[#4031] release changes

diff --git a/ChangeLog b/ChangeLog
index 46833e94f5a9644977ed3a039dde1a755e9ba448..589706bd38573a7b898b624343c957c36f0c5ff5 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,27 @@
+Kea 3.1.0 (development) released on July 30, 2025
+
+2381.  [build]*                fdupont
+       Moved Botan crypto backend support to version 3.
+       (Gitlab #3553)
+
+2380.  [bug]           tmark
+       kea-dhcp4 now correctly supports option class-tags
+       (i.e."client-classes") in host and config back ends
+       for both MySQL and PosgreSQL.
+       (Gitlab #3770)
+
+2379.  [func]          razvan
+       Added SSL/TLS support for PostgreSQL database connection in
+       the Kea configuration. Available parameters are:
+       "trust-anchor", "cert-file", "key-file" and "ssl-mode".
+       (Gitlab #3927)
+
+2378.  [sec]*          tmark
+       Additional runtime security checks were added
+       to kea-dhcp4,kea-dhcp6,kea-dhcp-ddns, and
+       kea-ctrl-agent
+       (Gitlab #3848)
+
 2377.  [build]         razvan
        The library version numbers have been bumped up for the Kea 3.1.0
        development release.

diff --git a/changelog_unreleased/3553-botan-3 b/changelog_unreleased/3553-botan-3
deleted file mode 100644 (file)
index ed90be0..0000000
--- a/changelog_unreleased/3553-botan-3
+++ /dev/null
@@ -1,3 +0,0 @@
-[build]*               fdupont
-       Moved Botan crypto backend support to version 3.
-       (Gitlab #3553)

diff --git a/changelog_unreleased/3770-examine-cb-command-behavior-for-mulitple-options-with-the-same-code-in-a-given-scope b/changelog_unreleased/3770-examine-cb-command-behavior-for-mulitple-options-with-the-same-code-in-a-given-scope
deleted file mode 100644 (file)
index 8045450..0000000
--- a/changelog_unreleased/3770-examine-cb-command-behavior-for-mulitple-options-with-the-same-code-in-a-given-scope
+++ /dev/null
@@ -1,5 +0,0 @@
-[bug]          tmark
-       kea-dhcp4 now correctly supports option class-tags
-       (i.e."client-classes") in host and config back ends
-       for both MySQL and PosgreSQL.
-       (Gitlab #3770)

diff --git a/changelog_unreleased/3848-security-policy-security-strict-relaxed b/changelog_unreleased/3848-security-policy-security-strict-relaxed
deleted file mode 100644 (file)
index c4a4c21..0000000
--- a/changelog_unreleased/3848-security-policy-security-strict-relaxed
+++ /dev/null
@@ -1,5 +0,0 @@
-[sec]*         tmark
-       Additional runtime security checks were added
-       to kea-dhcp4,kea-dhcp6,kea-dhcp-ddns, and
-       kea-ctrl-agent
-       (Gitlab #3848)

diff --git a/changelog_unreleased/3927-add-tls-settings-to-pqconnectdb b/changelog_unreleased/3927-add-tls-settings-to-pqconnectdb
deleted file mode 100644 (file)
index badd5f0..0000000
--- a/changelog_unreleased/3927-add-tls-settings-to-pqconnectdb
+++ /dev/null
@@ -1,5 +0,0 @@
-[func]         razvan
-       Added SSL/TLS support for PostgreSQL database connection in
-       the Kea configuration. Available parameters are:
-       "trust-anchor", "cert-file", "key-file" and "ssl-mode".
-       (Gitlab #3927)

diff --git a/doc/sphinx/grammar/grammar-dhcp4-parser.rst b/doc/sphinx/grammar/grammar-dhcp4-parser.rst
index 192115b1f3df23f4183e16ebeebc58e689788a80..4224b2b8ef74d3cf963cd56906d4bedeccbac304 100644 (file)
--- a/doc/sphinx/grammar/grammar-dhcp4-parser.rst
+++ b/doc/sphinx/grammar/grammar-dhcp4-parser.rst
@@ -343,6 +343,7 @@ This grammar is generated from ``dhcp4_parser.yy``. See :ref:`dhcp4` for more de
                        | trust_anchor
                        | cert_file
                        | key_file
+                       | ssl_mode
                        | cipher_list
                        | unknown_map_entry
 
@@ -392,6 +393,13 @@ This grammar is generated from ``dhcp4_parser.yy``. See :ref:`dhcp4` for more de
 
      key_file ::= "key-file" ":" STRING
 
+     ssl_mode ::= "ssl-mode" ":" ssl_mode
+             | "disable"
+             | "prefer"
+             | "require"
+             | "verify-ca"
+             | "verify-full"
+
      cipher_list ::= "cipher-list" ":" STRING
 
      host_reservation_identifiers ::= "host-reservation-identifiers" ":" "[" host_reservation_identifiers_list "]"

diff --git a/doc/sphinx/grammar/grammar-dhcp6-parser.rst b/doc/sphinx/grammar/grammar-dhcp6-parser.rst
index e8cb164145c4019787471763ac1b80aedcc79c60..6be622c13d04f330652ddd507b0e2b4cde998db8 100644 (file)
--- a/doc/sphinx/grammar/grammar-dhcp6-parser.rst
+++ b/doc/sphinx/grammar/grammar-dhcp6-parser.rst
@@ -320,6 +320,7 @@ This grammar is generated from ``dhcp6_parser.yy``. See :ref:`dhcp6` for more de
                        | trust_anchor
                        | cert_file
                        | key_file
+                       | ssl_mode
                        | cipher_list
                        | unknown_map_entry
 
@@ -369,6 +370,13 @@ This grammar is generated from ``dhcp6_parser.yy``. See :ref:`dhcp6` for more de
 
      key_file ::= "key-file" ":" STRING
 
+     ssl_mode ::= "ssl-mode" ":" ssl_mode
+             | "disable"
+             | "prefer"
+             | "require"
+             | "verify-ca"
+             | "verify-full"
+
      cipher_list ::= "cipher-list" ":" STRING
 
      sanity_checks ::= "sanity-checks" ":" "{" sanity_checks_params "}"

diff --git a/doc/sphinx/kea-messages.rst b/doc/sphinx/kea-messages.rst
index 10e031344e96a037c5e2ee5e956df0e098a9b717..29d2cebf432af548342d556ff77935f09cfd6d5a 100644 (file)
--- a/doc/sphinx/kea-messages.rst
+++ b/doc/sphinx/kea-messages.rst
@@ -2691,6 +2691,18 @@ Logged at debug log level 10.
 This debug messages is issued when the Command HTTP listener, listening
 at the given address and port, has begun to shutdown.
 
+COMMAND_HTTP_SOCKET_SECURITY_WARNING
+====================================
+
+.. code-block:: text
+
+    command socket configuration is NOT SECURE: %1
+
+This warning message is issued when security enforcement is disabled
+and command socket configuration does not use HTTPS/TLS or  baseic HTTP
+authentication. The server will still use the socket as configured but
+is warning that doing so may pose a security risk.
+
 COMMAND_PROCESS_ERROR1
 ======================
 
@@ -2880,6 +2892,30 @@ COMMAND_SOCKET_WRITE_FAIL
 This error message indicates that an error was encountered while
 attempting to send a response to the command socket.
 
+COMMAND_UNIX_SOCKET_PATH_SECURITY_WARNING
+=========================================
+
+.. code-block:: text
+
+    unix socket path is NOT SECURE: %1
+
+This warning message is issued when security enforcement is disabled
+and the path specified for a control channel unix socket-name does
+not comply with the supported path. The server will still use the
+specified path but is warning that doing so may pose a security risk.
+
+COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING
+================================================
+
+.. code-block:: text
+
+    unix socket permissions are NOT SECURE: %1
+
+This warning message is issued when security enforcement is disabled
+and the path specified for a control channel unix socket-name does
+not have the required socket permissions. The server will still use the
+specified path but is warning that doing so may pose a security risk.
+
 COMMAND_WATCH_SOCKET_CLEAR_ERROR
 ================================
 
@@ -3508,6 +3544,19 @@ DCTL_INIT_PROCESS_FAIL
 This error message is issued if the controller could not initialize the
 application and will exit.
 
