].length = SIT_SIZE;
- ednsopts[count].value = sit;
+ ednsopts[count].code = DNS_OPT_COOKIE;
+ ednsopts[count].length = COOKIE_SIZE;
+ ednsopts[count].value = cookie;
count++;
}
-#endif
if ((client->attributes & NS_CLIENTATTR_HAVEEXPIRE) != 0) {
isc_buffer_t buf;
return (ISC_TF(view == myview));
}
-#ifdef ISC_PLATFORM_USESIT
static void
-compute_sit(ns_client_t *client, isc_uint32_t when, isc_uint32_t nonce,
- isc_buffer_t *buf)
+compute_cookie(ns_client_t *client, isc_uint32_t when, isc_uint32_t nonce,
+ isc_buffer_t *buf)
{
-#ifdef AES_SIT
- unsigned char digest[ISC_AES_BLOCK_LENGTH];
- unsigned char input[4 + 4 + 16];
- isc_netaddr_t netaddr;
- unsigned char *cp;
- unsigned int i;
-
- memset(input, 0, sizeof(input));
- cp = isc_buffer_used(buf);
- isc_buffer_putmem(buf, client->cookie, 8);
- isc_buffer_putuint32(buf, nonce);
- isc_buffer_putuint32(buf, when);
- memmove(input, cp, 16);
- isc_aes128_crypt(ns_g_server->secret, input, digest);
- for (i = 0; i < 8; i++)
- input[i] = digest[i] ^ digest[i + 8];
- isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
- switch (netaddr.family) {
- case AF_INET:
- memmove(input + 8, (unsigned char *)&netaddr.type.in, 4);
- memset(input + 12, 0, 4);
- isc_aes128_crypt(ns_g_server->secret, input, digest);
- break;
- case AF_INET6:
- memmove(input + 8, (unsigned char *)&netaddr.type.in6, 16);
+ switch (ns_g_server->cookiealg) {
+ case ns_cookiealg_aes: {
+ unsigned char digest[ISC_AES_BLOCK_LENGTH];
+ unsigned char input[4 + 4 + 16];
+ isc_netaddr_t netaddr;
+ unsigned char *cp;
+ unsigned int i;
+
+ memset(input, 0, sizeof(input));
+ cp = isc_buffer_used(buf);
+ isc_buffer_putmem(buf, client->cookie, 8);
+ isc_buffer_putuint32(buf, nonce);
+ isc_buffer_putuint32(buf, when);
+ memmove(input, cp, 16);
isc_aes128_crypt(ns_g_server->secret, input, digest);
for (i = 0; i < 8; i++)
- input[i + 8] = digest[i] ^ digest[i + 8];
- isc_aes128_crypt(ns_g_server->secret, input + 8, digest);
+ input[i] = digest[i] ^ digest[i + 8];
+ isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+ switch (netaddr.family) {
+ case AF_INET:
+ cp = (unsigned char *)&netaddr.type.in;
+ memmove(input + 8, cp, 4);
+ memset(input + 12, 0, 4);
+ isc_aes128_crypt(ns_g_server->secret, input, digest);
+ break;
+ case AF_INET6:
+ cp = (unsigned char *)&netaddr.type.in6;
+ memmove(input + 8, cp, 16);
+ isc_aes128_crypt(ns_g_server->secret, input, digest);
+ for (i = 0; i < 8; i++)
+ input[i + 8] = digest[i] ^ digest[i + 8];
+ isc_aes128_crypt(ns_g_server->secret, input + 8,
+ digest);
+ break;
+ }
+ for (i = 0; i < 8; i++)
+ digest[i] ^= digest[i + 8];
+ isc_buffer_putmem(buf, digest, 8);
break;
}
- for (i = 0; i < 8; i++)
- digest[i] ^= digest[i + 8];
- isc_buffer_putmem(buf, digest, 8);
-#endif
-#ifdef HMAC_SHA1_SIT
- unsigned char digest[ISC_SHA1_DIGESTLENGTH];
- isc_netaddr_t netaddr;
- unsigned char *cp;
- isc_hmacsha1_t hmacsha1;
-
- cp = isc_buffer_used(buf);
- isc_buffer_putmem(buf, client->cookie, 8);
- isc_buffer_putuint32(buf, nonce);
- isc_buffer_putuint32(buf, when);
-
- isc_hmacsha1_init(&hmacsha1,
- ns_g_server->secret,
- ISC_SHA1_DIGESTLENGTH);
- isc_hmacsha1_update(&hmacsha1, cp, 16);
- isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
- switch (netaddr.family) {
- case AF_INET:
- isc_hmacsha1_update(&hmacsha1,
- (unsigned char *)&netaddr.type.in, 4);
- break;
- case AF_INET6:
- isc_hmacsha1_update(&hmacsha1,
- (unsigned char *)&netaddr.type.in6, 16);
+
+ case ns_cookiealg_sha1: {
+ unsigned char digest[ISC_SHA1_DIGESTLENGTH];
+ isc_netaddr_t netaddr;
+ unsigned char *cp;
+ isc_hmacsha1_t hmacsha1;
+ size_t length;
+
+ cp = isc_buffer_used(buf);
+ isc_buffer_putmem(buf, client->cookie, 8);
+ isc_buffer_putuint32(buf, nonce);
+ isc_buffer_putuint32(buf, when);
+
+ isc_hmacsha1_init(&hmacsha1,
+ ns_g_server->secret,
+ ISC_SHA1_DIGESTLENGTH);
+ isc_hmacsha1_update(&hmacsha1, cp, 16);
+ isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+ switch (netaddr.family) {
+ case AF_INET:
+ cp = (unsigned char *)&netaddr.type.in;
+ length = 4;
+ break;
+ case AF_INET6:
+ cp = (unsigned char *)&netaddr.type.in6;
+ length = 4;
+ break;
+ default:
+ INSIST(0);
+ }
+ isc_hmacsha1_update(&hmacsha1, cp, length);
+ isc_hmacsha1_update(&hmacsha1, client->cookie,
+ sizeof(client->cookie));
+ isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest));
+ isc_buffer_putmem(buf, digest, 8);
+ isc_hmacsha1_invalidate(&hmacsha1);
break;
}
- isc_hmacsha1_update(&hmacsha1, client->cookie, sizeof(client->cookie));
- isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest));
- isc_buffer_putmem(buf, digest, 8);
- isc_hmacsha1_invalidate(&hmacsha1);
-#endif
-#ifdef HMAC_SHA256_SIT
- unsigned char digest[ISC_SHA256_DIGESTLENGTH];
- isc_netaddr_t netaddr;
- unsigned char *cp;
- isc_hmacsha256_t hmacsha256;
-
- cp = isc_buffer_used(buf);
- isc_buffer_putmem(buf, client->cookie, 8);
- isc_buffer_putuint32(buf, nonce);
- isc_buffer_putuint32(buf, when);
-
- isc_hmacsha256_init(&hmacsha256,
- ns_g_server->secret,
- ISC_SHA256_DIGESTLENGTH);
- isc_hmacsha256_update(&hmacsha256, cp, 16);
- isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
- switch (netaddr.family) {
- case AF_INET:
- isc_hmacsha256_update(&hmacsha256,
- (unsigned char *)&netaddr.type.in, 4);
- break;
- case AF_INET6:
- isc_hmacsha256_update(&hmacsha256,
- (unsigned char *)&netaddr.type.in6, 16);
+
+ case ns_cookiealg_sha256: {
+ unsigned char digest[ISC_SHA256_DIGESTLENGTH];
+ isc_netaddr_t netaddr;
+ unsigned char *cp;
+ isc_hmacsha256_t hmacsha256;
+ size_t length;
+
+ cp = isc_buffer_used(buf);
+ isc_buffer_putmem(buf, client->cookie, 8);
+ isc_buffer_putuint32(buf, nonce);
+ isc_buffer_putuint32(buf, when);
+
+ isc_hmacsha256_init(&hmacsha256,
+ ns_g_server->secret,
+ ISC_SHA256_DIGESTLENGTH);
+ isc_hmacsha256_update(&hmacsha256, cp, 16);
+ isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+ switch (netaddr.family) {
+ case AF_INET:
+ cp = (unsigned char *)&netaddr.type.in;
+ length = 4;
+ break;
+ case AF_INET6:
+ cp = (unsigned char *)&netaddr.type.in6;
+ length = 4;
+ break;
+ default:
+ INSIST(0);
+ }
+ isc_hmacsha256_update(&hmacsha256, cp, length);
+ isc_hmacsha256_update(&hmacsha256, client->cookie,
+ sizeof(client->cookie));
+ isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest));
+ isc_buffer_putmem(buf, digest, 8);
+ isc_hmacsha256_invalidate(&hmacsha256);
break;
}
- isc_hmacsha256_update(&hmacsha256, client->cookie,
- sizeof(client->cookie));
- isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest));
- isc_buffer_putmem(buf, digest, 8);
- isc_hmacsha256_invalidate(&hmacsha256);
-#endif
+ default:
+ INSIST(0);
+ }
}
static void
-process_sit(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
- unsigned char dbuf[SIT_SIZE];
+process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
+ unsigned char dbuf[COOKIE_SIZE];
unsigned char *old;
isc_stdtime_t now;
isc_uint32_t when;
isc_uint32_t nonce;
isc_buffer_t db;
- client->attributes |= NS_CLIENTATTR_WANTSIT;
+ /*
+ * If we have already seen a cookie option skip this cookie option.
+ */
+ if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0) {
+ isc_buffer_forward(buf, (unsigned int)optlen);
+ return;
+ }
- isc_stats_increment(ns_g_server->nsstats,
- dns_nsstatscounter_sitopt);
+ client->attributes |= NS_CLIENTATTR_WANTCOOKIE;
+
+ isc_stats_increment(ns_g_server->nsstats, dns_nsstatscounter_cookiein);
- if (optlen != SIT_SIZE) {
+ if (optlen != COOKIE_SIZE) {
/*
* Not our token.
*/
- if (optlen >= 8U)
- memmove(client->cookie, isc_buffer_current(buf), 8);
- else
- memset(client->cookie, 0, 8);
+ INSIST(optlen >= 8U);
+ memmove(client->cookie, isc_buffer_current(buf), 8);
isc_buffer_forward(buf, (unsigned int)optlen);
if (optlen == 8U)
isc_stats_increment(ns_g_server->nsstats,
- dns_nsstatscounter_sitnew);
+ dns_nsstatscounter_cookienew);
else
isc_stats_increment(ns_g_server->nsstats,
- dns_nsstatscounter_sitbadsize);
+ dns_nsstatscounter_cookiebadsize);
return;
}
/*
* Allow for a 5 minute clock skew between servers sharing a secret.
- * Only accept SIT if we have talked to the client in the last hour.
+ * Only accept COOKIE if we have talked to the client in the last hour.
*/
isc_stdtime_get(&now);
if (isc_serial_gt(when, (now + 300)) || /* In the future. */
isc_serial_lt(when, (now - 3600))) { /* In the past. */
isc_stats_increment(ns_g_server->nsstats,
- dns_nsstatscounter_sitbadtime);
+ dns_nsstatscounter_cookiebadtime);
return;
}
isc_buffer_init(&db, dbuf, sizeof(dbuf));
- compute_sit(client, when, nonce, &db);
+ compute_cookie(client, when, nonce, &db);
- if (memcmp(old, dbuf, SIT_SIZE) != 0) {
+ if (memcmp(old, dbuf, COOKIE_SIZE) != 0) {
isc_stats_increment(ns_g_server->nsstats,
- dns_nsstatscounter_sitnomatch);
+ dns_nsstatscounter_cookienomatch);
return;
}
- isc_stats_increment(ns_g_server->nsstats,
- dns_nsstatscounter_sitmatch);
- client->attributes |= NS_CLIENTATTR_HAVESIT;
+ isc_stats_increment(ns_g_server->nsstats,
+ dns_nsstatscounter_cookiematch);
+ client->attributes |= NS_CLIENTATTR_HAVECOOKIE;
}
-#endif
static isc_result_t
process_ecs(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
client->attributes |= NS_CLIENTATTR_WANTNSID;
isc_buffer_forward(&optbuf, optlen);
break;
-#ifdef ISC_PLATFORM_USESIT
- case DNS_OPT_SIT:
- process_sit(client, &optbuf, optlen);
+ case DNS_OPT_COOKIE:
+ process_cookie(client, &optbuf, optlen);
break;
-#endif
case DNS_OPT_EXPIRE:
isc_stats_increment(ns_g_server->nsstats,
dns_nsstatscounter_expireopt);
* Parsing the request failed. Send a response
* (typically FORMERR or SERVFAIL).
