1. 05 Sep, 2018 1 commit
  2. 04 Sep, 2018 1 commit
  3. 03 Sep, 2018 1 commit
  4. 31 Aug, 2018 3 commits
  5. 29 Aug, 2018 2 commits
  6. 28 Aug, 2018 11 commits
  7. 27 Aug, 2018 2 commits
  8. 25 Aug, 2018 1 commit
  9. 22 Aug, 2018 3 commits
    • Michał Kępień's avatar
      Fix reloading inline-signed zones · 54315839
      Michał Kępień authored
      While "rndc reload" causes dns_zone_asyncload() to be called for the
      signed version of an inline-signed zone, the subsequent zone_load() call
      causes the raw version to be reloaded from storage.  This means that
      DNS_ZONEFLG_LOADPENDING gets set for the signed version of the zone by
      dns_zone_asyncload() before the reload is attempted, but zone_postload()
      is only called for the raw version and thus DNS_ZONEFLG_LOADPENDING is
      cleared for the raw version, but not for the signed version.  This in
      turn prevents zone maintenance from happening for the signed version of
      the zone.
      
      Until commit 29b7efdd, this problem
      remained dormant because DNS_ZONEFLG_LOADPENDING was previously
      immediately, unconditionally cleared after zone loading was started
      (whereas it should only be cleared when zone loading is finished or an
      error occurs).  This behavior caused other issues [1] and thus had to be
      changed.
      
      Fix reloading inline-signed zones by clearing DNS_ZONEFLG_LOADPENDING
      for the signed version of the zone once the raw version reload
      completes.  Take care not to clear it prematurely during initial zone
      load.  Also make sure that DNS_ZONEFLG_LOADPENDING gets cleared when
      zone_postload() encounters an error or returns early, to prevent other
      scenarios from resulting in the same problem.  Add comments aiming to
      help explain code flow.
      
      [1] see RT #47076
      54315839
    • Michał Kępień's avatar
      Set DNS_JOURNALOPT_RESIGN when loading the secure journal for an inline-signed zone · 8db550c4
      Michał Kępień authored
      When an inline-signed zone is loaded, the master file for its signed
      version is loaded and then a rollforward of the journal for the signed
      version of the zone is performed.  If DNS_JOURNALOPT_RESIGN is not set
      during the latter phase, signatures loaded from the journal for the
      signed version of the zone will not be scheduled for refresh.  Fix the
      conditional expression determining which flags should be used for the
      dns_journal_rollforward() call so that DNS_JOURNALOPT_RESIGN is set when
      zone_postload() is called for the signed version of an inline-signed
      zone.
      
      Extend bin/tests/system/stop.pl so that it can use "rndc halt" instead
      of "rndc stop" as the former allows master file flushing upon shutdown
      to be suppressed.
      8db550c4
    • Michał Kępień's avatar
      Do not treat a referral with a non-empty ANSWER section as an error · 24b9ec55
      Michał Kępień authored
      As part of resquery_response() refactoring [1], a goto statement was
      replaced [2] with a call to a new function - originally called
      rctx_delegation(), now folded into rctx_answer_none() - extracted from
      existing code.  However, one call site of that refactored function does
      not reset the "result" variable, causing a referral with a non-empty
      ANSWER section to be inadvertently treated as an error, which prevents
      resolution of names reliant on servers sending such responses.  Fix by
      resetting the "result" variable to ISC_R_SUCCESS when a response
      containing a non-empty ANSWER section can be treated as a delegation.
      
      [1] see RT #45362
      
      [2] see commit e1380a16741a3b4a57e54d7a9ce09dd12691522f
      24b9ec55
  10. 16 Aug, 2018 2 commits
  11. 14 Aug, 2018 5 commits
    • Evan Hunt's avatar
      option to disable validation under specified names · eaac2057
      Evan Hunt authored
      - added new 'validate-except' option, which configures an NTA with
        expiry of 0xffffffff.  NTAs with that value in the expiry field do not
        expire, are are not written out when saving the NTA table and are not
        dumped by rndc secroots
      eaac2057
    • Mark Andrews's avatar
      add missing ATF_REQUIRE · 0ce82e9d
      Mark Andrews authored
      0ce82e9d
    • Michał Kępień's avatar
      Do not remove errors from the OpenSSL error queue in toresult() · fe20f8fe
      Michał Kępień authored
      dst__openssl_toresult3() first calls toresult() and subsequently uses
      ERR_get_error_line_data() in a loop.  Given this, it is a mistake to use
      ERR_get_error() in toresult() because it causes the retrieved error to
      be removed from the OpenSSL error queue, thus preventing it from being
      retrieved by the subsequent ERR_get_error_line_data() calls.  Fix by
      using ERR_peek_error() instead of ERR_get_error() in toresult().
      fe20f8fe
    • Michał Kępień's avatar
      Prevent rare rbt_insert_and_remove unit test failures · 13fe7637
      Michał Kępień authored
      When two or more absolute, two-label names are added to a completely
      empty RBT, an extra, empty node for the root name will be created due to
      node splitting.  check_tree() expects that, but the extra node will not
      be created when just one name is added to a completely empty RBT.  This
      problem could be handled inside check_tree(), but that would introduce
      unnecessary complexity into it since adding a single name will result in
      a different node count for a completely empty RBT (node count will be 1)
      and an RBT containing only an empty node for the root name, created due
      to prior node splitting (node count will be 2).  Thus, first explicitly
      create a node for the root name to prevent rare check_tree() failures
      caused by a single name being added in the first iteration of the
      insert/remove loop.
      13fe7637
    • Michał Kępień's avatar
      Queue "rndc signing -nsec3param ..." requests if needed · cb40c522
      Michał Kępień authored
      If "rndc signing -nsec3param ..." is ran for a zone which has not yet
      been loaded or transferred (i.e. its "db" field is NULL), it will be
      silently ignored by named despite rndc logging an "nsec3param request
      queued" message, which is misleading.  Prevent this by keeping a
      per-zone queue of NSEC3PARAM change requests which arrive before a zone
      is loaded or transferred and processing that queue once the raw version
      of an inline-signed zone becomes available.
      cb40c522
  12. 10 Aug, 2018 1 commit
  13. 08 Aug, 2018 7 commits