Mark Andrews [Fri, 1 Sep 2023 00:17:00 +0000 (10:17 +1000)]
Adjust level of log messages when transferring in a zone
This raises the log level of messages treated as FORMERR to NOTICE
when transfering in a zone. This also adds a missing log message
for TYPE0 and meta types received during a zone transfer.
Mark Andrews [Mon, 4 Sep 2023 23:46:05 +0000 (09:46 +1000)]
Restore dns_validator_destroy and fetchctx_detach call order
7a78a85b moved the destruction of the validator from near the start
validated to the end. This reversed the order of dns_validator_destroy
and fetchctx_detach. Restore the order so that val->name remains
valid for the lifetime of the validator.
Synchronize used library versions reporting functions
There are libraries which are reported in printversion(), but not
reported in setup(). Synchronize the functions, so that the log
file could have the same information as reported by the 'named -V'
command execution.
Print the used jemalloc version in autoconf and named -V output
The autoconf and named -V now prints used version of jemalloc. This
doesn't work with system supplied jemalloc, so in it prints `system`
instead in the autoconf and nothing in named -V output.
We now depend on explicitly creating memory arenas and disabling tcache
on those, and these features are not available with jemalloc < 4.
Instead of working around these issues, make the jemalloc >= 4.0.0 hard
requirement by looking for sdallocx() symbol that's only available from
that version.
The jemalloc < 4 was only used by RHEL 7 which is not supported since
BIND 9.19+.
Artem Boldariev [Thu, 10 Aug 2023 20:08:25 +0000 (23:08 +0300)]
Allocate DNS send buffers using dedicated per-worker memory arenas
This commit ensures that memory allocations related to DNS send
buffers are routed through dedicated per-worker memory arenas in order
to decrease memory usage on high load caused by TCP-based DNS
transports.
We do that by following jemalloc developers suggestions:
Artem Boldariev [Thu, 10 Aug 2023 14:02:43 +0000 (17:02 +0300)]
Make it possible to create memory contexts backed by jemalloc arenas
This commit extends the internal memory management middleware code in
BIND so that memory contexts backed by dedicated jemalloc arenas can
be created. A new function (isc_mem_create_arena()) is added for that.
Moreover, it extends the existing code so that specialised memory
contexts can be created easily, should we need that functionality for
other future purposes. We have achieved that by passing the flags to
the underlying jemalloc-related calls. See the above
isc_mem_create_arena(), which can serve as an example of this.
Having this opens up possibilities for creating memory contexts tuned
for specific needs.
Michał Kępień [Mon, 4 Sep 2023 09:54:57 +0000 (11:54 +0200)]
Move security-related information to SECURITY.md
To follow current best practices, create a short SECURITY.md file in the
root of the repository that contains information about the project's
security policy and guidelines for reporting potential security issues.
Replace the relevant bits of text in other files with references to the
new SECURITY.md file, so that the relevant information only needs to be
maintained in one place.
Replace all occurrences of the generic security-officer@isc.org email
with a dedicated address for reporting BIND 9 security issues,
bind-security@isc.org.
Evan Hunt [Thu, 24 Aug 2023 20:47:19 +0000 (13:47 -0700)]
unconditionally create view and resolver nametrees
instead of allowing a NULL nametree in dns_nametree_covered(),
require nametree to exist, and ensure that the nametrees defined
for view and resolver objects are always created.
Evan Hunt [Thu, 17 Aug 2023 06:26:50 +0000 (23:26 -0700)]
add semantics to name trees to support counters
name trees can now also hold trees of counters. each time a name
dns_nametree_add() is called with a given name, the counter for that
name is incremented; the name is not deleted until dns_nametree_delete()
is called the same number of times.
this is meant to be used for synth-from-dnssec, which is incremented for
each key defined at a name, and decremented when a key is removed, the
name must continue to exist until the number of keys has reached zero.
Evan Hunt [Thu, 17 Aug 2023 02:59:50 +0000 (19:59 -0700)]
add semantics to dns_nametree to support bitfields
name trees can now hold either boolean values or bit fields. the
type is selected when the name tree is created.
the behavior of dns_nametree_add() differs slightly beteween the types:
in a boolean tree adding an existing name will return ISC_R_EXISTS,
but in a bitfield tree it simply sets the specified bit in the bitfield
and returns ISC_R_SUCCESS.
