1. 05 Jun, 2018 1 commit
  2. 04 Jun, 2018 1 commit
  3. 31 May, 2018 3 commits
    • Evan Hunt's avatar
      update system tests so validation won't fail when using IANA key · a7a2fa29
      Evan Hunt authored
      - all tests with "recursion yes" now also specify "dnssec-validation yes",
        and all tests with "recursion no" also specify "dnssec-validation no".
        this must be maintained in all new tests, or else validation will fail
        when we use local root zones for testing.
      - clean.sh has been modified where necessary to remove managed-keys.bind
        and viewname.mkeys files.
      a7a2fa29
    • Evan Hunt's avatar
      Set "dnssec-validation auto" by default · bef18eca
      Evan Hunt authored
      - the default setting for dnssec-validation is now "auto", which
        activates DNSSEC validation using the IANA root key.  The old behavior
        can be restored by explicitly setting "dnssec-validation yes", which
        "yes", which activates DNSSEC validation only if keys are explicitly
        configured in named.conf.
      - the ARM has been updated to describe the new behavior
      bef18eca
    • Ondřej Surý's avatar
  4. 30 May, 2018 1 commit
  5. 29 May, 2018 1 commit
    • Ondřej Surý's avatar
      Change isc_random() to be just PRNG, and add isc_nonce_buf() that uses CSPRNG · 99ba29bc
      Ondřej Surý authored
      This commit reverts the previous change to use system provided
      entropy, as (SYS_)getrandom is very slow on Linux because it is
      a syscall.
      
      The change introduced in this commit adds a new call isc_nonce_buf
      that uses CSPRNG from cryptographic library provider to generate
      secure data that can be and must be used for generating nonces.
      Example usage would be DNS cookies.
      
      The isc_random() API has been changed to use fast PRNG that is not
      cryptographically secure, but runs entirely in user space.  Two
      contestants have been considered xoroshiro family of the functions
      by Villa&Blackman and PCG by O'Neill.  After a consideration the
      xoshiro128starstar function has been used as uint32_t random number
      provider because it is very fast and has good enough properties
      for our usage pattern.
      
      The other change introduced in the commit is the more extensive usage
      of isc_random_uniform in places where the usage pattern was
      isc_random() % n to prevent modulo bias.  For usage patterns where
      only 16 or 8 bits are needed (DNS Message ID), the isc_random()
      functions has been renamed to isc_random32(), and isc_random16() and
      isc_random8() functions have been introduced by &-ing the
      isc_random32() output with 0xffff and 0xff.  Please note that the
      functions that uses stripped down bit count doesn't pass our
      NIST SP 800-22 based random test.
      99ba29bc
  6. 26 May, 2018 1 commit
    • Evan Hunt's avatar
      clarify serve-stale documentation, and add a floor for max-stale-ttl · d1ca21d5
      Evan Hunt authored
      - added a 1-second floor to max-stale-ttl similar to stale-answer-ttl;
        if set to 0, it will be silently updated to 1.
      - fixed the ARM entry on max-stale-ttl, which incorrectly suggested that
        the default was 0 instead of 1 week.
      - clarified rndc serve-stale documentation.
      d1ca21d5
  7. 25 May, 2018 2 commits
    • Evan Hunt's avatar
      1e31fdb7
    • Evan Hunt's avatar
      remove the experimental authoritative ECS support from named · e3244493
      Evan Hunt authored
      - mark the 'geoip-use-ecs' option obsolete; warn when it is used
        in named.conf
      - prohibit 'ecs' ACL tags in named.conf; note that this is a fatal error
        since simply ignoring the tags could make ACLs behave unpredictably
      - re-simplify the radix and iptable code
      - clean up dns_acl_match(), dns_aclelement_match(), dns_acl_allowed()
        and dns_geoip_match() so they no longer take ecs options
      - remove the ECS-specific unit and system test cases
      - remove references to ECS from the ARM
      e3244493
  8. 24 May, 2018 1 commit
  9. 23 May, 2018 3 commits
  10. 22 May, 2018 3 commits
  11. 21 May, 2018 1 commit
  12. 18 May, 2018 1 commit
  13. 16 May, 2018 5 commits
  14. 14 May, 2018 1 commit
  15. 11 May, 2018 3 commits
  16. 10 May, 2018 2 commits
  17. 03 May, 2018 5 commits
  18. 27 Apr, 2018 2 commits
  19. 25 Apr, 2018 1 commit
    • Michał Kępień's avatar
      Apply raw zone deltas to yet unsigned secure zones · 6acf3269
      Michał Kępień authored
      When inline signing is enabled for a zone without creating signing keys
      for it, changes subsequently applied to the raw zone will not be
      reflected in the secure zone due to the dns_update_signaturesinc() call
      inside receive_secure_serial() failing.  Given that an inline zone will
      be served (without any signatures) even with no associated signing keys
      being present, keep applying raw zone deltas to the secure zone until
      keys become available in an attempt to follow the principle of least
      astonishment.
      6acf3269
  20. 20 Apr, 2018 2 commits