+DCTL_LOG_PATH_SECURITY_WARNING
+==============================
+
+.. code-block:: text
+
+    Log output path specified is NOT SECURE: %1
+
+This warning message is issued when security enforcement is
+disabled and the output path specified for a given logger does
+not comply with the supported path. The server will still
+use the specified path but is warning that doing so may pose a
+security risk.
+
 DCTL_NOT_RUNNING
 ================
 
@@ -3567,6 +3616,18 @@ The controller has encountered a fatal error while running the
 application and is terminating. The reason for the failure is
 included in the message.
 
+DCTL_ROOT_USER_SECURITY_WARNING
+===============================
+
+.. code-block:: text
+
+    %1 running as root user!
+
+This warning is emitted when the server is running as a root user.
+While the server will function fully, this mode of operation may
+expose your environment to security vulnerabilities and should
+only be used after careful consideration.
+
 DCTL_RUN_PROCESS
 ================
 
@@ -5829,6 +5890,18 @@ supplied its hostname. The first argument includes the client and the
 transaction identification information. The second argument holds the
 generated hostname.
 
+DHCP4_ROOT_USER_SECURITY_WARNING
+================================
+
+.. code-block:: text
+
+    kea-dhcp4 running as root user!
+
+This warning is emitted when kea-dhcp4 is running as a root user.
+While the server will function fully, this mode of operation may
+expose your environment to security vulnerabilities and should
+only be used after careful consideration.
+
 DHCP4_SECURITY_CHECKS_DISABLED
 ==============================
 
@@ -8187,6 +8260,18 @@ identification information. The second and third argument contains the
 packet name and type respectively. The fourth argument contains detailed
 packet information.
 
+DHCP6_ROOT_USER_SECURITY_WARNING
+================================
+
+.. code-block:: text
+
+    kea-dhcp6 running as root user!
+
+This warning is emitted when kea-dhcp6 is running as a root user.
+While the server will function fully, this mode of operation may
+expose your environment to security vulnerabilities and should
+only be used after careful consideration
+
 DHCP6_SECURITY_CHECKS_DISABLED
 ==============================
 
@@ -9964,6 +10049,18 @@ testing but should not be enabled in normal circumstances. Non-persistence
 mode is enabled when 'persist4=no persist6=no' parameters are specified
 in the database access string.
 
+DHCPSRV_MEMFILE_PATH_SECURITY_WARNING
+=====================================
+
+.. code-block:: text
+
+    Lease file path specified is NOT SECURE: %1
+
+This warning message is issued when security enforcement is
+disabled and the lease file path specified for does not comply
+with the supported path. The server will still use the specified
+path but is warning that doing so may pose a security risk.
+
 DHCPSRV_MEMFILE_READ_HWADDR_FAIL
 ================================
 
@@ -11454,6 +11551,18 @@ message but the attempt to send it suffered an unexpected error. This is most
 likely a programmatic error, rather than a communications issue. Some or all
 of the DNS updates requested as part of this request did not succeed.
 
+DHCP_DDNS_TSIG_SECRET_SECURITY_WARNING
+======================================
+
+.. code-block:: text
+
+    use of clear text TSIG 'secret' is NOT SECURE: %1
+
+This warning message is issued when security enforcement is disabled
+and TSIG key configuration uses clear text 'secret' rather
+than 'secret-file'. The server will still use the key as configured
+but is warning that doing so may pose a security risk.
+
 DHCP_DDNS_UDP_SENDER_WATCH_SOCKET_CLOSE_ERROR
 =============================================
 
@@ -14489,6 +14598,19 @@ This is most likely due to the installation of a new version of Kea
 without rebuilding the hook library.  A rebuild and re-install of the
 library should fix the problem in most cases.
 
+HOOKS_LIBPATH_SECURITY_WARNING
+==============================
+
+.. code-block:: text
+
+    Library path specified is NOT SECURE: %1
+
+This warning message is issued when security enforcement is
+disabled and the library path specified for a given hook library
+does not comply with the supported path. The server will still load
+the hook library but is warning that doing so may pose a security
+risk.
+
 HOOKS_LIBRARY_CLOSED
 ====================
 
@@ -15975,6 +16097,18 @@ HOST_CACHE_INIT_OK
 This info message indicates that the Host Cache hooks library has been
 loaded successfully. Enjoy!
 
+HOST_CACHE_PATH_SECURITY_WARNING
+================================
+
+.. code-block:: text
+
+    Cache file path specified is NOT SECURE: %1
+
+This warning message is issued when security enforcement is
+disabled and the host cache file path specified does not comply
+with the supported path. The server will still use the specified
+path but is warning that doing so may pose a security risk.
+
 HOST_CMDS_DEINIT_OK
 ===================
 
@@ -16344,6 +16478,18 @@ Logged at debug log level 40.
 This debug message is issued when a multi-threaded HTTP client instance has
 been created.  The argument specifies the maximum number of threads.
 
+HTTP_CLIENT_PASSWORD_SECURITY_WARNING
+=====================================
+
+.. code-block:: text
+
+    use of clear text 'password' is NOT SECURE: %1
+
+This warning message is issued when security enforcement is disabled
+and command socket configuration uses clear text 'password' rather
+than 'password-file'. The server will still use the socket as configured
+but is warning that doing so may pose a security risk.
+
 HTTP_CLIENT_QUEUE_SIZE_GROWING
 ==============================
 
@@ -16465,6 +16611,18 @@ This debug message is issued when the HTTP request timeout has occurred and
 the server is going to send a response with Http Request timeout status
 code.
 
+HTTP_CLIENT_USER_SECURITY_WARNING
+=================================
+
+.. code-block:: text
+
+    use of clear text 'user' is NOT SECURE: %1
+
+This warning message is issued when security enforcement is disabled
+and command socket configuration uses clear text 'user' rather
+than 'user-file'. The server will still use the socket as configured
+but is warning that doing so may pose a security risk.
+
 HTTP_COMMAND_MGR_HTTPS_SERVICE_REUSE_FAILED
 ===========================================
 
@@ -17039,6 +17197,19 @@ This error message indicates an error loading the Lease Commands
 hooks library. The details of the error are provided as argument of
 the log message.
 
+LEASE_CMDS_PATH_SECURITY_WARNING
+================================
+
+.. code-block:: text
+
+    lease file path specified is NOT SECURE: %1
+
+This warning message is issued when security enforcement is disabled
+and the path portion of the `filename` parameter of the lease4-write
+or lease6-write command does not comply with the supported path. The
+server will still use the specified path but is warning that doing so
+may pose a security risk.
+
 LEASE_CMDS_RESEND_DDNS4
 =======================
 
@@ -17442,6 +17613,19 @@ Logged at debug log level 50.
 A debug message issued when a new MySQL connected is created with TLS.
 The TLS cipher name is logged.
 
+LEGAL_LOG_PATH_SECURITY_WARNING
+===============================
+
+.. code-block:: text
+
+    Forensic log path specified is NOT SECURE: %1
+
+This warning message is issued when security enforcement is
+disabled and the path specified for forensic logging output
+does not comply with the supported path. The server will
+still use the specified path but is warning that doing so may
+pose a security risk.
+
 LEGAL_LOG_PGSQL_COMMIT
 ======================
 

diff --git a/src/bin/agent/agent_lexer.cc b/src/bin/agent/agent_lexer.cc
index dba1a6a2e0fb2d4e5f1d17715f6526c3a1adfcb6..39e602af57fda8a6936771b56dd3aba535163c04 100644 (file)
--- a/src/bin/agent/agent_lexer.cc
+++ b/src/bin/agent/agent_lexer.cc
@@ -1,6 +1,6 @@
-#line 2 "agent_lexer.cc"
+#line 1 "agent_lexer.cc"
 
-#line 4 "agent_lexer.cc"
+#line 3 "agent_lexer.cc"
 
 #define  YY_INT_ALIGNED short int
 
@@ -1624,7 +1624,7 @@ using isc::agent::AgentParser;
 