*/
+ if (result == DNS_R_OPTERR)
+ (void)ns_client_addopt(client, client->message,
+ &client->opt);
ns_client_error(client, result);
goto cleanup;
}
}
if (client->message->rdclass == 0) {
+ if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0 ||
+ (client->message->opcode == dns_opcode_query &&
+ client->message->counts[DNS_SECTION_QUESTION] == 0U)) {
+ result = dns_message_reply(client->message, ISC_TRUE);
+ if (result != ISC_R_SUCCESS) {
+ ns_client_error(client, result);
+ return;
+ }
+ ns_client_send(client);
+ return;
+ }
ns_client_log(client, NS_LOGCATEGORY_CLIENT,
NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
"message class could not be determined");
automatic-interface-scan yes;\n\
bindkeys-file \"" NS_SYSCONFDIR "/bind.keys\";\n\
# blackhole {none;};\n"
+#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
+" cookie-algorithm aes;\n"
+#else
+" cookie-algorithm sha256;\n"
+#endif
#ifndef WIN32
" coresize default;\n\
datasize default;\n\
use-ixfr true;\n\
edns-udp-size 4096;\n\
max-udp-size 4096;\n\
-"
-#ifdef ISC_PLATFORM_USESIT
-"\
- nosit-udp-size 4096;\n\
- request-sit true;\n\
-"
-#endif
-"\
+ nocookie-udp-size 4096;\n\
+ send-cookie true;\n\
request-nsid false;\n\
reserved-sockets 512;\n\
\n\
#define NS_CLIENTATTR_FILTER_AAAA_RC 0x0080 /*%< recursing for A against AAAA */
#endif
#define NS_CLIENTATTR_WANTAD 0x0100 /*%< want AD in response if possible */
-#define NS_CLIENTATTR_WANTSIT 0x0200 /*%< include SIT */
-#define NS_CLIENTATTR_HAVESIT 0x0400 /*%< has a valid SIT */
+#define NS_CLIENTATTR_WANTCOOKIE 0x0200 /*%< return a COOKIE */
+#define NS_CLIENTATTR_HAVECOOKIE 0x0400 /*%< has a valid COOKIE */
#define NS_CLIENTATTR_WANTEXPIRE 0x0800 /*%< return seconds to expire */
#define NS_CLIENTATTR_HAVEEXPIRE 0x1000 /*%< return seconds to expire */
#define NS_CLIENTATTR_WANTOPT 0x2000 /*%< add opt to reply */
unsigned int session_keyalg;
isc_uint16_t session_keybits;
isc_boolean_t interface_auto;
- unsigned char secret[32]; /*%< Source Identity Token */
+ unsigned char secret[32]; /*%< Server Cookie Secret */
+ ns_cookiealg_t cookiealg;
char * lockfile;
};
dns_nsstatscounter_nxdomainredirect = 47,
dns_nsstatscounter_nxdomainredirect_rlookup = 48,
-#ifdef ISC_PLATFORM_USESIT
- dns_nsstatscounter_sitopt = 49,
- dns_nsstatscounter_sitbadsize = 50,
- dns_nsstatscounter_sitbadtime = 51,
- dns_nsstatscounter_sitnomatch = 52,
- dns_nsstatscounter_sitmatch = 53,
- dns_nsstatscounter_sitnew = 54,
-
- dns_nsstatscounter_max = 55
-#else
- dns_nsstatscounter_max = 49
-#endif
+ dns_nsstatscounter_cookiein = 49,
+ dns_nsstatscounter_cookiebadsize = 50,
+ dns_nsstatscounter_cookiebadtime = 51,
+ dns_nsstatscounter_cookienomatch = 52,
+ dns_nsstatscounter_cookiematch = 53,
+ dns_nsstatscounter_cookienew = 54,
+ dns_nsstatscounter_badcookie = 55,
+
+ dns_nsstatscounter_max = 56
};
void
typedef ISC_LIST(ns_dispatch_t) ns_dispatchlist_t;
typedef struct ns_statschannel ns_statschannel_t;
typedef ISC_LIST(ns_statschannel_t) ns_statschannellist_t;
+
+typedef enum {
+ ns_cookiealg_aes,
+ ns_cookiealg_sha1,
+ ns_cookiealg_sha256
+} ns_cookiealg_t;
+
#endif /* NAMED_TYPES_H */
/*% Want Recursion? */
#define WANTRECURSION(c) (((c)->query.attributes & \
NS_QUERYATTR_WANTRECURSION) != 0)
+/*% Is TCP? */
+#define TCP(c) (((c)->attributes & NS_CLIENTATTR_TCP) != 0)
/*% Want DNSSEC? */
#define WANTDNSSEC(c) (((c)->attributes & \
NS_CLIENTATTR_WANTDNSSEC) != 0)
/*% Want WANTAD? */
#define WANTAD(c) (((c)->attributes & \
NS_CLIENTATTR_WANTAD) != 0)
-#ifdef ISC_PLATFORM_USESIT
-/*% Client presented a valid Source Identity Token. */
-#define HAVESIT(c) (((c)->attributes & \
- NS_CLIENTATTR_HAVESIT) != 0)
-#else
-#define HAVESIT(c) (0)
-#endif
-
+/*% Client presented a valid COOKIE. */
+#define HAVECOOKIE(c) (((c)->attributes & \
+ NS_CLIENTATTR_HAVECOOKIE) != 0)
+/*% Client presented a COOKIE. */
+#define WANTCOOKIE(c) (((c)->attributes & \
+ NS_CLIENTATTR_WANTCOOKIE) != 0)
/*% No authority? */
#define NOAUTHORITY(c) (((c)->query.attributes & \
NS_QUERYATTR_NOAUTHORITY) != 0)
counter = dns_nsstatscounter_nxrrset;
} else
counter = dns_nsstatscounter_success;
- } else if (client->message->rcode == dns_rcode_nxdomain)
+ } else if (client->message->rcode == dns_rcode_nxdomain)
counter = dns_nsstatscounter_nxdomain;
+ else if (client->message->rcode == dns_rcode_badcookie)
+ counter = dns_nsstatscounter_badcookie;
else /* We end up here in case of YXDOMAIN, and maybe others */
counter = dns_nsstatscounter_failure;
tmprdataset = query_newrdataset(client);
if (tmprdataset == NULL)
return;
- if ((client->attributes & NS_CLIENTATTR_TCP) == 0)
+ if (!TCP(client))
peeraddr = &client->peeraddr;
else
peeraddr = NULL;
ns_client_killoldestquery(client);
}
if (result == ISC_R_SUCCESS && !client->mortal &&
- (client->attributes & NS_CLIENTATTR_TCP) == 0) {
+ !TCP(client)) {
result = ns_client_replace(client);
if (result != ISC_R_SUCCESS) {
ns_client_log(client, NS_LOGCATEGORY_CLIENT,
if (client->query.timerset == ISC_FALSE)
ns_client_settimeout(client, 60);
- if ((client->attributes & NS_CLIENTATTR_TCP) == 0)
+ if (!TCP(client))
peeraddr = &client->peeraddr;
else
peeraddr = NULL;
client->query.authdbset = ISC_TRUE;
/* Track TCP vs UDP stats per zone */
- if ((client->attributes & NS_CLIENTATTR_TCP) != 0)
+ if (TCP(client))
inc_stats(client, dns_nsstatscounter_tcp);
else
inc_stats(client, dns_nsstatscounter_udp);
* Don't mess with responses rewritten by RPZ
* Count each response at most once.
*/
- if (client->view->rrl != NULL && !HAVESIT(client) &&
+ if (client->view->rrl != NULL && !HAVECOOKIE(client) &&
((fname != NULL && dns_name_isabsolute(fname)) ||
(result == ISC_R_NOTFOUND && !RECURSIONOK(client))) &&
!(result == DNS_R_DELEGATION && !is_zone && RECURSIONOK(client)) &&
resp_result = ISC_R_SUCCESS;
}
rrl_result = dns_rrl(client->view, &client->peeraddr,
- ISC_TF((client->attributes
- & NS_CLIENTATTR_TCP) != 0),
- client->message->rdclass, qtype, tname,
- resp_result, client->now,
+ TCP(client), client->message->rdclass,
+ qtype, tname, resp_result, client->now,
wouldlog, log_buf, sizeof(log_buf));
if (rrl_result != DNS_RRL_RESULT_OK) {
/*
*/
inc_stats(client,
dns_nsstatscounter_rateslipped);
- client->message->flags |=
- DNS_MESSAGEFLAG_TC;
- if (resp_result == DNS_R_NXDOMAIN)
+ if (WANTCOOKIE(client)) {
+ client->message->flags &=
+ ~DNS_MESSAGEFLAG_AD;
client->message->rcode =
- dns_rcode_nxdomain;
+ dns_rcode_badcookie;
+ } else {
+ client->message->flags |=
+ DNS_MESSAGEFLAG_TC;
+ if (resp_result ==
+ DNS_R_NXDOMAIN)
+ client->message->rcode =
+ dns_rcode_nxdomain;
+ }
}
goto cleanup;
}
if (rpz_st->m.policy != DNS_RPZ_POLICY_MISS &&
rpz_st->m.policy != DNS_RPZ_POLICY_PASSTHRU &&
(rpz_st->m.policy != DNS_RPZ_POLICY_TCP_ONLY ||
- (client->attributes & NS_CLIENTATTR_TCP) == 0) &&
+ !TCP(client)) &&
rpz_st->m.policy != DNS_RPZ_POLICY_ERROR)
{
/*
client->ednsversion);
ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
- level, "query: %s %s %s %s%s%s%s%s%s (%s)", namebuf,
+ level, "query: %s %s %s %s%s%s%s%s%s%s (%s)", namebuf,
classname, typename, WANTRECURSION(client) ? "+" : "-",
(client->signer != NULL) ? "S" : "", ednsbuf,
- ((client->attributes & NS_CLIENTATTR_TCP) != 0) ?
- "T" : "",
+ TCP(client) ? "T" : "",
((extflags & DNS_MESSAGEEXTFLAG_DO) != 0) ? "D" : "",
((flags & DNS_MESSAGEFLAG_CD) != 0) ? "C" : "",
+ HAVECOOKIE(client) ? "V" : WANTCOOKIE(client) ? "K" : "",
onbuf);
}
/*
* Test only.
*/
- if (ns_g_clienttest && (client->attributes & NS_CLIENTATTR_TCP) == 0)
+ if (ns_g_clienttest && !TCP(client))
RUNTIME_CHECK(ns_client_replace(client) == ISC_R_SUCCESS);
/*
/*
* Turn on minimal responses for EDNS/UDP bufsize 512 queries.
*/
- if (client->ednsversion >= 0 && client->udpsize <= 512U &&
- (client->attributes & NS_CLIENTATTR_TCP) == 0)
+ if (client->ednsversion >= 0 && client->udpsize <= 512U && !TCP(client))
client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
NS_QUERYATTR_NOADDITIONAL);
#include <sys/types.h>
#include <sys/stat.h>
+#include <isc/aes.h>
#include <isc/app.h>
#include <isc/base64.h>
#include <isc/dir.h>
#include <isc/file.h>
#include <isc/hash.h>
#include <isc/hex.h>
+#include <isc/hmacsha.h>
#include <isc/httpd.h>
#include <isc/lex.h>
#include <isc/parseint.h>
#include <isc/util.h>
#include <isc/xml.h>
-#ifdef AES_SIT
-#include <isc/aes.h>
-#else
-#include <isc/hmacsha.h>
-#endif
-
#include <isccfg/grammar.h>
#include <isccfg/namedconf.h>
if (obj != NULL)
CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj)));
-#ifdef ISC_PLATFORM_USESIT
obj = NULL;
- (void)cfg_map_get(cpeer, "request-sit", &obj);
+ (void)cfg_map_get(cpeer, "send-cookie", &obj);
if (obj != NULL)
- CHECK(dns_peer_setrequestsit(peer, cfg_obj_asboolean(obj)));
-#endif
+ CHECK(dns_peer_setsendcookie(peer, cfg_obj_asboolean(obj)));
obj = NULL;
(void)cfg_map_get(cpeer, "edns", &obj);
udpsize = 4096;
view->maxudp = udpsize;
-#ifdef ISC_PLATFORM_USESIT
/*
- * Set the maximum UDP when a SIT is not provided.
+ * Set the maximum UDP when a COOKIE is not provided.
*/
obj = NULL;
- result = ns_config_get(maps, "nosit-udp-size", &obj);
+ result = ns_config_get(maps, "nocookie-udp-size", &obj);
INSIST(result == ISC_R_SUCCESS);
udpsize = cfg_obj_asuint32(obj);
if (udpsize < 128)
udpsize = 128;
if (udpsize > view->maxudp)
udpsize = view->maxudp;
- view->situdp = udpsize;
-#endif
+ view->nocookieudp = udpsize;
/*
* Set the maximum rsa exponent bits.
