GitLab

The HTML view of the statistics channel creates
pages with many long tables.  These can be difficult
to navigate.

This commit adds a "show/hide" toggle to each
heading, which makes it easy to compress/expand
the view.

In ISC-Bugs 45340, I wrote:

The Statistics channel offers links to Zones and Traffic.
Both produce valid data, but display as blank pages with
a web browser.

Zones never had XSL (I provided the original
implementation, but punted on the XSL).

Traffic has XSL, but it wasn't updated to reflect the
split between IPv4 and IPv6 data.

I've picked up enough XSL to fix my original omission,
and as penance for my sloth, fixed the Traffic bug as well.

Add most useful relaxed and acquire-relase stdatomic convenience macros

See merge request isc-projects/bind9!1935

The header file <isc/atomic.h> now contains convenience macros for
most useful explicit memory ordering for C11 stdatomics, only relaxed
and acquire-release semantics is being used.  These macros SHOULD be
used instead of atomic_<func>_explicit functions.

Remove UNSPEC rrtype

Closes #899

See merge request isc-projects/bind9!1931

Resolve "armv5 build is broken"

Closes #981

See merge request isc-projects/bind9!1892

Resolve "Remove dead code in pkcs11-keygen.c"

Closes #984

See merge request isc-projects/bind9!1814

Add benchmark for isc_{mem,mempool}_{get,put} operations

Closes #713

See merge request isc-projects/bind9!1928

placeholder

See merge request isc-projects/bind9!1923

Make NTAs work with validating forwarders

Closes #997

See merge request isc-projects/bind9!1859

Michał Kępień authored Apr 24, 2019 and Evan Hunt committed May 09, 2019

5219.	[bug]		Negative trust anchors did not work with "forward only;"
			to validating resolvers. [GL #997]

Michał Kępień authored Apr 24, 2019 and Evan Hunt committed May 09, 2019

If named is configured to perform DNSSEC validation and also forwards
all queries ("forward only;") to validating resolvers, negative trust
anchors do not work properly because the CD bit is not set in queries
sent to the forwarders.  As a result, instead of retrieving bogus DNSSEC
material and making validation decisions based on its configuration,
named is only receiving SERVFAIL responses to queries for bogus data.
Fix by ensuring the CD bit is always set in queries sent to forwarders
if the query name is covered by an NTA.

Improve the error message about missing PLY Python package

Closes #958

See merge request isc-projects/bind9!1918

Ondřej Surý authored May 10, 2019 and Evan Hunt committed May 09, 2019

Previously, only a message about missing Python was printed, which was
misleading to many users.  The new message clearly states that Python
AND PLY is required and prints basic instructions how to install PLY
package.

Make lib/dns/gen.c compatible with reproducible builds.

See merge request isc-projects/bind9!1758

The gen.c will now use SOURCE_DATE_EPOCH[1] if found in environment
to make the build more reproducible build friendly.

1. https://reproducible-builds.org/specs/source-date-epoch/

Resolve "Add EDNS Client Tag and EDNS Server Tag"

Closes #960

See merge request isc-projects/bind9!1754

Deprecate SHA-1 hash in DS/CDS

Closes #1015

See merge request isc-projects/bind9!1908

Tony Finch authored Jan 30, 2019 and Evan Hunt committed May 08, 2019

This affects CDS records generated by `named` and `dnssec-signzone`
based on `-P sync` and `-D sync` key timing instructions.

This is for conformance with the DS/CDS algorithm requirements in
https://tools.ietf.org/html/draft-ietf-dnsop-algorithm-update

Tony Finch authored Jan 30, 2019 and Evan Hunt committed May 08, 2019

This affects two cases:

  * When writing a `dsset` file for this zone, to be used by its
    parent, only write a SHA-256 DS record.

  * When reading a `keyset` file for a child, to generate DS records
    to include in this zone, generate SHA-256 DS records only.

This change does not affect digests used in CDS records.

This is for conformance with the DS/CDS algorithm requirements in
https://tools.ietf.org/html/draft-ietf-dnsop-algorithm-update

Tony Finch authored Feb 04, 2019 and Evan Hunt committed May 08, 2019

This changes the behaviour so that it explicitly lists DS records that
are present in the parent but do not have keys in the child. Any
inconsistency is reported as an error, which is somewhat stricter than
before.

This is for conformance with the DS/CDS algorithm requirements in
https://tools.ietf.org/html/draft-ietf-dnsop-algorithm-update

Tony Finch authored Jan 31, 2019 and Evan Hunt committed May 08, 2019

This makes the `-12a` options to `dnssec-dsfromkey` work more like
`dnssec-cds`, in that you can specify more than one digest and you
will get multiple records. (Previously you could only get one
non-default digest type at a time.)

The default is now `-2`. You can get the old behaviour with `-12`.

Tests and tools that use `dnssec-dsfromkey` have been updated to use
`-12` where necessary.

This is for conformance with the DS/CDS algorithm requirements in
https://tools.ietf.org/html/draft-ietf-dnsop-algorithm-update

fuzz dns_rdata_fromwire

See merge request isc-projects/bind9!1582

Fuzz input to dns_rdata_fromwire(). Then convert the result
to text, back to wire format, to multiline text, and back to wire
format again, checking for consistency throughout the sequence.

Merge branch '852-bind-returning-malformed-packet-error-when-sshfp-record-has-fingerprint-value-less-than-4-characters' into 'master'

Resolve "Bind returning malformed packet error when sshfp record has fingerprint value less than 4 characters"

Closes #852

See merge request isc-projects/bind9!1445

fix incorrect behavior mixing trusted-keys with validation auto

Closes #868

See merge request !1483