 /* To avoid the call to exit... oops! */
 #define YY_FATAL_ERROR(msg) isc::agent::ParserContext::fatal(msg)
-#line 1628 "agent_lexer.cc"
+#line 1627 "agent_lexer.cc"
 /* noyywrap disables automatic rewinding for the next file to parse. Since we
    always parse only a single string, there's no need to do any wraps. And
    using yywrap requires linking with -lfl, which provides the default yywrap
@@ -1650,8 +1650,8 @@ using isc::agent::AgentParser;
    by moving it ahead by yyleng bytes. yyleng specifies the length of the
    currently matched token. */
 #define YY_USER_ACTION  driver.loc_.columns(yyleng);
+#line 1653 "agent_lexer.cc"
 #line 1654 "agent_lexer.cc"
-#line 1655 "agent_lexer.cc"
 
 #define INITIAL 0
 #define COMMENT 1
@@ -1965,7 +1965,7 @@ YY_DECL
     }
 
 
-#line 1969 "agent_lexer.cc"
+#line 1968 "agent_lexer.cc"
 
        while ( /*CONSTCOND*/1 )                /* loops until end-of-file is reached */
                {
@@ -2982,7 +2982,7 @@ YY_RULE_SETUP
 #line 835 "agent_lexer.ll"
 ECHO;
        YY_BREAK
-#line 2986 "agent_lexer.cc"
+#line 2985 "agent_lexer.cc"
 
        case YY_END_OF_BUFFER:
                {

diff --git a/src/bin/agent/tests/ca_response_creator_unittests.cc b/src/bin/agent/tests/ca_response_creator_unittests.cc
index 19cf3339c2107a2225f7ec6fa1624c846a1aedf1..2516a82f3f01118c71b144a28c9d857dcb63dcc6 100644 (file)
--- a/src/bin/agent/tests/ca_response_creator_unittests.cc
+++ b/src/bin/agent/tests/ca_response_creator_unittests.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2017-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2017-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/d2/d2_lexer.cc b/src/bin/d2/d2_lexer.cc
index 1e56767ffbb43ff890c5a4bd045149841571ae37..92e386daa044963e7e9cac805169cb5d2d2eb168 100644 (file)
--- a/src/bin/d2/d2_lexer.cc
+++ b/src/bin/d2/d2_lexer.cc
@@ -1,6 +1,6 @@
-#line 2 "d2_lexer.cc"
+#line 1 "d2_lexer.cc"
 
-#line 4 "d2_lexer.cc"
+#line 3 "d2_lexer.cc"
 
 #define  YY_INT_ALIGNED short int
 
@@ -1214,7 +1214,7 @@ unsigned int comment_start_line = 0;
 
 /* To avoid the call to exit... oops! */
 #define YY_FATAL_ERROR(msg) isc::d2::D2ParserContext::fatal(msg)
-#line 1218 "d2_lexer.cc"
+#line 1217 "d2_lexer.cc"
 /* noyywrap disables automatic rewinding for the next file to parse. Since we
    always parse only a single string, there's no need to do any wraps. And
    using yywrap requires linking with -lfl, which provides the default yywrap
@@ -1240,8 +1240,8 @@ unsigned int comment_start_line = 0;
    by moving it ahead by yyleng bytes. yyleng specifies the length of the
    currently matched token. */
 #define YY_USER_ACTION  driver.loc_.columns(yyleng);
+#line 1243 "d2_lexer.cc"
 #line 1244 "d2_lexer.cc"
-#line 1245 "d2_lexer.cc"
 
 #define INITIAL 0
 #define COMMENT 1
@@ -1561,7 +1561,7 @@ YY_DECL
     }
 
 
-#line 1565 "d2_lexer.cc"
+#line 1564 "d2_lexer.cc"
 
        while ( /*CONSTCOND*/1 )                /* loops until end-of-file is reached */
                {
@@ -2812,7 +2812,7 @@ YY_RULE_SETUP
 #line 1022 "d2_lexer.ll"
 ECHO;
        YY_BREAK
-#line 2816 "d2_lexer.cc"
+#line 2815 "d2_lexer.cc"
 
        case YY_END_OF_BUFFER:
                {

diff --git a/src/bin/d2/tests/d2_controller_unittests.cc b/src/bin/d2/tests/d2_controller_unittests.cc
index 600dc8d580effbc703ee0d5184620518c1181d56..3646c7a29e48ea35ea3b9634b6fa98fe6c83c74a 100644 (file)
--- a/src/bin/d2/tests/d2_controller_unittests.cc
+++ b/src/bin/d2/tests/d2_controller_unittests.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2013-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2013-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/d2/tests/d2_simple_parser_unittest.cc b/src/bin/d2/tests/d2_simple_parser_unittest.cc
index 0a6111a0b2791619c79c1ca8537635c4d93ff33a..8e1f4cdf54a4190d641daf0077a10b5e35358783 100644 (file)
--- a/src/bin/d2/tests/d2_simple_parser_unittest.cc
+++ b/src/bin/d2/tests/d2_simple_parser_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2017-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2017-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/dhcp4/dhcp4_lexer.cc b/src/bin/dhcp4/dhcp4_lexer.cc
index 339ed4470a05d21eead2b608eafaf5353e6a64d3..4a63e63b68b3354f10adc23c37039e685f2fb0b8 100644 (file)
--- a/src/bin/dhcp4/dhcp4_lexer.cc
+++ b/src/bin/dhcp4/dhcp4_lexer.cc
@@ -1,6 +1,6 @@
-#line 2 "dhcp4_lexer.cc"
+#line 1 "dhcp4_lexer.cc"
 
-#line 4 "dhcp4_lexer.cc"
+#line 3 "dhcp4_lexer.cc"
 
 #define  YY_INT_ALIGNED short int
 
@@ -2297,7 +2297,7 @@ using namespace isc::dhcp;
 
 /* To avoid the call to exit... oops! */
 #define YY_FATAL_ERROR(msg) isc::dhcp::Parser4Context::fatal(msg)
-#line 2301 "dhcp4_lexer.cc"
+#line 2300 "dhcp4_lexer.cc"
 /* noyywrap disables automatic rewinding for the next file to parse. Since we
    always parse only a single string, there's no need to do any wraps. And
    using yywrap requires linking with -lfl, which provides the default yywrap
@@ -2323,8 +2323,8 @@ using namespace isc::dhcp;
    by moving it ahead by yyleng bytes. yyleng specifies the length of the
    currently matched token. */
 #define YY_USER_ACTION  driver.loc_.columns(yyleng);
+#line 2326 "dhcp4_lexer.cc"
 #line 2327 "dhcp4_lexer.cc"
-#line 2328 "dhcp4_lexer.cc"
 
 #define INITIAL 0
 #define COMMENT 1
@@ -2652,7 +2652,7 @@ YY_DECL
     }
 
 
-#line 2656 "dhcp4_lexer.cc"
+#line 2655 "dhcp4_lexer.cc"
 
        while ( /*CONSTCOND*/1 )                /* loops until end-of-file is reached */
                {
@@ -5980,7 +5980,7 @@ YY_RULE_SETUP
 #line 2631 "dhcp4_lexer.ll"
 ECHO;
        YY_BREAK
-#line 5984 "dhcp4_lexer.cc"
+#line 5983 "dhcp4_lexer.cc"
 
        case YY_END_OF_BUFFER:
                {

diff --git a/src/bin/dhcp4/dhcp4_messages.mes b/src/bin/dhcp4/dhcp4_messages.mes
index 6029e28badf138048e19332551584911ea5826cf..a7b8c02d31816ec3c7330fcf0ea7bcbd620f6a1b 100644 (file)
--- a/src/bin/dhcp4/dhcp4_messages.mes
+++ b/src/bin/dhcp4/dhcp4_messages.mes
@@ -1042,6 +1042,12 @@ supplied its hostname. The first argument includes the client and the
 transaction identification information. The second argument holds the
 generated hostname.
 