INSIST(result == ISC_R_SUCCESS);
view->requestnsid = cfg_obj_asboolean(obj);
-#ifdef ISC_PLATFORM_USESIT
obj = NULL;
- result = ns_config_get(maps, "request-sit", &obj);
+ result = ns_config_get(maps, "send-cookie", &obj);
INSIST(result == ISC_R_SUCCESS);
- view->requestsit = cfg_obj_asboolean(obj);
-#endif
+ view->sendcookie = cfg_obj_asboolean(obj);
obj = NULL;
result = ns_config_get(maps, "max-clients-per-query", &obj);
server->flushonshutdown = ISC_FALSE;
}
-#ifdef ISC_PLATFORM_USESIT
obj = NULL;
- result = ns_config_get(maps, "sit-secret", &obj);
+ result = ns_config_get(maps, "cookie-algorithm", &obj);
+ INSIST(result == ISC_R_SUCCESS);
+ if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0)
+ server->cookiealg = ns_cookiealg_aes;
+ else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0)
+ server->cookiealg = ns_cookiealg_sha1;
+ else if (strcasecmp(cfg_obj_asstring(obj), "sha256") == 0)
+ server->cookiealg = ns_cookiealg_sha256;
+ else
+ INSIST(0);
+
+ obj = NULL;
+ result = ns_config_get(maps, "cookie-secret", &obj);
if (result == ISC_R_SUCCESS) {
isc_buffer_t b;
+ unsigned int usedlength;
memset(server->secret, 0, sizeof(server->secret));
isc_buffer_init(&b, server->secret, sizeof(server->secret));
result = isc_hex_decodestring(cfg_obj_asstring(obj), &b);
if (result != ISC_R_SUCCESS && result != ISC_R_NOSPACE)
goto cleanup;
-#ifdef AES_SIT
- if (isc_buffer_usedlength(&b) != ISC_AES128_KEYLENGTH)
- CHECKM(ISC_R_RANGE,
- "AES sit-secret must be on 128 bits");
-#endif
-#ifdef HMAC_SHA1_SIT
- if (isc_buffer_usedlength(&b) != ISC_SHA1_DIGESTLENGTH)
- CHECKM(ISC_R_RANGE,
- "SHA1 sit-secret must be on 160 bits");
-#endif
-#ifdef HMAC_SHA256_SIT
- if (isc_buffer_usedlength(&b) != ISC_SHA256_DIGESTLENGTH)
- CHECKM(ISC_R_RANGE,
- "SHA256 sit-secret must be on 256 bits");
-#endif
+
+ usedlength = isc_buffer_usedlength(&b);
+ switch (server->cookiealg) {
+ case ns_cookiealg_aes:
+ if (usedlength != ISC_AES128_KEYLENGTH)
+ CHECKM(ISC_R_RANGE,
+ "AES cookie-secret must be 128 bits");
+ break;
+ case ns_cookiealg_sha1:
+ if (usedlength != ISC_SHA1_DIGESTLENGTH)
+ CHECKM(ISC_R_RANGE,
+ "SHA1 cookie-secret must be 160 bits");
+ break;
+ case ns_cookiealg_sha256:
+ if (usedlength != ISC_SHA256_DIGESTLENGTH)
+ CHECKM(ISC_R_RANGE,
+ "SHA256 cookie-secret must be 256 bits");
+ break;
+ }
} else {
result = isc_entropy_getdata(ns_g_entropy,
server->secret,
if (result != ISC_R_SUCCESS)
goto cleanup;
}
-#endif
result = ISC_R_SUCCESS;
SET_NSSTATDESC(nsidopt, "NSID option received", "NSIDOpt");
SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
SET_NSSTATDESC(otheropt, "Other EDNS option received", "OtherOpt");
-#ifdef ISC_PLATFORM_USESIT
- SET_NSSTATDESC(sitopt, "source identity token option received",
- "SitOpt");
- SET_NSSTATDESC(sitnew, "new source identity token requested",
- "SitNew");
- SET_NSSTATDESC(sitbadsize, "source identity token - bad size",
- "SitBadSize");
- SET_NSSTATDESC(sitbadtime, "source identity token - bad time",
- "SitBadTime");
- SET_NSSTATDESC(sitnomatch, "source identity token - no match",
- "SitNoMatch");
- SET_NSSTATDESC(sitmatch, "source identity token - match", "SitMatch");
-#endif
+ SET_NSSTATDESC(cookiein, "COOKIE option received", "CookieIn");
+ SET_NSSTATDESC(cookienew, "COOKIE - client only", "CookieNew");
+ SET_NSSTATDESC(cookiebadsize, "COOKIE - bad size", "CookieBadSize");
+ SET_NSSTATDESC(cookiebadtime, "COOKIE - bad time", "CookieBadTime");
+ SET_NSSTATDESC(cookienomatch, "COOKIE - no match", "CookieNoMatch");
+ SET_NSSTATDESC(cookiematch, "COOKIE - match", "CookieMatch");
SET_NSSTATDESC(ecsopt, "EDNS client subnet option recieved", "ECSOpt");
SET_NSSTATDESC(nxdomainredirect,
"queries resulted in NXDOMAIN that were redirected",
"queries resulted in NXDOMAIN that were redirected and "
"resulted in a successful remote lookup",
"QryNXRedirRLookup");
+ SET_NSSTATDESC(badcookie, "sent badcookie response", "QryBADCOOKIE");
INSIST(i == dns_nsstatscounter_max);
/* Initialize resolver statistics */
SET_RESSTATDESC(nfetch, "active fetches", "NumFetch");
SET_RESSTATDESC(buckets, "bucket size", "BucketSize");
SET_RESSTATDESC(refused, "REFUSED received", "REFUSED");
-#ifdef ISC_PLATFORM_USESIT
- SET_RESSTATDESC(sitcc, "SIT sent client cookie only",
- "SitClientOut");
- SET_RESSTATDESC(sitout, "SIT sent with client and server cookie",
- "SitOut");
- SET_RESSTATDESC(sitin, "SIT replies received", "SitIn");
- SET_RESSTATDESC(sitok, "SIT client cookie ok", "SitClientOk");
-#endif
+ SET_RESSTATDESC(cookienew, "COOKIE send with client cookie only",
+ "ClientCookieOut");
+ SET_RESSTATDESC(cookieout, "COOKIE sent with client and server cookie",
+ "ServerCookieOut");
+ SET_RESSTATDESC(cookiein, "COOKIE replies received", "CookieIn");
+ SET_RESSTATDESC(cookieok, "COOKIE client ok", "CookieClientOk");
SET_RESSTATDESC(badvers, "bad EDNS version", "BadEDNSVersion");
+ SET_RESSTATDESC(badcookie, "bad cookie rcode", "BadCookieRcode");
INSIST(i == dns_resstatscounter_max);
# v6synth
SUBDIRS="acl additional allow_query addzone autosign builtin
cacheclean case checkconf @CHECKDS@ checknames checkzone
- @COVERAGE@ database digdelv dlv dlvauto dlz dlzexternal dname
- dns64 dnssec dsdigest dscp ecdsa ednscompliance emptyzones
- filter-aaaa formerr forward geoip glue gost ixfr inline
- legacy limits logfileconfig lwresd
- masterfile masterformat metadata mkeys
- notify nslookup nsupdate pending pipelined @PKCS11_TEST@
- reclimit redirect resolver rndc rpz rpzrecurse
- rrl rrchecker rrsetorder rsabigexponent runtime
- sit sfcache smartsign sortlist spf
- staticstub statistics stub tcp tkey tsig tsiggss unknown
- upforwd verify views wildcard xfer xferquota zero zonechecks"
+ cookie @COVERAGE@ database digdelv dlv dlvauto dlz dlzexternal
+ dname dns64 dnssec dsdigest dscp ecdsa ednscompliance
+ emptyzones filter-aaaa formerr forward geoip glue gost
+ ixfr inline legacy limits logfileconfig lwresd masterfile
+ masterformat metadata mkeys notify nslookup nsupdate pending
+ pipelined @PKCS11_TEST@ reclimit redirect resolver rndc
+ rpz rpzrecurse rrl rrchecker rrsetorder rsabigexponent
+ runtime sfcache smartsign sortlist spf staticstub statistics
+ stub tcp tkey tsig tsiggss unknown upforwd verify views
+ wildcard xfer xferquota zero zonechecks"
# Use the CONFIG_SHELL detected by configure for tests
SHELL=@SHELL@
*/
options {
- sit-secret "012345678901234567890123456789012345678901234567890123456789012";
+ cookie-secret "012345678901234567890123456789012345678901234567890123456789012";
};
*/
options {
- sit-secret "01234567890123456789012345678901234567890123456789012345678901234567890";
+ cookie-secret "01234567890123456789012345678901234567890123456789012345678901234567890";
};
except-from { "goodcname.example.net";
"gooddname.example.net"; };
allow-query {!10.53.0.8; any; };
- request-sit yes;
- nosit-udp-size 512;
+ send-cookie yes;
+ nocookie-udp-size 512;
};
zone "." {
listen-on-v6 { none; };
recursion no;
acache-enable yes;
- request-sit yes;
- nosit-udp-size 512;
+ send-cookie yes;
+ nocookie-udp-size 512;
};
zone "." {
status=0
n=0
-getsit() {
- awk '$2 == "SIT:" {
+getcookie() {
+ awk '$2 == "COOKIE:" {
print $3;
}' < $1
}
-fullsit() {
+fullcookie() {
awk 'BEGIN { n = 0 }
// { v[n++] = length(); }
END { print (v[1] == v[2]); }'
done
n=`expr $n + 1`
-echo "I:checking SIT token returned to empty SIT option ($n)"
+echo "I:checking COOKIE token returned to empty COOKIE option ($n)"
ret=0
-$DIG +qr +sit version.bind txt ch @10.53.0.1 -p 5300 > dig.out.test$n
-grep SIT: dig.out.test$n > /dev/null || ret=1
+$DIG +qr +cookie version.bind txt ch @10.53.0.1 -p 5300 > dig.out.test$n
+grep COOKIE: dig.out.test$n > /dev/null || ret=1
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
-echo "I:checking response size without SIT ($n)"
+echo "I:checking response size without COOKIE ($n)"
ret=0
$DIG large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
havetc dig.out.test$n || ret=1
status=`expr $status + $ret`
n=`expr $n + 1`
-echo "I:checking response size without valid SIT ($n)"
+echo "I:checking response size without valid COOKIE ($n)"
ret=0
-$DIG +sit large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
+$DIG +cookie large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
havetc dig.out.test$n || ret=1
-grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
-echo "I:checking response size with SIT ($n)"
+echo "I:checking response size with COOKIE ($n)"
ret=0
-$DIG +sit large.example txt @10.53.0.1 -p 5300 > dig.out.test$n.l
-sit=`getsit dig.out.test$n.l`
-$DIG +qr +sit=$sit large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
+$DIG +cookie large.example txt @10.53.0.1 -p 5300 > dig.out.test$n.l
+cookie=`getcookie dig.out.test$n.l`
+$DIG +qr +cookie=$cookie large.example txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
havetc dig.out.test$n && ret=1
-grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
-echo "I:checking response size with SIT recursive ($n)"
+echo "I:checking response size with COOKIE recursive ($n)"
ret=0
-$DIG +qr +sit=$sit large.xxx txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
+$DIG +qr +cookie=$cookie large.xxx txt @10.53.0.1 -p 5300 +ignore > dig.out.test$n
havetc dig.out.test$n && ret=1
-grep "; SIT:.*(good)" dig.out.test$n > /dev/null || ret=1
+grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
-echo "I:checking SIT is learnt for TCP retry ($n)"
+echo "I:checking COOKIE is learnt for TCP retry ($n)"
ret=0
-$DIG +qr +sit large.example txt @10.53.0.1 -p 5300 > dig.out.test$n
-linecount=`getsit dig.out.test$n | wc -l`
+$DIG +qr +cookie large.example txt @10.53.0.1 -p 5300 > dig.out.test$n
+linecount=`getcookie dig.out.test$n | wc -l`
if [ $linecount != 3 ]; then ret=1; fi
-checkfull=`getsit dig.out.test$n | fullsit`
+checkfull=`getcookie dig.out.test$n | fullcookie`
if [ $checkfull != 1 ]; then ret=1; fi
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
-echo "I:checking for SIT value in adb ($n)"
+echo "I:checking for COOKIE value in adb ($n)"
ret=0
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 dumpdb
sleep 1
-grep "10.53.0.2.*\[sit=" ns1/named_dump.db > /dev/null|| ret=1
+grep "10.53.0.2.*\[cookie=" ns1/named_dump.db > /dev/null|| ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:failed"; status=`expr $status + 1`;
fi
-# this one arguable could be NOERORR.
+# this one is now NOERROR
echo "I:no questions"
$PERL formerr.pl -a 10.53.0.1 -p 5300 noquestions > noquestions.out
ans=`grep got: noquestions.out`
-if [ "${ans}" != "got: 000080010000000000000000" ];
+if [ "${ans}" != "got: 000080000000000000000000" ];
then
echo "I:failed"; status=`expr $status + 1`;
fi
ret=0
$DIG soa all-cnames @10.53.0.5 -p 5300 +opcode=status > dig.out.ns5.test${n} || ret=1
grep "status: NOTIMP" dig.out.ns5.test${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:exit status: $status"
+++ /dev/null
-# Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC")
-#
-# Permission to use, copy, modify, and/or distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-test "@HAVE_SIT@" = "" && exit 255
-exit 0
static isc_dscp_t dscp = -1;
static unsigned char cookie_secret[33];
static int onfly = 0;
-#ifdef ISC_PLATFORM_USESIT
-static char sitvalue[256];
-#endif
+static char hexcookie[81];
struct query {
char textname[MXNAME]; /*% Name we're going to be looking up */
isc_boolean_t have_zflag;
isc_boolean_t dnssec;
isc_boolean_t expire;
-#ifdef ISC_PLATFORM_USESIT
- isc_boolean_t sit;
- char *sitvalue;
-#endif
+ isc_boolean_t send_cookie;
+ char *cookie;
isc_boolean_t nsid;
dns_rdatatype_t rdtype;
dns_rdataclass_t rdclass;
/*%
* Add EDNS0 option record to a message. Currently, the only supported
* options are UDP buffer size, the DO bit, and EDNS options
- * (e.g., NSID, SIT, client-subnet)
+ * (e.g., NSID, COOKIE, client-subnet)
*/
static void
add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
CHECK("dns_message_setopt", result);
}
-#ifdef ISC_PLATFORM_USESIT
static void
compute_cookie(unsigned char *cookie, size_t len) {
/* XXXMPA need to fix, should be per server. */
INSIST(len >= 8U);
memmove(cookie, cookie_secret, 8);
}
-#endif
static isc_result_t
sendquery(struct query *query, isc_task_t *task)
unsigned int flags;
int i = 0;
char ecsbuf[20];
-#ifdef ISC_PLATFORM_USESIT
- unsigned char cookie[8];
- char sitbuf[256];
-#endif
+ unsigned char cookie[40];
if (query->udpsize == 0)
query->udpsize = 4096;
i++;
}
-#ifdef ISC_PLATFORM_USESIT
- if (query->sit) {
+ if (query->send_cookie) {
INSIST(i < DNS_EDNSOPTIONS);
- opts[i].code = DNS_OPT_SIT;
- if (query->sitvalue != NULL) {
+ opts[i].code = DNS_OPT_COOKIE;
+ if (query->cookie != NULL) {
isc_buffer_t b;
- isc_buffer_init(&b, sitbuf, sizeof(sitbuf));
- result = isc_hex_decodestring(query->sitvalue,
+ isc_buffer_init(&b, cookie, sizeof(cookie));
+ result = isc_hex_decodestring(query->cookie,
&b);
CHECK("isc_hex_decodestring", result);
opts[i].value = isc_buffer_base(&b);
opts[i].length = isc_buffer_usedlength(&b);
} else {
- compute_cookie(cookie, sizeof(cookie));
+ compute_cookie(cookie, 8);
opts[i].length = 8;
opts[i].value = cookie;
}
i++;
}
-#endif
if (query->expire) {
INSIST(i < DNS_EDNSOPTIONS);
" +[no]zflag (Set Z flag in query)\n"
" +[no]dnssec (Request DNSSEC records)\n"
" +[no]expire (Request time to expire)\n"
-#ifdef ISC_PLATFORM_USESIT
-" +[no]sit[=###] (Request a Source Identity Token)\n"
-#endif
+" +[no]cookie[=###] (Send a COOKIE option)\n"
" +[no]nsid (Request Name Server ID)\n",
stdout);
}
char *cmd, *value, *ptr, *code;
isc_uint32_t num;
isc_boolean_t state = ISC_TRUE;
-#ifdef ISC_PLATFORM_USESIT
size_t n;
-#endif
strncpy(option_store, option, sizeof(option_store));
option_store[sizeof(option_store) - 1] = 0;
display_class = state;
break;
case 'o': /* comments */
- FULLCHECK("comments");
- GLOBAL();
- display_comments = state;
+ switch (cmd[2]) {
+ case 'm':
+ FULLCHECK("comments");
+ GLOBAL();
+ display_comments = state;
+ break;
+ case 'o':
+ FULLCHECK("cookie");
+ if (state && query->edns == -1)
+ query->edns = 0;
+ query->send_cookie = state;
+ if (value != NULL) {
+ n = strlcpy(hexcookie, value,
+ sizeof(hexcookie));
+ if (n >= sizeof(hexcookie))
+ fatal("COOKIE data too large");
+ query->cookie = hexcookie;
+ } else
+ query->cookie = NULL;
+ break;
+ default:
+ goto invalid_option;
+ }
break;
case 'r':
FULLCHECK("crypto");
display_rrcomments = ISC_FALSE;
}
break;
-#ifdef ISC_PLATFORM_USESIT
- case 'i':
- FULLCHECK("sit");
- if (state && query->edns == -1)
- query->edns = 0;
- query->sit = state;
- if (value != NULL) {
- n = strlcpy(sitvalue, value, sizeof(sitvalue));
- if (n >= sizeof(sitvalue))
- fatal("SIT data too large");
- query->sitvalue = sitvalue;
- } else
- query->sitvalue = NULL;
- break;
-#endif
case 'p': /* split */
FULLCHECK("split");
GLOBAL();
default_query.have_zflag = ISC_FALSE;
default_query.dnssec = ISC_FALSE;
default_query.expire = ISC_FALSE;
-#ifdef ISC_PLATFORM_USESIT
- default_query.sit = ISC_FALSE;
- default_query.sitvalue = NULL;
-#endif
+ default_query.send_cookie = ISC_FALSE;
+ default_query.cookie = NULL;
default_query.nsid = ISC_FALSE;
default_query.rdtype = dns_rdatatype_a;
default_query.rdclass = dns_rdataclass_in;
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><option>+[no]cookie<optional>=####</optional></option></term>
+ <listitem>
+ <para>
+ Send a COOKIE EDNS option, with optional value.