Evan Hunt [Tue, 15 Aug 2023 22:30:12 +0000 (15:30 -0700)]
refactor disable_algorithm and disable_ds_digest to use one data structure
the functions for disabling DNSSEC signing algorithms and DS digest
algorithms in resolver.c had a lot of duplicated code.
this commit adds functions to implement a "bitfield tree", which is
(currently) an RBT in which the node data contains arbitrary-sized
bitfields to indicate whether a value has been added at the given
node or not. (it can be changed to a QP trie later.)
it also replaces the functions dns_resolver_disable_algorithm(),
dns_resolver_algorithm_supported(), dns_resolver_disable_ds_digest()
and dns_resolver_ds_digest_supported() with simple wrappers that call
the new functions.
Evan Hunt [Wed, 16 Aug 2023 20:28:36 +0000 (13:28 -0700)]
use dns_nametree in place of RBTs
replace the use of RBTs for deny-answer-aliases, the exclude
lists for deny-answer-aliases and deny-answer-addresses, and
dnssec-must-be-secure, with name trees.
Evan Hunt [Wed, 16 Aug 2023 19:08:53 +0000 (12:08 -0700)]
add dns_nametree structure for policy match lookups
this is a QP trie of boolean values to indicate whether a name is
included in or excluded from some policy. this can be used for
synth-from-dnssec, deny-answer-aliases, etc.
Evan Hunt [Wed, 16 Aug 2023 04:04:54 +0000 (21:04 -0700)]
replace RBTs with hashmaps in dns_transport
as dns_transport_find() is only concerned with finding an exact
match on the specified name it doesn't need to use a tree data
structure internally, we can replace the RBTs with hash tables.
Tony Finch [Fri, 9 Jun 2023 12:58:41 +0000 (13:58 +0100)]
A semantic patch to refactor isc_mem_cget and friends
The aim is to match unsafe patterns of allocation size arithmetic
and turn them into safe calls to the new `isc_mem_cget()`,
`isc_mem_creget()`, and `isc_mem_cput()`.
Ondřej Surý [Wed, 23 Aug 2023 06:56:22 +0000 (08:56 +0200)]
Checked array allocation arithmetic with isc_mem_get and friends
Add new isc_mem_cget(), isc_mem_creget(), and isc_mem_cput() macros to
complement the isc_mem_callocate() (which works like calloc()).
The overflow checks are implemented as macros in the <isc/mem.h>, so
that the compiler can see that the element size is constant: it should
always be `sizeof(something)`.
Matthijs Mekking [Tue, 22 Aug 2023 09:45:41 +0000 (11:45 +0200)]
Fix keys reference link in ARM
There's a statement that says: "Here is an example (for illustration
purposes only) of some possible entries in a [keys] list:", and that
links to the wrong "keys" statement (it links to the TSIG keys section).
Remove the reference, as we are already in the right section.
Michal Nowak [Tue, 29 Aug 2023 08:44:18 +0000 (10:44 +0200)]
Install Sphinx tools versions from BIND 9 repository
The doc/arm/requirements.txt file is the single source of truth when it
comes to Sphinx tools versions used to build documentation via
util/release-tarball-comparison.sh.
Aram Sargsyan [Wed, 23 Aug 2023 11:50:02 +0000 (11:50 +0000)]
Reset the 'result' before using it again
The 'result' variable should be reset to ISC_R_NOTFOUND again,
because otherwise a log message could be logged about not being
able to get the TLS configuration based on on the 'result' value
from the previous calls to get the TSIG key.
Matthijs Mekking [Thu, 24 Aug 2023 09:33:05 +0000 (11:33 +0200)]
After cache flush, restore serve-stale settings
When flushing the cache, we create a new cache database. The serve-stale
settings need to be restored after doing this. We already did this
for max-stale-ttl, but forgot to do this for stale-refresh-time.
projects / thirdparty / bind9.git / log