+% DHCP4_ROOT_USER_SECURITY_WARNING kea-dhcp4 running as root user!
+This warning is emitted when kea-dhcp4 is running as a root user.
+While the server will function fully, this mode of operation may
+expose your environment to security vulnerabilities and should
+only be used after careful consideration.
+
 % DHCP4_SECURITY_CHECKS_DISABLED Invoked with command line option -X, Security checks are disabled!!
 This warning is emitted when internal security checks normally
 performed by kea-dhcp4 have been disabled via command line option '-X'.
@@ -1190,9 +1196,3 @@ expected: the erroneous response is dropped, the request query is displayed.
 An DHCPOFFER for the 0.0.0.0 address was generated for a client requesting
 the v6-only-preferred (108) option but the option is not in the response as
 expected: the erroneous response is dropped, the discover query is displayed.
-
-% DHCP4_ROOT_USER_SECURITY_WARNING kea-dhcp4 running as root user!
-This warning is emitted when kea-dhcp4 is running as a root user.
-While the server will function fully, this mode of operation may
-expose your environment to security vulnerabilities and should
-only be used after careful consideration.

diff --git a/src/bin/dhcp4/parser_context.cc b/src/bin/dhcp4/parser_context.cc
index 1d61f57df86ec6dd514c6eef900e461caddac7d9..7b3dc546a1d50d65652149cf62fa520c1e78bd43 100644 (file)
--- a/src/bin/dhcp4/parser_context.cc
+++ b/src/bin/dhcp4/parser_context.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2016-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2016-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/dhcp4/parser_context.h b/src/bin/dhcp4/parser_context.h
index 92230af15bc9010a70706fae8e3a28a6c81d25d6..9e39ecec41d8cb865513edcdb1639cc6d85197ec 100644 (file)
--- a/src/bin/dhcp4/parser_context.h
+++ b/src/bin/dhcp4/parser_context.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2015-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2015-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/dhcp4/tests/config_backend_unittest.cc b/src/bin/dhcp4/tests/config_backend_unittest.cc
index dc8f7df2f7c657168ee8acc9acdcea78c19dc4ba..c1703b04bbc9e06319feeeeaf286ecc4a192d145 100644 (file)
--- a/src/bin/dhcp4/tests/config_backend_unittest.cc
+++ b/src/bin/dhcp4/tests/config_backend_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2019-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2019-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/dhcp6/dhcp6_lexer.cc b/src/bin/dhcp6/dhcp6_lexer.cc
index 5e51ba27243427b619121531e950e9e74260f5f2..159c11bdf6649c51dbab3135efe180ef101bd00e 100644 (file)
--- a/src/bin/dhcp6/dhcp6_lexer.cc
+++ b/src/bin/dhcp6/dhcp6_lexer.cc
@@ -1,6 +1,6 @@
-#line 2 "dhcp6_lexer.cc"
+#line 1 "dhcp6_lexer.cc"
 
-#line 4 "dhcp6_lexer.cc"
+#line 3 "dhcp6_lexer.cc"
 
 #define  YY_INT_ALIGNED short int
 
@@ -2266,7 +2266,7 @@ using namespace isc::dhcp;
 
 /* To avoid the call to exit... oops! */
 #define YY_FATAL_ERROR(msg) isc::dhcp::Parser6Context::fatal(msg)
-#line 2270 "dhcp6_lexer.cc"
+#line 2269 "dhcp6_lexer.cc"
 /* noyywrap disables automatic rewinding for the next file to parse. Since we
    always parse only a single string, there's no need to do any wraps. And
    using yywrap requires linking with -lfl, which provides the default yywrap
@@ -2292,8 +2292,8 @@ using namespace isc::dhcp;
    by moving it ahead by yyleng bytes. yyleng specifies the length of the
    currently matched token. */
 #define YY_USER_ACTION  driver.loc_.columns(yyleng);
+#line 2295 "dhcp6_lexer.cc"
 #line 2296 "dhcp6_lexer.cc"
-#line 2297 "dhcp6_lexer.cc"
 
 #define INITIAL 0
 #define COMMENT 1
@@ -2623,7 +2623,7 @@ YY_DECL
     }
 
 
-#line 2627 "dhcp6_lexer.cc"
+#line 2626 "dhcp6_lexer.cc"
 
        while ( /*CONSTCOND*/1 )                /* loops until end-of-file is reached */
                {
@@ -5991,7 +5991,7 @@ YY_RULE_SETUP
 #line 2664 "dhcp6_lexer.ll"
 ECHO;
        YY_BREAK
-#line 5995 "dhcp6_lexer.cc"
+#line 5994 "dhcp6_lexer.cc"
 
        case YY_END_OF_BUFFER:
                {

diff --git a/src/bin/dhcp6/dhcp6_messages.mes b/src/bin/dhcp6/dhcp6_messages.mes
index 49b2689908cef816865b30de36b4048217558a27..760f35e1f7cbe5212307eea3861b4e0f529b5d7b 100644 (file)
--- a/src/bin/dhcp6/dhcp6_messages.mes
+++ b/src/bin/dhcp6/dhcp6_messages.mes
@@ -1060,6 +1060,12 @@ identification information. The second and third argument contains the
 packet name and type respectively. The fourth argument contains detailed
 packet information.
 
+% DHCP6_ROOT_USER_SECURITY_WARNING kea-dhcp6 running as root user!
+This warning is emitted when kea-dhcp6 is running as a root user.
+While the server will function fully, this mode of operation may
+expose your environment to security vulnerabilities and should
+only be used after careful consideration
+
 % DHCP6_SECURITY_CHECKS_DISABLED Invoked with command line option -X, Security checks are disabled!!
 This warning is emitted when internal security checks normally
 performed by kea-dhcp6 have been disabled via command line option '-X'.
@@ -1167,9 +1173,3 @@ such modification. The clients will remember previous server-id, and will
 use it to extend their leases. As a result, they will have to go through
 a rebinding phase to re-acquire their leases and associate them with a
 new server id.
-
-% DHCP6_ROOT_USER_SECURITY_WARNING kea-dhcp6 running as root user!
-This warning is emitted when kea-dhcp6 is running as a root user.
-While the server will function fully, this mode of operation may
-expose your environment to security vulnerabilities and should
-only be used after careful consideration

diff --git a/src/bin/dhcp6/parser_context.cc b/src/bin/dhcp6/parser_context.cc
index ec31d322befc96ce1d2a86a91f512f3cf1ae73d5..ef673f4324357d4965bf39063bd03840d474b551 100644 (file)
--- a/src/bin/dhcp6/parser_context.cc
+++ b/src/bin/dhcp6/parser_context.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2016-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2016-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/dhcp6/parser_context.h b/src/bin/dhcp6/parser_context.h
index 82c61b399fed5871952fd8a8d9055afea3294445..9546da8ceda6c68047a205f5af1d45e3c4799aff 100644 (file)
--- a/src/bin/dhcp6/parser_context.h
+++ b/src/bin/dhcp6/parser_context.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2015-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2015-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/dhcp6/tests/config_backend_unittest.cc b/src/bin/dhcp6/tests/config_backend_unittest.cc
index afc62db890a379078f9f22d6bd0021eaa6d08a1a..ebcc241cb4cb2f3649cd4906a7f6e251f1789dc1 100644 (file)
--- a/src/bin/dhcp6/tests/config_backend_unittest.cc
+++ b/src/bin/dhcp6/tests/config_backend_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2019-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2019-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/bin/netconf/netconf_lexer.cc b/src/bin/netconf/netconf_lexer.cc
index d598a9692bb716945e0b21f15a5f205b8029248a..29b017c513c4d5db24c89f24b9b32adc6aacc744 100644 (file)
--- a/src/bin/netconf/netconf_lexer.cc
+++ b/src/bin/netconf/netconf_lexer.cc
@@ -1474,7 +1474,7 @@ static const flex_int16_t yy_rule_linenum[64] =
 #define YY_RESTORE_YY_MORE_OFFSET
 char *yytext;
 #line 1 "netconf_lexer.ll"
-/* Copyright (C) 2018-2023 Internet Systems Consortium, Inc. ("ISC")
+/* Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 
    This Source Code Form is subject to the terms of the Mozilla Public
    License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/hooks/dhcp/lease_cmds/lease_cmds_messages.mes b/src/hooks/dhcp/lease_cmds/lease_cmds_messages.mes
index 34e023454c35bbc6f92333b770bd8d07168fcb5a..3ce570b49dc460121c3243e982f084b5ae11002f 100644 (file)
--- a/src/hooks/dhcp/lease_cmds/lease_cmds_messages.mes
+++ b/src/hooks/dhcp/lease_cmds/lease_cmds_messages.mes
@@ -105,6 +105,13 @@ This error message indicates an error loading the Lease Commands
 hooks library. The details of the error are provided as argument of
 the log message.
 