+ Replaying a COOKIE from a previous response will allow
+ the server to identify a previous client. The default
+ is <option>+nocookie</option>.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><option>+[no]dnssec</option></term>
<listitem>
</listitem>
</varlistentry>
- <varlistentry>
- <term><option>+[no]sit<optional>=####</optional></option></term>
- <listitem>
- <para>
- Send a Source Identity Token EDNS option, with optional
- value. Replaying a SIT from a previous response will
- allow the server to identify a previous client. The
- default is <option>+nosit</option>. Currently using
- experimental value 65001 for the option code.
- </para>
- </listitem>
- </varlistentry>
-
<varlistentry>
<term><option>+[no]subnet=addr/prefix</option></term>
<listitem>
/* Define if building universal (internal helper macro) */
#undef AC_APPLE_UNIVERSAL_BUILD
-/* Use AES for Source Identity Token generation */
-#undef AES_SIT
+/* Use AES for Client Cookie generation */
+#undef AES_CC
/* Define to enable the "filter-aaaa-on-v4" and "filter-aaaa-on-v6" options.
*/
/* HMAC_*() return ints */
#undef HMAC_RETURN_INT
-/* Use HMAC-SHA1 for Source Identity Token generation */
-#undef HMAC_SHA1_SIT
+/* Use HMAC-SHA1 for Client Cookie generation */
+#undef HMAC_SHA1_CC
-/* Use HMAC-SHA256 for Source Identity Token generation */
-#undef HMAC_SHA256_SIT
+/* Use HMAC-SHA256 for Client Cookie generation */
+#undef HMAC_SHA256_CC
/* return type of gai_strerror */
#undef IRS_GAISTRERROR_RETURN_T
OPENSSLGOSTLINKSRCS
OPENSSLGOSTLINKOBJS
DST_OPENSSL_INC
-HAVE_SIT
-ISC_PLATFORM_USESIT
INSTALL_LIBRARY
ISC_THREAD_DIR
THREADOPTSRCS
with_gost
with_aes
enable_openssl_hash
-enable_sit
-with_sit_alg
+with_cc_alg
enable_openssl_version_check
with_libxml2
with_libjson
--enable-threads enable multithreading
--enable-native-pkcs11 use native PKCS11 for all crypto [default=no]
--enable-openssl-hash use OpenSSL for hash functions [default=no]
- --enable-sit enable source identity token [default=no]
--enable-openssl-version-check
check OpenSSL version [default=yes]
--enable-largefile 64-bit file support
--with-ecdsa Crypto ECDSA
--with-gost Crypto GOST yes|no|raw|asn1.
--with-aes Crypto AES
- --with-sit-alg=ALG choose the algorithm for SIT [aes|sha1|sha256]
+ --with-cc-alg=ALG choose the algorithm for Client Cookie [aes|sha1|sha256]
--with-libxml2=PATH build with libxml2 library yes|no|path
--with-libjson=PATH build with libjson0 library yes|no|path
--with-purify=PATH use Rational purify
test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
test "${enable_symtable+set}" = set || enable_symtable=all
- test "${enable_sit+set}" = set || enable_sit=yes
test "${enable_warn_error+set}" = set || enable_warn_error=yes
test "${enable_warn_shadow+set}" = set || enable_warn_shadow=yes
;;
if test "${with_aes+set}" = set; then :
withval=$with_aes; with_aes="$withval"
else
- with_aes="checksit"
+ with_aes="checkcc"
fi
if test "${enable_openssl_hash+set}" = set; then :
enableval=$enable_openssl_hash; want_openssl_hash="$enableval"
else
- want_openssl_hash="checksit"
+ want_openssl_hash="checkcc"
fi
#
-# Enable Source Identity Token support
+# Client Cookie algorithm choice
#
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Source Identity Token support" >&5
-$as_echo_n "checking for Source Identity Token support... " >&6; }
-# Check whether --enable-sit was given.
-if test "${enable_sit+set}" = set; then :
- enableval=$enable_sit; enable_sit="$enableval"
-else
- enable_sit="no"
-fi
-
-HAVE_SIT=
-ISC_PLATFORM_USESIT="#undef ISC_PLATFORM_USESIT"
-
-case "$enable_sit" in
-yes)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- ISC_PLATFORM_USESIT="#define ISC_PLATFORM_USESIT 1"
- HAVE_SIT=1
- ;;
-no)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- ;;
-*)
- as_fn_error $? "\"enable-sit requires yes or no\"" "$LINENO" 5
- ;;
-esac
-
-
-#
-# Source Identity Token algorithm choice
-#
-
-# Check whether --with-sit-alg was given.
-if test "${with_sit_alg+set}" = set; then :
- withval=$with_sit_alg; with_sit_alg="$withval"
+# Check whether --with-cc-alg was given.
+if test "${with_cc_alg+set}" = set; then :
+ withval=$with_cc_alg; with_cc_alg="$withval"
else
- with_sit_alg="auto"
+ with_cc_alg="auto"
fi
-if test "$enable_sit" = "yes"
-then
- case $with_sit_alg in
- *1)
- with_sit_alg="sha1"
- ;;
- *2*)
- with_sit_alg="sha256"
- ;;
- auto)
- if test "$with_aes" != "no"
- then
- with_aes="yes"
- fi
- ;;
- *)
- with_sit_alg="aes"
- if test "$with_aes" != "no"
- then
- with_aes="yes"
- fi
- ;;
- esac
-fi
-if test "with_aes" = "checksit"
+case $with_cc_alg in
+ *1)
+ with_cc_alg="sha1"
+ ;;
+ *2*)
+ with_cc_alg="sha256"
+ ;;
+ auto)
+ if test "$with_aes" != "no"
+ then
+ with_aes="yes"
+ fi
+ ;;
+ *)
+ with_cc_alg="aes"
+ if test "$with_aes" != "no"
+ then
+ with_aes="yes"
+ fi
+ ;;
+esac
+if test "with_aes" = "checkcc"
then
with_aes="no"
fi
#
-# Choose SIT algorithm
+# Choose Client Cookie algorithm
#
-if test "$enable_sit" = "yes"
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for the Algorithm for Client Cookie" >&5
+$as_echo_n "checking for the Algorithm for Client Cookie... " >&6; }
+if test "$with_cc_alg" = "auto"
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the Algorithm for SIT" >&5
-$as_echo_n "checking for the Algorithm for SIT... " >&6; }
- if test "$with_sit_alg" = "auto"
+ if test "$with_aes" = "yes"
then
- if test "$with_aes" = "yes"
- then
- with_sit_alg="aes"
- else
- with_sit_alg="sha256"
- fi
+ with_cc_alg="aes"
+ else
+ with_cc_alg="sha256"
fi
fi
-case $with_sit_alg in
+case $with_cc_alg in
sha1)
- if test "$enable_sit" != "yes"
- then
- as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5;
- fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: sha1" >&5
$as_echo "sha1" >&6; }
if test "$CRYPTO" = "-DOPENSSL"
then
- if test "$want_openssl_hash" = "checksit"
+ if test "$want_openssl_hash" = "checkcc"
then
want_openssl_hash="yes"
fi
fi
-$as_echo "#define HMAC_SHA1_SIT 1" >>confdefs.h
+$as_echo "#define HMAC_SHA1_CC 1" >>confdefs.h
;;
sha256)
- if test "$enable_sit" != "yes"
- then
- as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5;
- fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: sha256" >&5
$as_echo "sha256" >&6; }
if test "$CRYPTO" = "-DOPENSSL"
then
- if test "$want_openssl_hash" = "checksit"
+ if test "$want_openssl_hash" = "checkcc"
then
want_openssl_hash="yes"
fi
fi
-$as_echo "#define HMAC_SHA256_SIT 1" >>confdefs.h
+$as_echo "#define HMAC_SHA256_CC 1" >>confdefs.h
;;
aes)
- if test "$enable_sit" != "yes"
- then
- as_fn_error $? "\"with-sit-alg requires enable-sit\"" "$LINENO" 5;
- fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: aes" >&5
$as_echo "aes" >&6; }
if test "$with_aes" != "yes"
then
- as_fn_error $? "\"SIT wants to use unavailable AES\"" "$LINENO" 5;
+ as_fn_error $? "\"Client Cookie wants to use unavailable AES\"" "$LINENO" 5;
fi
-$as_echo "#define AES_SIT 1" >>confdefs.h
+$as_echo "#define AES_CC 1" >>confdefs.h
;;
esac
-if test "$want_openssl_hash" = "checksit"
+if test "$want_openssl_hash" = "checkcc"
then
want_openssl_hash="no"
fi
# elsewhere if there's a good reason for doing so.
#
-ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile bin/tests/db/Makefile bin/tests/dst/Makefile bin/tests/dst/Kdh.+002+18602.key bin/tests/dst/Kdh.+002+18602.private bin/tests/dst/Kdh.+002+48957.key bin/tests/dst/Kdh.+002+48957.private bin/tests/dst/Ktest.+001+00002.key bin/tests/dst/Ktest.+001+54622.key bin/tests/dst/Ktest.+001+54622.private bin/tests/dst/Ktest.+003+23616.key bin/tests/dst/Ktest.+003+23616.private bin/tests/dst/Ktest.+003+49667.key bin/tests/dst/dst_2_data bin/tests/dst/t2_data_1 bin/tests/dst/t2_data_2 bin/tests/dst/t2_dsasig bin/tests/dst/t2_rsasig bin/tests/hashes/Makefile bin/tests/headerdep_test.sh bin/tests/master/Makefile bin/tests/mem/Makefile bin/tests/names/Makefile bin/tests/net/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/rbt/Makefile bin/tests/resolver/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/builtin/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/named.conf bin/tests/system/filter-aaaa/Makefile bin/tests/system/geoip/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/resolver/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/sit/prereq.sh bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl doc/xsl/isc-notes-latex.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh"
+ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile bin/tests/db/Makefile bin/tests/dst/Makefile bin/tests/dst/Kdh.+002+18602.key bin/tests/dst/Kdh.+002+18602.private bin/tests/dst/Kdh.+002+48957.key bin/tests/dst/Kdh.+002+48957.private bin/tests/dst/Ktest.+001+00002.key bin/tests/dst/Ktest.+001+54622.key bin/tests/dst/Ktest.+001+54622.private bin/tests/dst/Ktest.+003+23616.key bin/tests/dst/Ktest.+003+23616.private bin/tests/dst/Ktest.+003+49667.key bin/tests/dst/dst_2_data bin/tests/dst/t2_data_1 bin/tests/dst/t2_data_2 bin/tests/dst/t2_dsasig bin/tests/dst/t2_rsasig bin/tests/hashes/Makefile bin/tests/headerdep_test.sh bin/tests/master/Makefile bin/tests/mem/Makefile bin/tests/names/Makefile bin/tests/net/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/rbt/Makefile bin/tests/resolver/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/builtin/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/named.conf bin/tests/system/filter-aaaa/Makefile bin/tests/system/geoip/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/resolver/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl doc/xsl/isc-notes-latex.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh"
#
"bin/tests/system/rndc/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rndc/Makefile" ;;
"bin/tests/system/rpz/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rpz/Makefile" ;;
"bin/tests/system/rsabigexponent/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/rsabigexponent/Makefile" ;;
- "bin/tests/system/sit/prereq.sh") CONFIG_FILES="$CONFIG_FILES bin/tests/system/sit/prereq.sh" ;;
"bin/tests/system/tkey/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/tkey/Makefile" ;;
"bin/tests/system/tsiggss/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/tsiggss/Makefile" ;;
"bin/tests/tasks/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/tasks/Makefile" ;;
test "$use_tuning" = "large" && echo " Large-system tuning (--with-tuning)"
test "$use_geoip" = "no" || echo " GeoIP access control (--with-geoip)"
test "$use_gssapi" = "no" || echo " GSS-API (--with-gssapi)"
-if test "$enable_sit" != "no"; then
- echo " Source Identity Token support (--enable-sit)"
- if test "$enable_full_report" = "yes" -o "$with_sit_alg" != "aes"; then
- echo " Algorithm: $with_sit_alg"
- fi
+if test "$enable_full_report" = "yes" -o "$with_cc_alg" != "aes"; then
+ echo " Algorithm: $with_cc_alg"
fi
# these lines are only printed if run with --enable-full-report
test "$use_geoip" = "no" && echo " GeoIP access control (--with-geoip)"
test "$use_gssapi" = "no" && echo " GSS-API (--with-gssapi)"
-test "$enable_sit" = "no" && echo " Source Identity Token support (--enable-sit)"
test "$enable_fixed" = "yes" || \
echo " Allow 'fixed' rrset-order (--enable-fixed-rrset)"
test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
test "${enable_symtable+set}" = set || enable_symtable=all
- test "${enable_sit+set}" = set || enable_sit=yes
test "${enable_warn_error+set}" = set || enable_warn_error=yes
test "${enable_warn_shadow+set}" = set || enable_warn_shadow=yes
;;
AC_ARG_WITH(gost, [ --with-gost Crypto GOST [yes|no|raw|asn1].],
with_gost="$withval", with_gost="auto")
AC_ARG_WITH(aes, [ --with-aes Crypto AES],
- with_aes="$withval", with_aes="checksit")
+ with_aes="$withval", with_aes="checkcc")
