1. 20 May, 2019 1 commit
    • Ondřej Surý's avatar
      Make lib/isc/app.c opaque and thread-safe · eb8c9bdd
      Ondřej Surý authored
      This work cleans up the API which includes couple of things:
      
      1. Make the isc_appctx_t type fully opaque
      
      2. Protect all access to the isc_app_t members via stdatomics
      
      3. sigwait() is part of POSIX.1, remove dead non-sigwait code
      
      4. Remove unused code: isc_appctx_set{taskmgr,sockmgr,timermgr}
      eb8c9bdd
  2. 08 Mar, 2019 1 commit
  3. 08 Aug, 2018 2 commits
  4. 19 Jul, 2018 1 commit
  5. 29 May, 2018 1 commit
    • Ondřej Surý's avatar
      Change isc_random() to be just PRNG, and add isc_nonce_buf() that uses CSPRNG · 99ba29bc
      Ondřej Surý authored
      This commit reverts the previous change to use system provided
      entropy, as (SYS_)getrandom is very slow on Linux because it is
      a syscall.
      
      The change introduced in this commit adds a new call isc_nonce_buf
      that uses CSPRNG from cryptographic library provider to generate
      secure data that can be and must be used for generating nonces.
      Example usage would be DNS cookies.
      
      The isc_random() API has been changed to use fast PRNG that is not
      cryptographically secure, but runs entirely in user space.  Two
      contestants have been considered xoroshiro family of the functions
      by Villa&Blackman and PCG by O'Neill.  After a consideration the
      xoshiro128starstar function has been used as uint32_t random number
      provider because it is very fast and has good enough properties
      for our usage pattern.
      
      The other change introduced in the commit is the more extensive usage
      of isc_random_uniform in places where the usage pattern was
      isc_random() % n to prevent modulo bias.  For usage patterns where
      only 16 or 8 bits are needed (DNS Message ID), the isc_random()
      functions has been renamed to isc_random32(), and isc_random16() and
      isc_random8() functions have been introduced by &-ing the
      isc_random32() output with 0xffff and 0xff.  Please note that the
      functions that uses stripped down bit count doesn't pass our
      NIST SP 800-22 based random test.
      99ba29bc
  6. 16 May, 2018 1 commit
    • Ondřej Surý's avatar
      Replace all random functions with isc_random, isc_random_buf and isc_random_uniform API. · 3a4f820d
      Ondřej Surý authored
      The three functions has been modeled after the arc4random family of
      functions, and they will always return random bytes.
      
      The isc_random family of functions internally use these CSPRNG (if available):
      
      1. getrandom() libc call (might be available on Linux and Solaris)
      2. SYS_getrandom syscall (might be available on Linux, detected at runtime)
      3. arc4random(), arc4random_buf() and arc4random_uniform() (available on BSDs and Mac OS X)
      4. crypto library function:
      4a. RAND_bytes in case OpenSSL
      4b. pkcs_C_GenerateRandom() in case PKCS#11 library
      3a4f820d
  7. 11 May, 2018 1 commit
  8. 23 Feb, 2018 1 commit
  9. 18 Jan, 2018 2 commits
  10. 01 Dec, 2017 1 commit
  11. 05 Sep, 2017 1 commit
  12. 29 Aug, 2017 1 commit
  13. 05 Jan, 2017 1 commit
  14. 04 Jan, 2017 1 commit
    • Evan Hunt's avatar
      [master] EDNS padding and keepalive support · 58043325
      Evan Hunt authored
      4549.	[func]		Added support for the EDNS TCP Keepalive option
      			(RFC 7828). [RT #42126]
      
      4548.	[func]		Added support for the EDNS Padding option (RFC 7830).
      			[RT #42094]
      58043325
  15. 28 Sep, 2016 1 commit
  16. 23 Aug, 2016 1 commit
  17. 18 Aug, 2016 1 commit
  18. 15 Aug, 2016 1 commit
  19. 27 Jun, 2016 1 commit
  20. 18 Feb, 2016 2 commits
  21. 27 Aug, 2015 1 commit
  22. 21 Jul, 2015 1 commit
    • Mukund Sivaraman's avatar
      Update rndc usage output (#40010) · fc39b6a9
      Mukund Sivaraman authored
      Squashed commit of the following:
      
      commit 73f0bba7d8d4763763ff88731c739ac646714ac8
      Author: Mukund Sivaraman <muks@isc.org>
      Date:   Mon Jul 13 05:40:35 2015 +0530
      
          Update rndc usage output
      
          This is based on a patch sent by Tony Finch.
      fc39b6a9
  23. 10 Jul, 2015 1 commit
  24. 09 Jul, 2015 1 commit
    • Evan Hunt's avatar
      [master] DDoS mitigation features · 1479200a
      Evan Hunt authored
      3938.	[func]		Added quotas to be used in recursive resolvers
      			that are under high query load for names in zones
      			whose authoritative servers are nonresponsive or
      			are experiencing a denial of service attack.
      
      			- "fetches-per-server" limits the number of
      			  simultaneous queries that can be sent to any
      			  single authoritative server.  The configured
      			  value is a starting point; it is automatically
      			  adjusted downward if the server is partially or
      			  completely non-responsive. The algorithm used to
      			  adjust the quota can be configured via the
      			  "fetch-quota-params" option.
      			- "fetches-per-zone" limits the number of
      			  simultaneous queries that can be sent for names
      			  within a single domain.  (Note: Unlike
      			  "fetches-per-server", this value is not
      			  self-tuning.)
      			- New stats counters have been added to count
      			  queries spilled due to these quotas.
      
      			See the ARM for details of these options. [RT #37125]
      1479200a
  25. 23 May, 2015 1 commit
  26. 05 May, 2015 2 commits
  27. 20 Jan, 2015 2 commits
  28. 14 Nov, 2014 1 commit
    • Evan Hunt's avatar
      [master] allow arbitrary-size rndc output · e32d354f
      Evan Hunt authored
      4005.	[func]		The buffer used for returning text from rndc
      			commands is now dynamically resizable, allowing
      			arbitrarily large amounts of text to be sent back
      			to the client. (Prior to this change, it was
      			possible for the output of "rndc tsig-list" to be
      			truncated.) [RT #37731]
      e32d354f
  29. 01 Aug, 2014 2 commits
  30. 31 Jul, 2014 1 commit
  31. 01 Jul, 2014 1 commit
  32. 04 Mar, 2014 1 commit
    • Evan Hunt's avatar
      [master] rndc -q · e7c0d42b
      Evan Hunt authored
      3776.	[bug]		"rndc -q" suppresses output from successful
      			rndc commands. Errors are printed on stderr.
                              [RT #21393]
      e7c0d42b
  33. 07 Feb, 2014 1 commit
  34. 09 Jan, 2014 1 commit