+% LEASE_CMDS_PATH_SECURITY_WARNING lease file path specified is NOT SECURE: %1
+This warning message is issued when security enforcement is disabled
+and the path portion of the `filename` parameter of the lease4-write
+or lease6-write command does not comply with the supported path. The
+server will still use the specified path but is warning that doing so
+may pose a security risk.
+
 % LEASE_CMDS_RESEND_DDNS4 lease4-resend-ddns command successful: %1
 A request to update DNS for the requested IPv4 lease has been
 successfully queued for transmission to kea-dhcp-ddns.
@@ -166,10 +173,3 @@ are logged.
 % LEASE_CMDS_WIPE6_FAILED lease6-wipe command failed (parameters: %1, reason: %2)
 The lease6-wipe command has failed. Both the reason as well as the
 parameters passed are logged.
-
-% LEASE_CMDS_PATH_SECURITY_WARNING lease file path specified is NOT SECURE: %1
-This warning message is issued when security enforcement is disabled
-and the path portion of the `filename` parameter of the lease4-write
-or lease6-write command does not comply with the supported path. The
-server will still use the specified path but is warning that doing so
-may pose a security risk.

diff --git a/src/hooks/dhcp/mysql/mysql_cb_dhcp4.h b/src/hooks/dhcp/mysql/mysql_cb_dhcp4.h
index 31e74f89b893ad08b4884e59e452453acb364af0..8f41b4ba612ef18ccbeea52a42b66ac94dc4173f 100644 (file)
--- a/src/hooks/dhcp/mysql/mysql_cb_dhcp4.h
+++ b/src/hooks/dhcp/mysql/mysql_cb_dhcp4.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/hooks/dhcp/mysql/mysql_cb_impl.h b/src/hooks/dhcp/mysql/mysql_cb_impl.h
index 45135942fb8a60e541f1ae00ef6b2a40254319e5..ac19936c8667d3c1a2fa7b091ca24b36150d873d 100644 (file)
--- a/src/hooks/dhcp/mysql/mysql_cb_impl.h
+++ b/src/hooks/dhcp/mysql/mysql_cb_impl.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/hooks/dhcp/mysql/tests/mysql_cb_dhcp4_unittest.cc b/src/hooks/dhcp/mysql/tests/mysql_cb_dhcp4_unittest.cc
index 3e28d98c7b06f17c9e1f3e1a52a88339057bb4b5..bde374537191f0482f8e7dcecbbce5e776759034 100644 (file)
--- a/src/hooks/dhcp/mysql/tests/mysql_cb_dhcp4_unittest.cc
+++ b/src/hooks/dhcp/mysql/tests/mysql_cb_dhcp4_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/hooks/dhcp/pgsql/pgsql_cb_dhcp4.h b/src/hooks/dhcp/pgsql/pgsql_cb_dhcp4.h
index 87f2755ffd4b3ce54bf7de394ffc74317fb4eef4..eea5b9479d92e417eb361836b78feceb50b72e44 100644 (file)
--- a/src/hooks/dhcp/pgsql/pgsql_cb_dhcp4.h
+++ b/src/hooks/dhcp/pgsql/pgsql_cb_dhcp4.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/hooks/dhcp/pgsql/pgsql_cb_impl.h b/src/hooks/dhcp/pgsql/pgsql_cb_impl.h
index c5ae6da35625d03b805405e6bf8912ced390ed08..eccd53a3b9952cfc3b325934f8390d5431ca4487 100644 (file)
--- a/src/hooks/dhcp/pgsql/pgsql_cb_impl.h
+++ b/src/hooks/dhcp/pgsql/pgsql_cb_impl.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/hooks/dhcp/pgsql/tests/pgsql_cb_dhcp4_unittest.cc b/src/hooks/dhcp/pgsql/tests/pgsql_cb_dhcp4_unittest.cc
index 29b231266f2b58a36f3a46f0ccda171ac8deca88..f84b60d33e11c3335e27d5c74bc73458cac3965c 100644 (file)
--- a/src/hooks/dhcp/pgsql/tests/pgsql_cb_dhcp4_unittest.cc
+++ b/src/hooks/dhcp/pgsql/tests/pgsql_cb_dhcp4_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/asiolink/botan_tls.cc b/src/lib/asiolink/botan_tls.cc
index 5a496375ea6633d5b43023c7098c558f493e43f5..d09780ecf6f3007328194deaa287e4631cf7bb7d 100644 (file)
--- a/src/lib/asiolink/botan_tls.cc
+++ b/src/lib/asiolink/botan_tls.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/asiolink/botan_tls.h b/src/lib/asiolink/botan_tls.h
index 1fe694103199e0f429d5fabfc1ed586f1597903d..b7c0b519f0500a75bab2a2f03359ff97b515e893 100644 (file)
--- a/src/lib/asiolink/botan_tls.h
+++ b/src/lib/asiolink/botan_tls.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/cc/data.cc b/src/lib/cc/data.cc
index 66f39869b7b53f91b664d8bef53d1d79ed38dde1..39206122309a12df3a40294bc91ead7251a6c2b7 100644 (file)
--- a/src/lib/cc/data.cc
+++ b/src/lib/cc/data.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2010-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2010-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/config/config_messages.mes b/src/lib/config/config_messages.mes
index c3854e10c019618d6b617dfc598155cfca942790..e686574aeba8045ff54b99431c6563cbbd5a8227 100644 (file)
--- a/src/lib/config/config_messages.mes
+++ b/src/lib/config/config_messages.mes
@@ -48,6 +48,12 @@ Logged at debug log level 10.
 This debug messages is issued when the Command HTTP listener, listening
 at the given address and port, has begun to shutdown.
 
+% COMMAND_HTTP_SOCKET_SECURITY_WARNING command socket configuration is NOT SECURE: %1
+This warning message is issued when security enforcement is disabled
+and command socket configuration does not use HTTPS/TLS or  baseic HTTP
+authentication. The server will still use the socket as configured but
+is warning that doing so may pose a security risk.
+
 % COMMAND_PROCESS_ERROR1 Error while processing command: %1
 This warning message indicates that the server encountered an error while
 processing received command. Additional information will be provided, if
@@ -135,6 +141,18 @@ over command socket identifier by the specified file descriptor.
 This error message indicates that an error was encountered while
 attempting to send a response to the command socket.
 
+% COMMAND_UNIX_SOCKET_PATH_SECURITY_WARNING unix socket path is NOT SECURE: %1
+This warning message is issued when security enforcement is disabled
+and the path specified for a control channel unix socket-name does
+not comply with the supported path. The server will still use the
+specified path but is warning that doing so may pose a security risk.
+
+% COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING unix socket permissions are NOT SECURE: %1
+This warning message is issued when security enforcement is disabled
+and the path specified for a control channel unix socket-name does
+not have the required socket permissions. The server will still use the
+specified path but is warning that doing so may pose a security risk.
+
 % COMMAND_WATCH_SOCKET_CLEAR_ERROR watch socket failed to clear: %1
 This error message is issued when the command manager was unable to reset
 the ready status after completing a send. This is a programmatic error
@@ -180,21 +198,3 @@ control commands.
 % HTTP_COMMAND_MGR_SERVICE_STOPPING Server is stopping %1 service %2
 This informational message indicates that the server has stopped
 HTTP/HTTPS service. When known the address and port are displayed.
-
-% COMMAND_UNIX_SOCKET_PATH_SECURITY_WARNING unix socket path is NOT SECURE: %1
-This warning message is issued when security enforcement is disabled
-and the path specified for a control channel unix socket-name does
-not comply with the supported path. The server will still use the
-specified path but is warning that doing so may pose a security risk.
-
-% COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING unix socket permissions are NOT SECURE: %1
-This warning message is issued when security enforcement is disabled
-and the path specified for a control channel unix socket-name does
-not have the required socket permissions. The server will still use the
-specified path but is warning that doing so may pose a security risk.
-
-% COMMAND_HTTP_SOCKET_SECURITY_WARNING command socket configuration is NOT SECURE: %1
-This warning message is issued when security enforcement is disabled
-and command socket configuration does not use HTTPS/TLS or  baseic HTTP
-authentication. The server will still use the socket as configured but
-is warning that doing so may pose a security risk.