#
# was --enable-openssl-hash specified?
#
AC_ARG_ENABLE(openssl-hash,
[ --enable-openssl-hash use OpenSSL for hash functions [[default=no]]],
- want_openssl_hash="$enableval", want_openssl_hash="checksit")
+ want_openssl_hash="$enableval", want_openssl_hash="checkcc")
#
-# Enable Source Identity Token support
+# Client Cookie algorithm choice
#
-AC_MSG_CHECKING(for Source Identity Token support)
-AC_ARG_ENABLE(sit,
- [ --enable-sit enable source identity token [[default=no]]],
- enable_sit="$enableval", enable_sit="no")
-HAVE_SIT=
-ISC_PLATFORM_USESIT="#undef ISC_PLATFORM_USESIT"
+AC_ARG_WITH(cc-alg,
+ [ --with-cc-alg=ALG choose the algorithm for Client Cookie [[aes|sha1|sha256]]],
+ with_cc_alg="$withval", with_cc_alg="auto")
-case "$enable_sit" in
-yes)
- AC_MSG_RESULT(yes)
- ISC_PLATFORM_USESIT="#define ISC_PLATFORM_USESIT 1"
- HAVE_SIT=1
- ;;
-no)
- AC_MSG_RESULT(no)
- ;;
-*)
- AC_MSG_ERROR("enable-sit requires yes or no")
- ;;
+case $with_cc_alg in
+ *1)
+ with_cc_alg="sha1"
+ ;;
+ *2*)
+ with_cc_alg="sha256"
+ ;;
+ auto)
+ if test "$with_aes" != "no"
+ then
+ with_aes="yes"
+ fi
+ ;;
+ *)
+ with_cc_alg="aes"
+ if test "$with_aes" != "no"
+ then
+ with_aes="yes"
+ fi
+ ;;
esac
-AC_SUBST(ISC_PLATFORM_USESIT)
-AC_SUBST(HAVE_SIT)
-
-#
-# Source Identity Token algorithm choice
-#
-AC_ARG_WITH(sit-alg,
- [ --with-sit-alg=ALG choose the algorithm for SIT [[aes|sha1|sha256]]],
- with_sit_alg="$withval", with_sit_alg="auto")
-
-if test "$enable_sit" = "yes"
-then
- case $with_sit_alg in
- *1)
- with_sit_alg="sha1"
- ;;
- *2*)
- with_sit_alg="sha256"
- ;;
- auto)
- if test "$with_aes" != "no"
- then
- with_aes="yes"
- fi
- ;;
- *)
- with_sit_alg="aes"
- if test "$with_aes" != "no"
- then
- with_aes="yes"
- fi
- ;;
- esac
-fi
-if test "with_aes" = "checksit"
+if test "with_aes" = "checkcc"
then
with_aes="no"
fi
AC_SUBST(ISC_PLATFORM_WANTAES)
#
-# Choose SIT algorithm
+# Choose Client Cookie algorithm
#
-if test "$enable_sit" = "yes"
+AC_MSG_CHECKING(for the Algorithm for Client Cookie)
+if test "$with_cc_alg" = "auto"
then
- AC_MSG_CHECKING(for the Algorithm for SIT)
- if test "$with_sit_alg" = "auto"
+ if test "$with_aes" = "yes"
then
- if test "$with_aes" = "yes"
- then
- with_sit_alg="aes"
- else
- with_sit_alg="sha256"
- fi
+ with_cc_alg="aes"
+ else
+ with_cc_alg="sha256"
fi
fi
-case $with_sit_alg in
+case $with_cc_alg in
sha1)
- if test "$enable_sit" != "yes"
- then
- AC_MSG_ERROR("with-sit-alg requires enable-sit");
- fi
AC_MSG_RESULT(sha1)
if test "$CRYPTO" = "-DOPENSSL"
then
- if test "$want_openssl_hash" = "checksit"
+ if test "$want_openssl_hash" = "checkcc"
then
want_openssl_hash="yes"
fi
fi
- AC_DEFINE(HMAC_SHA1_SIT, 1,
- [Use HMAC-SHA1 for Source Identity Token generation])
+ AC_DEFINE(HMAC_SHA1_CC, 1,
+ [Use HMAC-SHA1 for Client Cookie generation])
;;
sha256)
- if test "$enable_sit" != "yes"
- then
- AC_MSG_ERROR("with-sit-alg requires enable-sit");
- fi
AC_MSG_RESULT(sha256)
if test "$CRYPTO" = "-DOPENSSL"
then
- if test "$want_openssl_hash" = "checksit"
+ if test "$want_openssl_hash" = "checkcc"
then
want_openssl_hash="yes"
fi
fi
- AC_DEFINE(HMAC_SHA256_SIT, 1,
- [Use HMAC-SHA256 for Source Identity Token generation])
+ AC_DEFINE(HMAC_SHA256_CC, 1,
+ [Use HMAC-SHA256 for Client Cookie generation])
;;
aes)
- if test "$enable_sit" != "yes"
- then
- AC_MSG_ERROR("with-sit-alg requires enable-sit");
- fi
AC_MSG_RESULT(aes)
if test "$with_aes" != "yes"
then
- AC_MSG_ERROR("SIT wants to use unavailable AES");
+ AC_MSG_ERROR("Client Cookie wants to use unavailable AES");
fi
- AC_DEFINE(AES_SIT, 1,
- [Use AES for Source Identity Token generation])
+ AC_DEFINE(AES_CC, 1,
+ [Use AES for Client Cookie generation])
;;
esac
-if test "$want_openssl_hash" = "checksit"
+if test "$want_openssl_hash" = "checkcc"
then
want_openssl_hash="no"
fi
bin/tests/system/rndc/Makefile
bin/tests/system/rpz/Makefile
bin/tests/system/rsabigexponent/Makefile
- bin/tests/system/sit/prereq.sh
bin/tests/system/tkey/Makefile
bin/tests/system/tsiggss/Makefile
bin/tests/tasks/Makefile
test "$use_tuning" = "large" && echo " Large-system tuning (--with-tuning)"
test "$use_geoip" = "no" || echo " GeoIP access control (--with-geoip)"
test "$use_gssapi" = "no" || echo " GSS-API (--with-gssapi)"
-if test "$enable_sit" != "no"; then
- echo " Source Identity Token support (--enable-sit)"
- if test "$enable_full_report" = "yes" -o "$with_sit_alg" != "aes"; then
- echo " Algorithm: $with_sit_alg"
- fi
+if test "$enable_full_report" = "yes" -o "$with_cc_alg" != "aes"; then
+ echo " Algorithm: $with_cc_alg"
fi
# these lines are only printed if run with --enable-full-report
test "$use_geoip" = "no" && echo " GeoIP access control (--with-geoip)"
test "$use_gssapi" = "no" && echo " GSS-API (--with-gssapi)"
-test "$enable_sit" = "no" && echo " Source Identity Token support (--enable-sit)"
test "$enable_fixed" = "yes" || \
echo " Allow 'fixed' rrset-order (--enable-fixed-rrset)"
if not set), if the query was signed (S),
EDNS was in used along with the EDNS version
number (E(#)), if TCP was used (T), if DO
- (DNSSEC Ok) was set (D), or if CD (Checking
- Disabled) was set (C). After this the
- destination address the query was sent to is
- reported.
+ (DNSSEC Ok) was set (D), if CD (Checking
+ Disabled) was set (C), if a valid DNS Server
+ COOKIE was recieved (V), or if a DNS COOKIE
+ option without a valid Server COOKIE was
+ present (K). After this the destination
+ address the query was sent to is reported.
</para>
<para>
<optional> multiple-cnames <replaceable>yes_or_no</replaceable>; </optional>
<optional> notify <replaceable>yes_or_no</replaceable> | <replaceable>explicit</replaceable> | <replaceable>master-only</replaceable>; </optional>
<optional> recursion <replaceable>yes_or_no</replaceable>; </optional>
- <optional> request-sit <replaceable>yes_or_no</replaceable>; </optional>
- <optional> sit-secret <replaceable>secret_string</replaceable>; </optional>
+ <optional> send-cookie <replaceable>yes_or_no</replaceable>; </optional>
+ <optional> cookie-algorithm <replaceable>secret_string</replaceable>; </optional>
+ <optional> cookie-secret <replaceable>secret_string</replaceable>; </optional>
<optional> request-nsid <replaceable>yes_or_no</replaceable>; </optional>
<optional> rfc2308-type1 <replaceable>yes_or_no</replaceable>; </optional>
<optional> use-id-pool <replaceable>yes_or_no</replaceable>; </optional>
</varlistentry>
<varlistentry>
- <term><command>request-sit</command></term>
+ <term><command>request-nsid</command></term>
+ <para>
+ This experimental option is obsolete.
+ </para>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>send-cookie</command></term>
<listitem>
<para>
- If <userinput>yes</userinput>, then a SIT (Source
- Identity Token) EDNS option is sent along with
- the query. If the resolver has previously talked
- to the server, the SIT returned in the previous
- transaction is sent. This is used by the server
- to determine whether the resolver has talked to
- it before. A resolver sending the correct SIT is
- assumed not to be an off-path attacker sending a
- spoofed-source query; the query is therefore
- unlikely to be part of a reflection/amplification
- attack, so resolvers sending a correct SIT option
- are not subject to response rate limiting (RRL).
- Resolvers which do not send a correct SIT option
- may be limited to receiving smaller responses via
- the <command>nosit-udp-size</command> option.
+ If <userinput>yes</userinput>, then a COOKIE EDNS
+ option is sent along with the query. If the
+ resolver has previously talked to the server, the
+ COOKIE returned in the previous transaction is sent.
+ This is used by the server to determine whether
+ the resolver has talked to it before. A resolver
+ sending the correct COOKIE is assumed not to be an
+ off-path attacker sending a spoofed-source query;
+ the query is therefore unlikely to be part of a
+ reflection/amplification attack, so resolvers
+ sending a correct COOKIE option are not subject to
+ response rate limiting (RRL). Resolvers which
+ do not send a correct COOKIE option may be limited
+ to receiving smaller responses via the
+ <command>nocookie-udp-size</command> option.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><command>sit-secret</command></term>
+ <listitem>
+ <para>
+ This experimental option is obsolete.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>cookie-algorithm</command></term>
+ <listitem>
+ <para>
+ Set the algorithm to be used when generating the
+ server cookie. One of "aes", "sha1" or "sha256".
+ The default is "aes" if supported by the cryptographic
+ library or otherwise "sha256".
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>cookie-secret</command></term>
<listitem>
<para>
If set, this is a shared secret used for generating
<optional> request-ixfr <replaceable>yes_or_no</replaceable> ; </optional>
<optional> request-expire <replaceable>yes_or_no</replaceable> ; </optional>
<optional> request-nsid <replaceable>yes_or_no</replaceable> ; </optional>
- <optional> request-sit <replaceable>yes_or_no</replaceable> ; </optional>
+ <optional> send-cookie <replaceable>yes_or_no</replaceable> ; </optional>
<optional> edns <replaceable>yes_or_no</replaceable> ; </optional>
<optional> edns-udp-size <replaceable>number</replaceable> ; </optional>
<optional> edns-version <replaceable>number</replaceable> ; </optional>
- <optional> nosit-udp-size <replaceable>number</replaceable> ; </optional>
+ <optional> nocookie-udp-size <replaceable>number</replaceable> ; </optional>
<optional> max-udp-size <replaceable>number</replaceable> ; </optional>
<optional> tcp-only <replaceable>yes_or_no</replaceable> ; </optional>
<optional> transfers <replaceable>number</replaceable> ; </optional>
</para>
<para>
- The <command>nosit-udp-size</command> option sets the
+ The <command>nocookie-udp-size</command> option sets the
maximum size of UDP responses that will be sent to
- queries without a valid source identity token. The command
+ queries without a valid server COOKIE. The command
<command>max-udp-size</command> option may further limit
the response size.
</para>
</para>
<para>
- The <command>request-sit</command> clause determines
- whether the local server will add a SIT EDNS option
+ The <command>send-cookie</command> clause determines
+ whether the local server will add a COOKIE EDNS option
to requests sent to the server. This overrides
- <command>request-sit</command> set at the view or
+ <command>send-cookie</command> set at the view or
option level. The <command>named</command> server may
- determine that SIT is not supported by the remote server
- and not add a SIT EDNS option to requests.
+ determine that COOKIE is not supported by the remote server
+ and not add a COOKIE EDNS option to requests.
</para>
</sect2>
</listitem>
<listitem>
<para>
- When retrying a query via TCP due to the first answer being
- truncated, <command>dig</command> will now correctly send
- the SIT (server identity token) value returned by the server
- in the prior response. [RT #39047]
+ The experimental SIT option (code point 65001) of BIND
+ 9.10.0 through BIND 9.10.2 has be replace the COOKIE
+ option (code point 10) and is no longer experimental and
+ is sent by default.