diff --git a/src/lib/config/tests/http_command_response_creator_factory_unittests.cc b/src/lib/config/tests/http_command_response_creator_factory_unittests.cc
index ca656820a47829665934165d945c59f6fce2ece7..71956b1729053a6692d59301084001e5d29d20a8 100644 (file)
--- a/src/lib/config/tests/http_command_response_creator_factory_unittests.cc
+++ b/src/lib/config/tests/http_command_response_creator_factory_unittests.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/config/tests/http_command_response_creator_unittests.cc b/src/lib/config/tests/http_command_response_creator_unittests.cc
index ed9d90b24d7131764099e49f8186679ff0b3371a..9b72d9ddd89ef889fff817049a00404e45f85984 100644 (file)
--- a/src/lib/config/tests/http_command_response_creator_unittests.cc
+++ b/src/lib/config/tests/http_command_response_creator_unittests.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/cryptolink/botan_hmac.cc b/src/lib/cryptolink/botan_hmac.cc
index 058e4d4670d5a4e26eae9839c7eff917867eef4f..6350a9f94d9f102a5a262f5be6e4417f798ce5a2 100644 (file)
--- a/src/lib/cryptolink/botan_hmac.cc
+++ b/src/lib/cryptolink/botan_hmac.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2011-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2011-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/d2srv/d2_config.cc b/src/lib/d2srv/d2_config.cc
index c42b0235d7b81d3e50b73e50b06c978fbd836af3..3bb3bc4dbb742d333c5348d7be24901a1c3de8cd 100644 (file)
--- a/src/lib/d2srv/d2_config.cc
+++ b/src/lib/d2srv/d2_config.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2013-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2013-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/d2srv/d2_messages.mes b/src/lib/d2srv/d2_messages.mes
index d05a79e33321ffb424129f55619e038d0a16b3d7..deebbf7a880871524101eb44ac80a4f134db413d 100644 (file)
--- a/src/lib/d2srv/d2_messages.mes
+++ b/src/lib/d2srv/d2_messages.mes
@@ -446,6 +446,12 @@ message but the attempt to send it suffered an unexpected error. This is most
 likely a programmatic error, rather than a communications issue. Some or all
 of the DNS updates requested as part of this request did not succeed.
 
+% DHCP_DDNS_TSIG_SECRET_SECURITY_WARNING use of clear text TSIG 'secret' is NOT SECURE: %1
+This warning message is issued when security enforcement is disabled
+and TSIG key configuration uses clear text 'secret' rather
+than 'secret-file'. The server will still use the key as configured
+but is warning that doing so may pose a security risk.
+
 % DHCP_DDNS_UPDATE_REQUEST_SENT Request ID %1: %2 to server: %3
 Logged at debug log level 50.
 This is a debug message issued when DHCP_DDNS sends a DNS request to a DNS
@@ -455,9 +461,3 @@ server.
 Logged at debug log level 50.
 This is a debug message issued when DHCP_DDNS receives sends a DNS update
 response from a DNS server.
-
-% DHCP_DDNS_TSIG_SECRET_SECURITY_WARNING use of clear text TSIG 'secret' is NOT SECURE: %1 
-This warning message is issued when security enforcement is disabled
-and TSIG key configuration uses clear text 'secret' rather
-than 'secret-file'. The server will still use the key as configured
-but is warning that doing so may pose a security risk.

diff --git a/src/lib/database/dbaccess_parser.cc b/src/lib/database/dbaccess_parser.cc
index d5bd2f1e9426a1e102a06e7cdb6850c0749985f4..6b6950463866980d8913fe73465ca9140dac20a6 100644 (file)
--- a/src/lib/database/dbaccess_parser.cc
+++ b/src/lib/database/dbaccess_parser.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2012-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2012-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcp/classify.h b/src/lib/dhcp/classify.h
index 6e827c034de79b3a0fd8ee3422b3f3742efdc44a..ff421ad2d76134cc965e2572ec7f9e75f0f6bb20 100644 (file)
--- a/src/lib/dhcp/classify.h
+++ b/src/lib/dhcp/classify.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2014-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2014-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcp/tests/classify_unittest.cc b/src/lib/dhcp/tests/classify_unittest.cc
index 6253167c914ed0f54167b1b2e713009f9f7068a1..4c8d687bcbaa0ddfe44193e4a14c61aabef2abf8 100644 (file)
--- a/src/lib/dhcp/tests/classify_unittest.cc
+++ b/src/lib/dhcp/tests/classify_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2011-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2011-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/cb_ctl_dhcp.h b/src/lib/dhcpsrv/cb_ctl_dhcp.h
index 66aa1e3600df4719dbd5af5f1f79e4744a4bd700..c24aa950e4b9a4dde8c9469c8427914b656d6701 100644 (file)
--- a/src/lib/dhcpsrv/cb_ctl_dhcp.h
+++ b/src/lib/dhcpsrv/cb_ctl_dhcp.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2019-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2019-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/cb_ctl_dhcp4.cc b/src/lib/dhcpsrv/cb_ctl_dhcp4.cc
index dadc5c3f5f0475b1d4ff8a34326dcb6e0dc4c4b4..8e92fa1847e546be74bf8d766921234ebcea7891 100644 (file)
--- a/src/lib/dhcpsrv/cb_ctl_dhcp4.cc
+++ b/src/lib/dhcpsrv/cb_ctl_dhcp4.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2019-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2019-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/cb_ctl_dhcp6.cc b/src/lib/dhcpsrv/cb_ctl_dhcp6.cc
index 6aa9b02631170ce91e28aee3130553654019c54d..381c60d2ccdebe26cd217fb7063ee2b8ad8d7f6c 100644 (file)
--- a/src/lib/dhcpsrv/cb_ctl_dhcp6.cc
+++ b/src/lib/dhcpsrv/cb_ctl_dhcp6.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2019-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2019-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/cfg_globals.cc b/src/lib/dhcpsrv/cfg_globals.cc
index 076d802174a2d53d97cc36443023ab56001a7e63..e9824f75dbae9d28577019d74a63c41415845212 100644 (file)
--- a/src/lib/dhcpsrv/cfg_globals.cc
+++ b/src/lib/dhcpsrv/cfg_globals.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/cfg_globals.h b/src/lib/dhcpsrv/cfg_globals.h
index 33c938805371bb97e7f0c2b804cdf81c509b9ff4..f064cc933c5d326169593ceb0aae30a8b2652724 100644 (file)
--- a/src/lib/dhcpsrv/cfg_globals.h
+++ b/src/lib/dhcpsrv/cfg_globals.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/cfg_option.cc b/src/lib/dhcpsrv/cfg_option.cc
index 428a4f114dbe2f33b4a14f35fe67d873cc70e2d7..b725c2c3f0adbc855ed015f97b22fd4b4486d17e 100644 (file)
--- a/src/lib/dhcpsrv/cfg_option.cc
+++ b/src/lib/dhcpsrv/cfg_option.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2014-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2014-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/config_backend_dhcp4.h b/src/lib/dhcpsrv/config_backend_dhcp4.h
index 6ca3fee44180899ff144db9f4a11f34995f6063a..fe2520bf87bfb2ff97649a7e7abf902e88bac9d3 100644 (file)
--- a/src/lib/dhcpsrv/config_backend_dhcp4.h
+++ b/src/lib/dhcpsrv/config_backend_dhcp4.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2021 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/config_backend_pool_dhcp4.cc b/src/lib/dhcpsrv/config_backend_pool_dhcp4.cc
index 460328b90bf046164320346a0d29aac34289bc57..a6c2cf397c182160f4fbca3c4d39b590576c50eb 100644 (file)
--- a/src/lib/dhcpsrv/config_backend_pool_dhcp4.cc
+++ b/src/lib/dhcpsrv/config_backend_pool_dhcp4.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2021 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/config_backend_pool_dhcp4.h b/src/lib/dhcpsrv/config_backend_pool_dhcp4.h
index 72aa94a6fd4f132a8864d1714a5a26febefde866..b292c1e3b015ae0759ad424434771cfef63e43ee 100644 (file)
--- a/src/lib/dhcpsrv/config_backend_pool_dhcp4.h
+++ b/src/lib/dhcpsrv/config_backend_pool_dhcp4.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2022 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/dhcpsrv_messages.mes b/src/lib/dhcpsrv/dhcpsrv_messages.mes
index 6e6dc5a72f7e295b0e6b157205902cc18c3f9629..6036d72c8dd1831f8734a6ae8bd66794f14ea672 100644 (file)
--- a/src/lib/dhcpsrv/dhcpsrv_messages.mes
+++ b/src/lib/dhcpsrv/dhcpsrv_messages.mes
@@ -789,6 +789,12 @@ testing but should not be enabled in normal circumstances. Non-persistence
 mode is enabled when 'persist4=no persist6=no' parameters are specified
 in the database access string.
 
+% DHCPSRV_MEMFILE_PATH_SECURITY_WARNING Lease file path specified is NOT SECURE: %1
+This warning message is issued when security enforcement is
+disabled and the lease file path specified for does not comply
+with the supported path. The server will still use the specified
+path but is warning that doing so may pose a security risk.
+
 % DHCPSRV_MEMFILE_READ_HWADDR_FAIL failed to read hardware address from lease file: %1
 A warning message issued when read attempt of the hardware address stored in
 a disk file failed. The parameter should provide the exact nature of the failure.
@@ -1003,12 +1009,6 @@ included in the message.
 The database access string specified a database type (given in the
 message) that is unknown to the software. This is a configuration error.
 
-% DHCPSRV_MEMFILE_PATH_SECURITY_WARNING Lease file path specified is NOT SECURE: %1
-This warning message is issued when security enforcement is
-disabled and the lease file path specified for does not comply
-with the supported path. The server will still use the specified
-path but is warning that doing so may pose a security risk.
-
 % LEGAL_LOG_PATH_SECURITY_WARNING Forensic log path specified is NOT SECURE: %1
 This warning message is issued when security enforcement is
 disabled and the path specified for forensic logging output

diff --git a/src/lib/dhcpsrv/parsers/host_reservation_parser.cc b/src/lib/dhcpsrv/parsers/host_reservation_parser.cc
index 0196aab9935d4ada405f8d33b636e573f17afea0..ceab2a13aef19c1aefddf3ccaa4fdd09b2765191 100644 (file)
--- a/src/lib/dhcpsrv/parsers/host_reservation_parser.cc
+++ b/src/lib/dhcpsrv/parsers/host_reservation_parser.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2014-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2014-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/parsers/host_reservation_parser.h b/src/lib/dhcpsrv/parsers/host_reservation_parser.h
index 202ba38235d8c909e334427b925dc5192312ad9d..5366a8a603be910fe920f0c02bc50adfcb1c3083 100644 (file)
--- a/src/lib/dhcpsrv/parsers/host_reservation_parser.h
+++ b/src/lib/dhcpsrv/parsers/host_reservation_parser.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2014-2023 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2014-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/parsers/option_data_parser.cc b/src/lib/dhcpsrv/parsers/option_data_parser.cc
index 5be8fe78acd5c0938d790467982cf2a000764224..bc20940abca729e4367f7566e280aa7d6cd98024 100644 (file)
--- a/src/lib/dhcpsrv/parsers/option_data_parser.cc
+++ b/src/lib/dhcpsrv/parsers/option_data_parser.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2017-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2017-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/parsers/simple_parser4.h b/src/lib/dhcpsrv/parsers/simple_parser4.h
index 614fa319fe29a6071e9b5adda657bd6d891ed792..3cc2086385cabb1f7d63329b792ec93bbd7f8203 100644 (file)
--- a/src/lib/dhcpsrv/parsers/simple_parser4.h
+++ b/src/lib/dhcpsrv/parsers/simple_parser4.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2016-2020 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2016-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/parsers/simple_parser6.h b/src/lib/dhcpsrv/parsers/simple_parser6.h
index b7e504bb4cae7654867ca7eea296f47a971e1f8c..03f776281e8e048bd06f3abbf7b64aead2c3ab34 100644 (file)
--- a/src/lib/dhcpsrv/parsers/simple_parser6.h
+++ b/src/lib/dhcpsrv/parsers/simple_parser6.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2016-2020 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2016-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/tests/host_reservation_parser_unittest.cc b/src/lib/dhcpsrv/tests/host_reservation_parser_unittest.cc
index 5a793424d2af9ef9f0b0b635d7d006ead7c4d4b7..b20397ce2244dc3a61b084a95ac52f6a99bb1155 100644 (file)
--- a/src/lib/dhcpsrv/tests/host_reservation_parser_unittest.cc
+++ b/src/lib/dhcpsrv/tests/host_reservation_parser_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2014-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2014-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/testutils/generic_backend_unittest.h b/src/lib/dhcpsrv/testutils/generic_backend_unittest.h
index 94bf7cece1503281bd3323094e4f4560eeaedbab..2e4d297caffc84c3c58e86583cf64b506b5a79a9 100644 (file)
--- a/src/lib/dhcpsrv/testutils/generic_backend_unittest.h
+++ b/src/lib/dhcpsrv/testutils/generic_backend_unittest.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2023 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/testutils/generic_cb_dhcp4_unittest.h b/src/lib/dhcpsrv/testutils/generic_cb_dhcp4_unittest.h
index 71a2ccfa56591ae5d1be9a6e3164e3b8b8ca9ed4..4a89d5cd8953f79c91471bd55604bf1fb40f6c0f 100644 (file)
--- a/src/lib/dhcpsrv/testutils/generic_cb_dhcp4_unittest.h
+++ b/src/lib/dhcpsrv/testutils/generic_cb_dhcp4_unittest.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2022-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2022-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/testutils/generic_host_data_source_unittest.cc b/src/lib/dhcpsrv/testutils/generic_host_data_source_unittest.cc
index 74703258d1e7658e562c5b252b434cde7eb62301..c9c0e3c5e3e6fe43495e66c4b7fca3a05a373ba7 100644 (file)
--- a/src/lib/dhcpsrv/testutils/generic_host_data_source_unittest.cc
+++ b/src/lib/dhcpsrv/testutils/generic_host_data_source_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2015-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2015-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/testutils/host_data_source_utils.cc b/src/lib/dhcpsrv/testutils/host_data_source_utils.cc
index c3b1f45a21a360d1650b73921d852d6650938022..c2df7bcb9add799c078147ef6ca0c0bb8ac34281 100644 (file)
--- a/src/lib/dhcpsrv/testutils/host_data_source_utils.cc
+++ b/src/lib/dhcpsrv/testutils/host_data_source_utils.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2024 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/dhcpsrv/testutils/test_config_backend_dhcp4.h b/src/lib/dhcpsrv/testutils/test_config_backend_dhcp4.h
index fe8dbf1dc927a5087192008be8c5e26bc459d962..baed8fd8bbb4f546417426fd76a905ccbad998cf 100644 (file)
--- a/src/lib/dhcpsrv/testutils/test_config_backend_dhcp4.h
+++ b/src/lib/dhcpsrv/testutils/test_config_backend_dhcp4.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2021 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2018-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/eval/lexer.cc b/src/lib/eval/lexer.cc
index 00c30411dee49371920c142556b50462f54edb94..1c9707c03bfd4e2c3246b3a16444e83ea2c98140 100644 (file)
--- a/src/lib/eval/lexer.cc
+++ b/src/lib/eval/lexer.cc
@@ -1,6 +1,6 @@
-#line 2 "lexer.cc"
+#line 1 "lexer.cc"
 
-#line 4 "lexer.cc"
+#line 3 "lexer.cc"
 