+ </para>
+ <para>
+ The SIT related named.conf options have been marked as
+ obsolete and are otherwise ignored.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ When retrying a query via TCP due to the first answer
+ being truncated, <command>dig</command> will now correctly
+ send the Server COOKIE returned by the server in the prior
+ response. [RT #39047]
</para>
</listitem>
<listitem>
#include <stdlib.h>
+#include <isc/aes.h>
#include <isc/base64.h>
#include <isc/buffer.h>
#include <isc/file.h>
#include <isc/platform.h>
#include <isc/region.h>
#include <isc/result.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
#include <isc/sockaddr.h>
#include <isc/string.h>
#include <isc/symtab.h>
#include <isc/util.h>
-#ifdef ISC_PLATFORM_USESIT
-#ifdef AES_SIT
-#include <isc/aes.h>
-#endif
-#ifdef HMAC_SHA1_SIT
-#include <isc/sha1.h>
-#endif
-#ifdef HMAC_SHA256_SIT
-#include <isc/sha2.h>
-#endif
-#endif
-
#include <dns/acl.h>
#include <dns/fixedname.h>
#include <dns/rdataclass.h>
dns_fixedname_t fixed;
const char *str;
dns_name_t *name;
-#ifdef ISC_PLATFORM_USESIT
isc_buffer_t b;
-#endif
isc_uint32_t lifetime = 3600;
+#if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
+ const char *ccalg = "aes";
+#else
+ const char *ccalg = "sha256";
+#endif
static intervaltable intervals[] = {
{ "cleaning-interval", 60, 28 * 24 * 60 }, /* 28 days */
"(%d seconds)", recheck, lifetime);
}
-#ifdef ISC_PLATFORM_USESIT
obj = NULL;
- (void) cfg_map_get(options, "sit-secret", &obj);
+ (void) cfg_map_get(options, "cookie-algorithm,", &obj);
+ if (obj != NULL)
+ ccalg = cfg_obj_asstring(obj);
+#if !defined(HAVE_OPENSSL_AES) && !defined(HAVE_OPENSSL_EVP_AES)
+ if (strcasecmp(ccalg, "aes") == 0)
+ cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+ "cookie-algorithm: '%s' not supported", ccalg);
+#endif
+
+ obj = NULL;
+ (void) cfg_map_get(options, "cookie-secret", &obj);
if (obj != NULL) {
unsigned char secret[32];
tresult = isc_hex_decodestring(cfg_obj_asstring(obj), &b);
if (tresult == ISC_R_NOSPACE) {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- "sit-secret: too long");
+ "cookie-secret: too long");
} else if (tresult != ISC_R_SUCCESS) {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- "sit-secret: invalid hex string");
+ "cookie-secret: invalid hex string");
}
if (tresult != ISC_R_SUCCESS)
result = tresult;
-#ifdef AES_SIT
+
if (tresult == ISC_R_SUCCESS &&
+ strcasecmp(ccalg, "aes") != 0 &&
isc_buffer_usedlength(&b) != ISC_AES128_KEYLENGTH) {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- "AES sit-secret must be on 128 bits");
+ "AES cookie-secret must be on 128 bits");
result = ISC_R_RANGE;
}
-#endif
-#ifdef HMAC_SHA1_SIT
if (tresult == ISC_R_SUCCESS &&
+ strcasecmp(ccalg, "sha1") != 0 &&
isc_buffer_usedlength(&b) != ISC_SHA1_DIGESTLENGTH) {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- "SHA1 sit-secret must be on 160 bits");
+ "SHA1 cookie-secret must be on 160 bits");
result = ISC_R_RANGE;
}
-#endif
-#ifdef HMAC_SHA256_SIT
if (tresult == ISC_R_SUCCESS &&
+ strcasecmp(ccalg, "sha256") != 0 &&
isc_buffer_usedlength(&b) != ISC_SHA256_DIGESTLENGTH) {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
- "SHA256 sit-secret must be on 256 bits");
+ "SHA256 cookie-secret must be on 256 bits");
result = ISC_R_RANGE;
}
-#endif
}
-#endif
return (result);
}
result = ISC_R_FAILURE;
/*
- * Use case insensitve comparision as not all file systems are
+ * Use case insensitive comparision as not all file systems are
* case sensitive. This will prevent people using FOO.DB and foo.db
* on case sensitive file systems but that shouldn't be a major issue.
*/
unsigned char to1232; /* IPv6 nofrag */
unsigned char to512; /* plain DNS */
isc_sockaddr_t sockaddr;
- unsigned char * sit;
- isc_uint16_t sitlen;
+ unsigned char * cookie;
+ isc_uint16_t cookielen;
isc_stdtime_t expires;
isc_stdtime_t lastage;
e->to1432 = 0;
e->to1232 = 0;
e->to512 = 0;
- e->sit = NULL;
- e->sitlen = 0;
+ e->cookie = NULL;
+ e->cookielen = 0;
isc_random_get(&r);
e->srtt = (r & 0x1f) + 1;
e->lastage = 0;
e->magic = 0;
- if (e->sit != NULL)
- isc_mem_put(adb->mctx, e->sit, e->sitlen);
+ if (e->cookie != NULL)
+ isc_mem_put(adb->mctx, e->cookie, e->cookielen);
li = ISC_LIST_HEAD(e->lameinfo);
while (li != NULL) {
entry->to512, entry->plain, entry->plainto);
if (entry->udpsize != 0U)
fprintf(f, " [udpsize %u]", entry->udpsize);
-#ifdef ISC_PLATFORM_USESIT
- if (entry->sit != NULL) {
+ if (entry->cookie != NULL) {
unsigned int i;
- fprintf(f, " [sit=");
- for (i = 0; i < entry->sitlen; i++)
- fprintf(f, "%02x", entry->sit[i]);
+ fprintf(f, " [cookie=");
+ for (i = 0; i < entry->cookielen; i++)
+ fprintf(f, "%02x", entry->cookie[i]);
fprintf(f, "]");
}
-#endif
-
if (entry->expires != 0)
fprintf(f, " [ttl %d]", entry->expires - now);
fprintf(f, "\n");
}
void
-dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
- const unsigned char *sit, size_t len)
+dns_adb_setcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
+ const unsigned char *cookie, size_t len)
{
int bucket;
bucket = addr->entry->lock_bucket;
LOCK(&adb->entrylocks[bucket]);
- if (addr->entry->sit != NULL &&
- (sit == NULL || len != addr->entry->sitlen)) {
- isc_mem_put(adb->mctx, addr->entry->sit, addr->entry->sitlen);
- addr->entry->sit = NULL;
- addr->entry->sitlen = 0;
+ if (addr->entry->cookie != NULL &&
+ (cookie == NULL || len != addr->entry->cookielen)) {
+ isc_mem_put(adb->mctx, addr->entry->cookie,
+ addr->entry->cookielen);
+ addr->entry->cookie = NULL;
+ addr->entry->cookielen = 0;
}
- if (addr->entry->sit == NULL && sit != NULL && len != 0U) {
- addr->entry->sit = isc_mem_get(adb->mctx, len);
- if (addr->entry->sit != NULL)
- addr->entry->sitlen = (isc_uint16_t)len;
+ if (addr->entry->cookie == NULL && cookie != NULL && len != 0U) {
+ addr->entry->cookie = isc_mem_get(adb->mctx, len);
+ if (addr->entry->cookie != NULL)
+ addr->entry->cookielen = (isc_uint16_t)len;
}
- if (addr->entry->sit != NULL)
- memmove(addr->entry->sit, sit, len);
+ if (addr->entry->cookie != NULL)
+ memmove(addr->entry->cookie, cookie, len);
UNLOCK(&adb->entrylocks[bucket]);
}
size_t
-dns_adb_getsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
- unsigned char *sit, size_t len)
+dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
+ unsigned char *cookie, size_t len)
{
int bucket;
bucket = addr->entry->lock_bucket;
LOCK(&adb->entrylocks[bucket]);
- if (sit != NULL && addr->entry->sit != NULL &&
- len >= addr->entry->sitlen)
+ if (cookie != NULL && addr->entry->cookie != NULL &&
+ len >= addr->entry->cookielen)
{
- memmove(sit, addr->entry->sit, addr->entry->sitlen);
- len = addr->entry->sitlen;
+ memmove(cookie, addr->entry->cookie, addr->entry->cookielen);
+ len = addr->entry->cookielen;
} else
len = 0;
UNLOCK(&adb->entrylocks[bucket]);
*/
void
-dns_adb_setsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
- const unsigned char *sit, size_t len);
+dns_adb_setcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
+ const unsigned char *cookie, size_t len);
/*%<
- * Record the Source Identity Token (SIT) associated with this addresss. If
- * sit is NULL or len is zero. The recorded SIT is cleared.
+ * Record the COOKIE associated with this addresss. If
+ * cookie is NULL or len is zero the recorded COOKIE is cleared.
*
* Requires:
*\li 'adb' is valid.
*/
size_t
-dns_adb_getsit(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
- unsigned char *sit, size_t len);
+dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
+ unsigned char *cookie, size_t len);
/*
- * Retieve the saved SIT value and store it in 'sit' which has size 'len'.
+ * Retieve the saved COOKIE value and store it in 'cookie' which has
+ * size 'len'.
*
* Requires:
*\li 'adb' is valid.
*\li 'addr' is valid.
*
* Returns:
- * The size of the sit token or zero if it doesn't fit in the buffer
+ * The size of the cookie or zero if it doesn't fit in the buffer
* or it doesn't exist.
*/
#ifdef DRAFT_ANDREWS_EDNS1
#undef DNS_EDNS_VERSION
/*
- * Warning: this currently disables sending SIT requests in resolver.c
+ * Warning: this currently disables sending COOKIE requests in resolver.c
*/
#define DNS_EDNS_VERSION 1 /* draft-andrews-edns1 */
#endif
#define DNS_OPT_NSID 0x0003 /*%< NSID opt code */
#define DNS_OPT_CLIENT_SUBNET 0x0008 /*%< client subnet opt code */
#define DNS_OPT_EXPIRE 0x0009 /*%< EXPIRE opt code */
+#define DNS_OPT_COOKIE 0x000a /*%< COOKIE opt code */
/*%< Experimental options [65001...65534] as per RFC6891 */
-#define DNS_OPT_SIT 65001 /*%< SIT opt code */
/*%< The number of EDNS options we know about. */
#define DNS_EDNSOPTIONS 5
unsigned int verify_attempted : 1;
unsigned int free_query : 1;
unsigned int free_saved : 1;
- unsigned int sitok : 1;
- unsigned int sitbad : 1;
+ unsigned int cc_ok : 1;
+ unsigned int cc_bad : 1;
unsigned int opt_reserved;
unsigned int sig_reserved;
isc_boolean_t request_ixfr;
isc_boolean_t support_edns;
isc_boolean_t request_nsid;
- isc_boolean_t request_sit;
+ isc_boolean_t send_cookie;
isc_boolean_t request_expire;
isc_boolean_t force_tcp;
dns_name_t *key;
dns_peer_getrequestnsid(dns_peer_t *peer, isc_boolean_t *retval);
isc_result_t
-dns_peer_setrequestsit(dns_peer_t *peer, isc_boolean_t newval);
+dns_peer_setsendcookie(dns_peer_t *peer, isc_boolean_t newval);
isc_result_t
-dns_peer_getrequestsit(dns_peer_t *peer, isc_boolean_t *retval);
+dns_peer_getsendcookie(dns_peer_t *peer, isc_boolean_t *retval);
isc_result_t
dns_peer_setrequestexpire(dns_peer_t *peer, isc_boolean_t newval);
#define DNS_R_NTACOVERED (ISC_RESULTCLASS_DNS + 110)
#define DNS_R_BADCDS (ISC_RESULTCLASS_DNS + 111)
#define DNS_R_BADCDNSKEY (ISC_RESULTCLASS_DNS + 112)
+#define DNS_R_OPTERR (ISC_RESULTCLASS_DNS + 113)
-#define DNS_R_NRESULTS 113 /*%< Number of results */
+#define DNS_R_NRESULTS 114 /*%< Number of results */
/*
* DNS wire format rcodes.
dns_resstatscounter_dispreqtcp = 32,
dns_resstatscounter_buckets = 33,
dns_resstatscounter_refused = 34,
-#ifdef ISC_PLATFORM_USESIT
- dns_resstatscounter_sitcc = 35,
- dns_resstatscounter_sitout = 36,
- dns_resstatscounter_sitin = 37,
- dns_resstatscounter_sitok = 38,
-
+ dns_resstatscounter_cookienew = 35,
+ dns_resstatscounter_cookieout = 36,
+ dns_resstatscounter_cookiein = 37,
+ dns_resstatscounter_cookieok = 38,
dns_resstatscounter_badvers = 39,
- dns_resstatscounter_max = 40,
-#else
- dns_resstatscounter_badvers = 35,
- dns_resstatscounter_max = 36,
-#endif
+ dns_resstatscounter_badcookie = 40,
+ dns_resstatscounter_max = 41,
/*
* DNSSEC stats.
/*
* Extended rcodes.