 #define  YY_INT_ALIGNED short int
 
@@ -1055,7 +1055,7 @@ namespace {
 
 /* To avoid the call to exit... oops! */
 #define YY_FATAL_ERROR(msg) isc::eval::EvalContext::fatal(msg)
-#line 1059 "lexer.cc"
+#line 1058 "lexer.cc"
 /* noyywrap disables automatic rewinding for the next file to parse. Since we
    always parse only a single string, there's no need to do any wraps. And
    using yywrap requires linking with -lfl, which provides the default yywrap
@@ -1080,8 +1080,8 @@ namespace {
    by moving it ahead by yyleng bytes. yyleng specifies the length of the
    currently matched token. */
 #define YY_USER_ACTION  loc.columns(evalleng);
+#line 1083 "lexer.cc"
 #line 1084 "lexer.cc"
-#line 1085 "lexer.cc"
 
 #define INITIAL 0
 
@@ -1380,7 +1380,7 @@ YY_DECL
 
 
 
-#line 1384 "lexer.cc"
+#line 1383 "lexer.cc"
 
        while ( /*CONSTCOND*/1 )                /* loops until end-of-file is reached */
                {
@@ -1889,7 +1889,7 @@ YY_RULE_SETUP
 #line 251 "lexer.ll"
 ECHO;
        YY_BREAK
-#line 1893 "lexer.cc"
+#line 1892 "lexer.cc"
 
        case YY_END_OF_BUFFER:
                {

diff --git a/src/lib/hooks/hooks_messages.mes b/src/lib/hooks/hooks_messages.mes
index 9cb191f176bb48aff32a3feef3031f563314f47b..27b288c6e55aaa7c29f523089389fdf58ad8cf81 100644 (file)
--- a/src/lib/hooks/hooks_messages.mes
+++ b/src/lib/hooks/hooks_messages.mes
@@ -1,4 +1,4 @@
-# Copyright (C) 2013-2024 Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2013-2025 Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -86,6 +86,13 @@ This is most likely due to the installation of a new version of Kea
 without rebuilding the hook library.  A rebuild and re-install of the
 library should fix the problem in most cases.
 
+% HOOKS_LIBPATH_SECURITY_WARNING Library path specified is NOT SECURE: %1
+This warning message is issued when security enforcement is
+disabled and the library path specified for a given hook library
+does not comply with the supported path. The server will still load
+the hook library but is warning that doing so may pose a security
+risk.
+
 % HOOKS_LIBRARY_CLOSED hooks library %1 successfully closed
 This information message is issued when a user-supplied hooks library
 has been successfully closed.
@@ -215,10 +222,3 @@ in a hook library during the unload process, called, and returned success.
 This error message is issued if the version() function in the specified
 hooks library was called and generated an exception.  The library is
 considered unusable and will not be loaded.
-
-% HOOKS_LIBPATH_SECURITY_WARNING Library path specified is NOT SECURE: %1
-This warning message is issued when security enforcement is
-disabled and the library path specified for a given hook library
-does not comply with the supported path. The server will still load
-the hook library but is warning that doing so may pose a security
-risk.

diff --git a/src/lib/http/auth_messages.mes b/src/lib/http/auth_messages.mes
index d7ea4c11f22a36f1b85461f131e1d6a6cc68e434..af4cce9aeae33839b0d3f5094b2d9606ba1247ef 100644 (file)
--- a/src/lib/http/auth_messages.mes
+++ b/src/lib/http/auth_messages.mes
@@ -1,4 +1,4 @@
-# Copyright (C) 2021 Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2021-2025 Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -6,6 +6,12 @@
 
 $NAMESPACE isc::http
 
+% HTTP_CLIENT_PASSWORD_SECURITY_WARNING use of clear text 'password' is NOT SECURE: %1
+This warning message is issued when security enforcement is disabled
+and command socket configuration uses clear text 'password' rather
+than 'password-file'. The server will still use the socket as configured
+but is warning that doing so may pose a security risk.
+
 % HTTP_CLIENT_REQUEST_AUTHORIZED received HTTP request authorized for '%1'
 This information message is issued when the server receives with a matching
 authentication header. The argument provides the user id.
@@ -23,12 +29,6 @@ provided incorrect user id and/or password.
 This information message is issued when the server receives a request without
 a required authentication header.
 
-% HTTP_CLIENT_PASSWORD_SECURITY_WARNING use of clear text 'password' is NOT SECURE: %1
-This warning message is issued when security enforcement is disabled
-and command socket configuration uses clear text 'password' rather
-than 'password-file'. The server will still use the socket as configured
-but is warning that doing so may pose a security risk.
-
 % HTTP_CLIENT_USER_SECURITY_WARNING use of clear text 'user' is NOT SECURE: %1
 This warning message is issued when security enforcement is disabled
 and command socket configuration uses clear text 'user' rather

diff --git a/src/lib/pgsql/testutils/pgsql_schema.cc b/src/lib/pgsql/testutils/pgsql_schema.cc
index 1123137ab545b6b7dcac9dcd1720951f23fcd29e..3a8000f3bcdcddd5780cdd28331ba143ecd2b049 100644 (file)
--- a/src/lib/pgsql/testutils/pgsql_schema.cc
+++ b/src/lib/pgsql/testutils/pgsql_schema.cc
@@ -1,4 +1,4 @@
-// Copyright (C) 2016-2022 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2016-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/pgsql/testutils/pgsql_schema.h b/src/lib/pgsql/testutils/pgsql_schema.h
index 22a796c649417c3b79032b43628cef67c883bba3..4c8d73ad9961324ac7edc4ec20a48862b02a044a 100644 (file)
--- a/src/lib/pgsql/testutils/pgsql_schema.h
+++ b/src/lib/pgsql/testutils/pgsql_schema.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2016-2022 Internet Systems Consortium, Inc. ("ISC")
+// Copyright (C) 2016-2025 Internet Systems Consortium, Inc. ("ISC")
 //
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this

diff --git a/src/lib/process/process_messages.mes b/src/lib/process/process_messages.mes
index 2d34581285fb0f9b9c311fc255fe708d9ac54d2d..61db825adcaac08e0cb4c78d0d444eab72639f6e 100644 (file)
--- a/src/lib/process/process_messages.mes
+++ b/src/lib/process/process_messages.mes
@@ -78,6 +78,13 @@ to create and initialize its application instance.
 This error message is issued if the controller could not initialize the
 application and will exit.
 
+% DCTL_LOG_PATH_SECURITY_WARNING Log output path specified is NOT SECURE: %1
+This warning message is issued when security enforcement is
+disabled and the output path specified for a given logger does
+not comply with the supported path. The server will still
+use the specified path but is warning that doing so may pose a
+security risk.
+
 % DCTL_NOT_RUNNING %1 application instance is not running
 A warning message is issued when an attempt is made to shut down the
 application when it is not running.
@@ -107,6 +114,12 @@ The controller has encountered a fatal error while running the
 application and is terminating. The reason for the failure is
 included in the message.
 
+% DCTL_ROOT_USER_SECURITY_WARNING %1 running as root user!
+This warning is emitted when the server is running as a root user.
+While the server will function fully, this mode of operation may
+expose your environment to security vulnerabilities and should
+only be used after careful consideration.
+
 % DCTL_RUN_PROCESS %1 starting application event loop
 Logged at debug log level 0.
 This debug message is issued just before the controller invokes
@@ -145,16 +158,3 @@ This is a debug message indicating that the application received an
 unsupported signal.  This is a programming error indicating that the
 application has registered to receive the signal but no associated
 processing logic has been added.
-
-% DCTL_LOG_PATH_SECURITY_WARNING Log output path specified is NOT SECURE: %1
-This warning message is issued when security enforcement is
-disabled and the output path specified for a given logger does
-not comply with the supported path. The server will still
-use the specified path but is warning that doing so may pose a
-security risk.
-
-% DCTL_ROOT_USER_SECURITY_WARNING %1 running as root user!
-This warning is emitted when the server is running as a root user.
-While the server will function fully, this mode of operation may
-expose your environment to security vulnerabilities and should
-only be used after careful consideration.