*/
- dns_rcode_badvers = 16
+ dns_rcode_badvers = 16,
#define dns_rcode_badvers ((dns_rcode_t)dns_rcode_badvers)
+ /* Private space [3841..4095] */
+ dns_rcode_badcookie = 3860
+#define dns_rcode_badcookie ((dns_rcode_t)dns_rcode_badcookie)
};
/*%
dns_rrl_t * rrl;
isc_boolean_t provideixfr;
isc_boolean_t requestnsid;
- isc_boolean_t requestsit;
+ isc_boolean_t sendcookie;
dns_ttl_t maxcachettl;
dns_ttl_t maxncachettl;
isc_uint32_t nta_lifetime;
dns_name_t * dlv;
dns_fixedname_t dlv_fixed;
isc_uint16_t maxudp;
- isc_uint16_t situdp;
+ isc_uint16_t nocookieudp;
unsigned int maxbits;
dns_aaaa_t v4_aaaa;
dns_aaaa_t v6_aaaa;
m->saved.base = NULL;
m->saved.length = 0;
m->free_saved = 0;
- m->sitok = 0;
- m->sitbad = 0;
+ m->cc_ok = 0;
+ m->cc_bad = 0;
m->querytsig = NULL;
}
dns_rdataset_disassociate(msg->opt);
isc_mempool_put(msg->rdspool, msg->opt);
msg->opt = NULL;
- msg->sitok = 0;
- msg->sitbad = 0;
+ msg->cc_ok = 0;
+ msg->cc_bad = 0;
}
}
if (optcode == DNS_OPT_NSID) {
ADD_STRING(target, "; NSID");
- } else if (optcode == DNS_OPT_SIT) {
- ADD_STRING(target, "; SIT");
+ } else if (optcode == DNS_OPT_COOKIE) {
+ ADD_STRING(target, "; COOKIE");
} else if (optcode == DNS_OPT_CLIENT_SUBNET) {
ADD_STRING(target, "; CLIENT-SUBNET: ");
render_ecs(&optbuf, target);
for (i = 0; i < optlen; i++) {
const char *sep;
switch (optcode) {
- case DNS_OPT_SIT:
+ case DNS_OPT_COOKIE:
sep = "";
break;
default:
isc_buffer_forward(&optbuf, optlen);
- if (optcode == DNS_OPT_SIT) {
- if (msg->sitok)
+ if (optcode == DNS_OPT_COOKIE) {
+ if (msg->cc_ok)
ADD_STRING(target, " (good)");
- if (msg->sitbad)
+ if (msg->cc_bad)
ADD_STRING(target, " (bad)");
ADD_STRING(target, "\n");
continue;
}
/*
- * For non-SIT options, add a printable
+ * For non-COOKIE options, add a printable
* version
*/
ADD_STRING(target, "(\"");
#define SERVER_UDPSIZE_BIT 6
#define SERVER_MAXUDP_BIT 7
#define REQUEST_NSID_BIT 8
-#define REQUEST_SIT_BIT 9
+#define SEND_COOKIE_BIT 9
#define NOTIFY_DSCP_BIT 10
#define TRANSFER_DSCP_BIT 11
#define QUERY_DSCP_BIT 12
}
isc_result_t
-dns_peer_setrequestsit(dns_peer_t *peer, isc_boolean_t newval) {
+dns_peer_setsendcookie(dns_peer_t *peer, isc_boolean_t newval) {
isc_boolean_t existed;
REQUIRE(DNS_PEER_VALID(peer));
- existed = DNS_BIT_CHECK(REQUEST_SIT_BIT, &peer->bitflags);
+ existed = DNS_BIT_CHECK(SEND_COOKIE_BIT, &peer->bitflags);
- peer->request_sit = newval;
- DNS_BIT_SET(REQUEST_SIT_BIT, &peer->bitflags);
+ peer->send_cookie = newval;
+ DNS_BIT_SET(SEND_COOKIE_BIT, &peer->bitflags);
return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
}
isc_result_t
-dns_peer_getrequestsit(dns_peer_t *peer, isc_boolean_t *retval) {
+dns_peer_getsendcookie(dns_peer_t *peer, isc_boolean_t *retval) {
REQUIRE(DNS_PEER_VALID(peer));
REQUIRE(retval != NULL);
- if (DNS_BIT_CHECK(REQUEST_SIT_BIT, &peer->bitflags)) {
- *retval = peer->request_sit;
+ if (DNS_BIT_CHECK(SEND_COOKIE_BIT, &peer->bitflags)) {
+ *retval = peer->send_cookie;
return (ISC_R_SUCCESS);
} else
return (ISC_R_NOTFOUND);
#define ERCODENAMES \
/* extended rcodes */ \
{ dns_rcode_badvers, "BADVERS", 0}, \
+ { dns_rcode_badcookie, "BADCOOKIE", 0}, \
{ 0, NULL, 0 }
#define TSIGRCODENAMES \
isc_uint8_t addrbytes;
if (length < 4)
- return (DNS_R_FORMERR);
+ return (DNS_R_OPTERR);
family = uint16_fromregion(&sregion);
isc_region_consume(&sregion, 2);
addrlen = uint8_fromregion(&sregion);
switch (family) {
case 1:
if (addrlen > 32U || scope > 32U)
- return (DNS_R_FORMERR);
+ return (DNS_R_OPTERR);
break;
case 2:
if (addrlen > 128U || scope > 128U)
- return (DNS_R_FORMERR);
+ return (DNS_R_OPTERR);
break;
+ default:
+ return (DNS_R_OPTERR);
}
addrbytes = (addrlen + 7) / 8;
if (addrbytes + 4 != length)
- return (DNS_R_FORMERR);
+ return (DNS_R_OPTERR);
isc_region_consume(&sregion, addrbytes);
break;
}
* Request has zero length. Response is 32 bits.
*/
if (length != 0 && length != 4)
+ return (DNS_R_OPTERR);
+ isc_region_consume(&sregion, length);
+ break;
+ case DNS_OPT_COOKIE:
+ if (length != 8 && (length < 16 || length > 40))
return (DNS_R_FORMERR);
isc_region_consume(&sregion, length);
break;
#include <isc/timer.h>
#include <isc/util.h>
-#ifdef AES_SIT
+#ifdef AES_CC
#include <isc/aes.h>
#else
#include <isc/hmacsha.h>
* Private addrinfo flags. These must not conflict with DNS_FETCHOPT_NOEDNS0
* (0x008) which we also use as an addrinfo flag.
*/
-#define FCTX_ADDRINFO_MARK 0x0001
-#define FCTX_ADDRINFO_FORWARDER 0x1000
-#define FCTX_ADDRINFO_TRIED 0x2000
-#define FCTX_ADDRINFO_EDNSOK 0x4000
-#define FCTX_ADDRINFO_NOSIT 0x8000
+#define FCTX_ADDRINFO_MARK 0x00001
+#define FCTX_ADDRINFO_FORWARDER 0x01000
+#define FCTX_ADDRINFO_TRIED 0x02000
+#define FCTX_ADDRINFO_EDNSOK 0x04000
+#define FCTX_ADDRINFO_NOCOOKIE 0x08000
+#define FCTX_ADDRINFO_BADCOOKIE 0x10000
#define UNMARKED(a) (((a)->flags & FCTX_ADDRINFO_MARK) \
== 0)
FCTX_ADDRINFO_FORWARDER) != 0)
#define TRIED(a) (((a)->flags & \
FCTX_ADDRINFO_TRIED) != 0)
-#define NOSIT(a) (((a)->flags & \
- FCTX_ADDRINFO_NOSIT) != 0)
+#define NOCOOKIE(a) (((a)->flags & \
+ FCTX_ADDRINFO_NOCOOKIE) != 0)
#define EDNSOK(a) (((a)->flags & \
FCTX_ADDRINFO_EDNSOK) != 0)
+#define BADCOOKIE(a) (((a)->flags & \
+ FCTX_ADDRINFO_BADCOOKIE) != 0)
#define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
ISC_LIST_INITANDAPPEND(fctx->edns512, tried, link);
}
-#ifdef ISC_PLATFORM_USESIT
static void
-compute_cc(resquery_t *query, unsigned char *sit, size_t len) {
-#ifdef AES_SIT
+compute_cc(resquery_t *query, unsigned char *cookie, size_t len) {
+#ifdef AES_CC
unsigned char digest[ISC_AES_BLOCK_LENGTH];
unsigned char input[16];
isc_netaddr_t netaddr;
isc_aes128_crypt(query->fctx->res->view->secret, input, digest);
for (i = 0; i < 8; i++)
digest[i] ^= digest[i + 8];
- memmove(sit, digest, 8);
+ memmove(cookie, digest, 8);
#endif
-#ifdef HMAC_SHA1_SIT
+#ifdef HMAC_SHA1_CC
unsigned char digest[ISC_SHA1_DIGESTLENGTH];
isc_netaddr_t netaddr;
isc_hmacsha1_t hmacsha1;
break;
}
isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest));
- memmove(sit, digest, 8);
+ memmove(cookie, digest, 8);
isc_hmacsha1_invalidate(&hmacsha1);
#endif
-#ifdef HMAC_SHA256_SIT
+#ifdef HMAC_SHA256_CC
unsigned char digest[ISC_SHA256_DIGESTLENGTH];
isc_netaddr_t netaddr;
isc_hmacsha256_t hmacsha256;
break;
}
isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest));
- memmove(sit, digest, 8);
+ memmove(cookie, digest, 8);
isc_hmacsha256_invalidate(&hmacsha256);
#endif
}
-#endif
static isc_result_t
issecuredomain(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
unsigned int version = DNS_EDNS_VERSION;
unsigned int flags = query->addrinfo->flags;
isc_boolean_t reqnsid = res->view->requestnsid;
-#ifdef ISC_PLATFORM_USESIT
- isc_boolean_t reqsit = res->view->requestsit;
- unsigned char sit[64];
-#endif
+ isc_boolean_t sendcookie = res->view->sendcookie;
+ unsigned char cookie[64];
if ((flags & FCTX_ADDRINFO_EDNSOK) != 0 &&
(query->options & DNS_FETCHOPT_EDNS512) == 0) {
version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT;
}
- /* Request NSID/SIT/VERSION for current peer? */
+ /* Request NSID/COOKIE/VERSION for current peer? */
if (peer != NULL) {
isc_uint8_t ednsversion;
(void) dns_peer_getrequestnsid(peer, &reqnsid);
-#ifdef ISC_PLATFORM_USESIT
- (void) dns_peer_getrequestsit(peer, &reqsit);
-#endif
+ (void) dns_peer_getsendcookie(peer,
+ &sendcookie);
result = dns_peer_getednsversion(peer,
&ednsversion);
if (result == ISC_R_SUCCESS &&
ednsversion < version)
version = ednsversion;
}
-#ifdef ISC_PLATFORM_USESIT
- if (NOSIT(query->addrinfo))
- reqsit = ISC_FALSE;
-#endif
+ if (NOCOOKIE(query->addrinfo))
+ sendcookie = ISC_FALSE;
if (reqnsid) {
INSIST(ednsopt < DNS_EDNSOPTIONS);
ednsopts[ednsopt].code = DNS_OPT_NSID;
ednsopts[ednsopt].value = NULL;
ednsopt++;
}
-#ifdef ISC_PLATFORM_USESIT
#if DNS_EDNS_VERSION > 0
/*
* Some EDNS(0) servers don't ignore unknown options
* as it was not a explict requirement of RFC 2671.
- * Only send SIT to EDNS(1) servers.
+ * Only send COOKIE to EDNS(1) servers.
*/
if (version < 1)
- reqsit = ISC_FALSE;
+ sendcookie = ISC_FALSE;
#endif
- if (reqsit) {
+ if (sendcookie) {
INSIST(ednsopt < DNS_EDNSOPTIONS);
- ednsopts[ednsopt].code = DNS_OPT_SIT;
+ ednsopts[ednsopt].code = DNS_OPT_COOKIE;
ednsopts[ednsopt].length = (isc_uint16_t)
- dns_adb_getsit(fctx->adb,
- query->addrinfo,
- sit, sizeof(sit));
+ dns_adb_getcookie(fctx->adb,
+ query->addrinfo,
+ cookie,
+ sizeof(cookie));
if (ednsopts[ednsopt].length != 0) {
- ednsopts[ednsopt].value = sit;
+ ednsopts[ednsopt].value = cookie;
inc_stats(fctx->res,
- dns_resstatscounter_sitout);
+ dns_resstatscounter_cookieout);
} else {
- compute_cc(query, sit, sizeof(sit));
- ednsopts[ednsopt].value = sit;
+ compute_cc(query, cookie, 8);
+ ednsopts[ednsopt].value = cookie;
ednsopts[ednsopt].length = 8;
inc_stats(fctx->res,
- dns_resstatscounter_sitcc);
+ dns_resstatscounter_cookienew);
}
ednsopt++;
}
-#endif
query->ednsversion = version;
result = fctx_addopt(fctx->qmessage, version,
udpsize, ednsopts, ednsopt);
isc_result_t result;
isc_uint16_t optcode;
isc_uint16_t optlen;
-#ifdef ISC_PLATFORM_USESIT
- unsigned char *sit;
+ unsigned char *optvalue;
dns_adbaddrinfo_t *addrinfo;
unsigned char cookie[8];
-#endif
result = dns_rdataset_first(opt);
if (result == ISC_R_SUCCESS) {
query->fctx->res->mctx);
isc_buffer_forward(&optbuf, optlen);
break;
-#ifdef ISC_PLATFORM_USESIT
- case DNS_OPT_SIT:
- sit = isc_buffer_current(&optbuf);
+ case DNS_OPT_COOKIE:
+ optvalue = isc_buffer_current(&optbuf);
compute_cc(query, cookie, sizeof(cookie));
- INSIST(query->fctx->rmessage->sitbad == 0 &&
- query->fctx->rmessage->sitok == 0);
+ INSIST(query->fctx->rmessage->cc_bad == 0 &&
+ query->fctx->rmessage->cc_ok == 0);
if (optlen >= 8U &&
- memcmp(cookie, sit, 8) == 0) {
- query->fctx->rmessage->sitok = 1;
+ memcmp(cookie, optvalue, 8) == 0) {
+ query->fctx->rmessage->cc_ok = 1;
inc_stats(query->fctx->res,
- dns_resstatscounter_sitok);
+ dns_resstatscounter_cookieok);
addrinfo = query->addrinfo;
- dns_adb_setsit(query->fctx->adb,
- addrinfo, sit, optlen);
+ dns_adb_setcookie(query->fctx->adb,
+ addrinfo, optvalue,
+ optlen);
} else
- query->fctx->rmessage->sitbad = 1;
+ query->fctx->rmessage->cc_bad = 1;
isc_buffer_forward(&optbuf, optlen);
inc_stats(query->fctx->res,
- dns_resstatscounter_sitin);
+ dns_resstatscounter_cookiein);
break;
-#endif
default:
isc_buffer_forward(&optbuf, optlen);
break;
process_opt(query, opt);
#ifdef notyet
-#ifdef ISC_PLATFORM_USESIT
- if (message->sitbad) {
+ if (message->cc_bad) {
/*
- * If the SIT is bad assume it is a attack and retry.
+ * If the COOKIE is bad assume it is a attack and retry.
*/
resend = ISC_TRUE;
/* XXXMPA log it */
- FCTXTRACE("bad sit");
+ FCTXTRACE("bad cookie");
goto done;
}
-#endif
#endif
/*
case dns_rcode_badvers:
inc_stats(fctx->res, dns_resstatscounter_badvers);
break;
+ case dns_rcode_badcookie:
+ inc_stats(fctx->res, dns_resstatscounter_badcookie);
+ break;
default:
inc_stats(fctx->res, dns_resstatscounter_othererror);
break;
message->rcode != dns_rcode_nxdomain) {
isc_buffer_t b;
char code[64];
-#ifdef ISC_PLATFORM_USESIT
- unsigned char sit[64];
+ unsigned char cookie[64];
/*
* Some servers do not ignore unknown EDNS options.
*/
- if (!NOSIT(query->addrinfo) &&
+ if (!NOCOOKIE(query->addrinfo) &&
(message->rcode == dns_rcode_formerr ||
message->rcode == dns_rcode_notimp ||
message->rcode == dns_rcode_refused) &&
- dns_adb_getsit(fctx->adb, query->addrinfo,
- sit, sizeof(sit)) == 0U) {
+ dns_adb_getcookie(fctx->adb, query->addrinfo,
+ cookie, sizeof(cookie)) == 0U) {
dns_adb_changeflags(fctx->adb, query->addrinfo,
- FCTX_ADDRINFO_NOSIT,
- FCTX_ADDRINFO_NOSIT);
+ FCTX_ADDRINFO_NOCOOKIE,
+ FCTX_ADDRINFO_NOCOOKIE);
resend = ISC_TRUE;
- } else
-#endif
- if (((message->rcode == dns_rcode_formerr ||
- message->rcode == dns_rcode_notimp) ||
- (message->rcode == dns_rcode_servfail &&
- dns_message_getopt(message) == NULL)) &&
- (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
+ } else if ((message->rcode == dns_rcode_formerr ||
+ message->rcode == dns_rcode_notimp ||
+ (message->rcode == dns_rcode_servfail &&
+ dns_message_getopt(message) == NULL)) &&
+ (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
/*
* It's very likely they don't like EDNS0.
* If the response code is SERVFAIL, also check if the
} else if (message->rcode == dns_rcode_badvers) {
unsigned int flags, mask;
unsigned int version;
-#if defined(ISC_PLATFORM_USESIT) && DNS_EDNS_VERSION == 0
+
/*
* Some servers return BADVERS to unknown
* EDNS options. This cannot be long term
- * strategy. Do not disable SIT if we have
- * already have received a SIT from this
+ * strategy. Do not disable COOKIE if we have
+ * already have received a COOKIE from this
* server.
*/
- if (dns_adb_getsit(fctx->adb, query->addrinfo,
- sit, sizeof(sit)) == 0U) {
+ if (dns_adb_getcookie(fctx->adb, query->addrinfo,
+ cookie, sizeof(cookie)) == 0U) {
dns_adb_changeflags(fctx->adb, query->addrinfo,
- FCTX_ADDRINFO_NOSIT,
- FCTX_ADDRINFO_NOSIT);
+ FCTX_ADDRINFO_NOCOOKIE,
+ FCTX_ADDRINFO_NOCOOKIE);
}
-#endif
resend = ISC_TRUE;
INSIST(opt != NULL);
* RFC 6891 is clear that that they should be ignored.
* If we are supporting EDNS > 0 then perform strict
* version checking of badvers responses. We won't
- * be sending SIT etc. in that case.
+ * be sending COOKIE etc. in that case.
*/
#if DNS_EDNS_VERSION == 0
/* Avoids a compiler warning with < 0 */
broken_server = DNS_R_BADVERS;
keep_trying = ISC_TRUE;
}
+ } else if (message->rcode == dns_rcode_badcookie &&
+ message->cc_ok) {
+ /*
+ * We have recorded the new cookie.
+ */
+ if (BADCOOKIE(query->addrinfo))
+ query->options |= DNS_FETCHOPT_TCP;
+ query->addrinfo->flags |= FCTX_ADDRINFO_BADCOOKIE;
+ resend = ISC_TRUE;
} else {
/*
* XXXRTH log.
"not dynamic", /*%< 108 DNS_R_NOTDYNAMIC */
"bad EUI", /*%< 109 DNS_R_BADEUI */
- "covered by negative trust anchor", /*%< 110 DNS_R_NTACOVERED */
+ "covered by negative trust anchor", /*%< 110 DNS_R_NTACOVERED */
"bad CDS", /*%< 111 DNS_R_BADCSD */
- "bad CDNSKEY" /*%< 112 DNS_R_BADCDNSKEY */
+ "bad CDNSKEY", /*%< 112 DNS_R_BADCDNSKEY */
+ "malformed OPT option" /*%< 113 DNS_R_OPTERR */
};
static const char *ids[DNS_R_NRESULTS] = {
*/
return ((dns_rcode_t)((result) & 0xFFF));
}
+
/*
* Try to supply an appropriate rcode.
*/
case DNS_R_TSIGERRORSET:
case DNS_R_UNKNOWN:
case DNS_R_NAMETOOLONG:
+ case DNS_R_OPTERR:
rcode = dns_rcode_formerr;
break;
case DNS_R_DISALLOWED:
0x00, 0x08, 0x00, 0x04,
0x00, 0x00, 0x00, 0x00
},
- 8, ISC_TRUE
+ 8, ISC_FALSE
},
{
/* Option code family 1 (ipv4), source 0, scope 0 */
view->flush = ISC_FALSE;
view->dlv = NULL;
view->maxudp = 0;
- view->situdp = 0;
+ view->nocookieudp = 0;
view->maxbits = 0;
view->v4_aaaa = dns_aaaa_ok;
view->v6_aaaa = dns_aaaa_ok;
view->redirectzone = NULL;
dns_fixedname_init(&view->redirectfixed);
view->requestnsid = ISC_FALSE;
- view->requestsit = ISC_TRUE;
+ view->sendcookie = ISC_TRUE;
view->new_zone_file = NULL;
view->new_zone_config = NULL;
view->cfg_destroy = NULL;
dns_adb_flushname
dns_adb_flushnames
dns_adb_freeaddrinfo
+dns_adb_getcookie
dns_adb_getudpsize
-dns_adb_getsit
dns_adb_marklame
dns_adb_noedns
dns_adb_plainresponse
dns_adb_probesize
dns_adb_probesize2
dns_adb_setadbsize
+dns_adb_setcookie
dns_adb_setudpsize
-dns_adb_setsit
dns_adb_shutdown
dns_adb_timeout
dns_adb_whenshutdown
dns_message_gettimeadjust
dns_message_gettsig
dns_message_gettsigkey
-dns_message_logpacket
-dns_message_logpacket2
dns_message_logfmtpacket
dns_message_logfmtpacket2
+dns_message_logpacket
+dns_message_logpacket2
dns_message_movename
dns_message_nextname
dns_message_parse
dns_nsec_buildrdata
dns_nsec_compressbitmap
dns_nsec_isset
-dns_nsec_nseconly
dns_nsec_noexistnodata
+dns_nsec_nseconly
dns_nsec_setbit
dns_nsec_typepresent
dns_ntatable_add
dns_peer_getrequestexpire
dns_peer_getrequestixfr
dns_peer_getrequestnsid
-dns_peer_getrequestsit
+dns_peer_getsendcookie
dns_peer_getsupportedns
dns_peer_gettransferdscp
dns_peer_gettransferformat
dns_peer_setrequestexpire
dns_peer_setrequestixfr
dns_peer_setrequestnsid
-dns_peer_setrequestsit
+dns_peer_setsendcookie
dns_peer_setsupportedns
dns_peer_settransferdscp
dns_peer_settransferformat
dns_rbt_hashsize
dns_rbt_namefromnode
dns_rbt_nodecount
-dns_rbt_printtext
dns_rbt_printdot
dns_rbt_printnodeinfo
+dns_rbt_printtext
dns_rbt_root
dns_rbt_serialize_align
dns_rbt_serialize_tree
dns_resolver_resetmustbesecure
dns_resolver_setclientsperquery
dns_resolver_setlamettl
-dns_resolver_setmustbesecure
dns_resolver_setmaxdepth
dns_resolver_setmaxqueries
+dns_resolver_setmustbesecure
dns_resolver_setquerydscp4
dns_resolver_setquerydscp6
dns_resolver_settimeout
dns_zone_logc
dns_zone_maintenance
dns_zone_markdirty
-dns_zone_mkey_hour
dns_zone_mkey_day
+dns_zone_mkey_hour
dns_zone_mkey_month
dns_zone_name
dns_zone_nameonly
@ISC_PLATFORM_NORETURN_PRE@
@ISC_PLATFORM_NORETURN_POST@
-/*
- * Defined if we are enabling SIT (Source Identity Token).
- */
-@ISC_PLATFORM_USESIT@
-
/***
*** Windows dll support.
***/
result = PK11_R_NODIGESTSERVICE;
goto unlock;
}
-#if defined(ISC_PLATFORM_USESIT) && defined(AES_SIT)
+#if defined(AES_SIT)
if (aes_token == NULL) {
result = PK11_R_NOAESSERVICE;
goto unlock;
*/
@ISC_PLATFORM_NEEDSTRCASESTR@
-/*
- * Defined if we are enabling SIT (Source Identity Token).
- */
-@ISC_PLATFORM_USESIT@
-
/*
* Set up a macro for importing and exporting from the DLL
*/
&cfg_rep_list, &cfg_type_portrange
};
+static const char *cookiealg_enums[] = { "aes", "sha1", "sha256", NULL };
+static cfg_type_t cfg_type_cookiealg = {
+ "cookiealg", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
+ &cfg_rep_string, &cookiealg_enums };
+
/*%
* Clauses that can be found within the top level of the named.conf
* file only.
{ "avoid-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
{ "bindkeys-file", &cfg_type_qstring, 0 },
{ "blackhole", &cfg_type_bracketed_aml, 0 },
+ { "cookie-secret", &cfg_type_sstring, 0 },
+ { "cookie-algorithm", &cfg_type_cookiealg, 0 },
{ "coresize", &cfg_type_size, 0 },
{ "datasize", &cfg_type_size, 0 },
{ "session-keyfile", &cfg_type_qstringornone, 0 },
{ "listen-on", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI },
{ "listen-on-v6", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI },
{ "lock-file", &cfg_type_qstringornone, 0 },
-#ifdef ISC_PLATFORM_USESIT
- { "sit-secret", &cfg_type_sstring, 0 },
-#else
- { "sit-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
+ { "sit-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_OBSOLETE },
{ "managed-keys-directory", &cfg_type_qstring, 0 },
{ "match-mapped-addresses", &cfg_type_boolean, 0 },
{ "max-rsa-exponent-size", &cfg_type_uint32, 0 },
{ "fetch-glue", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
{ "ixfr-from-differences", &cfg_type_ixfrdifftype, 0 },
{ "lame-ttl", &cfg_type_ttlval, 0 },
-#ifdef ISC_PLATFORM_USESIT
- { "nosit-udp-size", &cfg_type_uint32, 0 },
-#else
- { "nosit-udp-size", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
+ { "nocookie-udp-size", &cfg_type_uint32, 0 },
+ { "nosit-udp-size", &cfg_type_uint32, CFG_CLAUSEFLAG_OBSOLETE },
{ "max-acache-size", &cfg_type_sizenodefault, 0 },
{ "max-cache-size", &cfg_type_sizenodefault, 0 },
{ "max-cache-ttl", &cfg_type_uint32, 0 },
{ "queryport-pool-updateinterval", &cfg_type_uint32,
CFG_CLAUSEFLAG_OBSOLETE },
{ "recursion", &cfg_type_boolean, 0 },
-#ifdef ISC_PLATFORM_USESIT
- { "request-sit", &cfg_type_boolean, 0 },
-#else
- { "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
+ { "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
{ "request-nsid", &cfg_type_boolean, 0 },
{ "resolver-query-timeout", &cfg_type_uint32, 0 },
{ "rfc2308-type1", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI },
{ "root-delegation-only", &cfg_type_optional_exclude, 0 },
{ "rrset-order", &cfg_type_rrsetorder, 0 },
+ { "send-cookie", &cfg_type_boolean, 0 },
{ "servfail-ttl", &cfg_type_ttlval, 0 },
{ "sortlist", &cfg_type_bracketed_aml, 0 },
{ "suppress-initial-notify", &cfg_type_boolean, CFG_CLAUSEFLAG_NYI },
{ "request-expire", &cfg_type_boolean, 0 },
{ "request-ixfr", &cfg_type_boolean, 0 },
{ "request-nsid", &cfg_type_boolean, 0 },
-#ifdef ISC_PLATFORM_USESIT
- { "request-sit", &cfg_type_boolean, 0 },
-#else
- { "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED },
-#endif
+ { "request-sit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
+ { "send-cookie", &cfg_type_boolean, 0 },
{ "support-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
{ "transfer-format", &cfg_type_transferformat, 0 },
{ "transfer-source", &cfg_type_sockaddr4wild, 0 },
./bin/tests/system/common/rndc.key CONF-C 2011,2013
./bin/tests/system/common/root.hint ZONE 2000,2001,2004,2007
./bin/tests/system/conf.sh.in SH 2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015
+./bin/tests/system/cookie/.gitignore X 2014
+./bin/tests/system/cookie/bad-sit-badhex.conf CONF-C 2014
+./bin/tests/system/cookie/bad-sit-toolong.conf CONF-C 2014
+./bin/tests/system/cookie/clean.sh SH 2014
+./bin/tests/system/cookie/ns1/example.db ZONE 2014
+./bin/tests/system/cookie/ns1/named.conf CONF-C 2014
+./bin/tests/system/cookie/ns1/root.hint ZONE 2014
+./bin/tests/system/cookie/ns2/named.conf CONF-C 2014
+./bin/tests/system/cookie/ns2/root.db ZONE 2014
+./bin/tests/system/cookie/prereq.sh.in SH 2014
+./bin/tests/system/cookie/tests.sh SH 2014,2015
./bin/tests/system/coverage/01-ksk-inactive/README X 2013
./bin/tests/system/coverage/01-ksk-inactive/expect X 2013
./bin/tests/system/coverage/02-zsk-inactive/README X 2013
./bin/tests/system/sfcache/prereq.sh SH 2014
./bin/tests/system/sfcache/setup.sh SH 2014
./bin/tests/system/sfcache/tests.sh SH 2014
-./bin/tests/system/sit/.gitignore X 2014
-./bin/tests/system/sit/bad-sit-badhex.conf CONF-C 2014
-./bin/tests/system/sit/bad-sit-toolong.conf CONF-C 2014
-./bin/tests/system/sit/clean.sh SH 2014
-./bin/tests/system/sit/ns1/example.db ZONE 2014
-./bin/tests/system/sit/ns1/named.conf CONF-C 2014
-./bin/tests/system/sit/ns1/root.hint ZONE 2014
-./bin/tests/system/sit/ns2/named.conf CONF-C 2014
-./bin/tests/system/sit/ns2/root.db ZONE 2014
-./bin/tests/system/sit/prereq.sh.in SH 2014
-./bin/tests/system/sit/tests.sh SH 2014,2015
./bin/tests/system/smartsign/child.db ZONE 2010
./bin/tests/system/smartsign/clean.sh SH 2010,2012,2014
./bin/tests/system/smartsign/parent.db ZONE 2010
projects / thirdparty / bind9.git / commitdiff
