"dnssec-signzone -Z none" removes pre-existing ZONEMD records from a
signed zone. If followed by another -Z option, a new ZONEMD record
will be added to replace the existing ones. This can be used, for
instance, to switch from one scheme/digest to the other.
Add a test case in which a zone is generated containing an
unsigned but otherwise valid ZONEMD record, and confirm that
"named-checkzone -z fail" loads it. Add the same ZONEMD
record to a different zone, and confirm that "named-checkzone
-z fail" rejects it.
If the zone already contains ZONEMD records, they will be updated
when signing the zone. If not, ZONEMD records can be added by using
the "-Z" option: for instance, "dnssec-signzone -Z - -S example.com".
Also, dnssec-verify now verifies the ZONEMD records, if any are
present. If run with the "-Z" flag, ZONEMD is mandatory, and the
zone will be rejected if it is not present.
Some zones in the mirror system test are now signed with ZONEMD.
If ZONEMD is present in a zone and zonemd-check is active,
check the hash of the zone contents against the ZONEMD record.
When loading primary zones only, an expired signature is permitted
for the ZONEMD RRset. This will allow the zone to be re-signed
by named.
When loading or transferring a mirror zone, the zone will now
be DNSSEC validated only if there was no signed ZONEMD to check.
(Note that ZONEMD is more protective than DNSSEC validation,
because it covers glue as well as in-zone data.)
dns_update_zonemd() has been added to update ZONEMD records.
dns_update_signaturesinc() has been extended to update (via
dns_update_zonemd) and sign ZONEMD records.
- dns_zonemd_buildrdata() iterates a zone database and constructs a
ZONEMD record using the SIMPLE digest scheme described in RFC 8976.
- dns_zonemd_supported() checks a ZONEMD record and returns true if
the scheme and hash algorithm are supported by this server. (Currently
the only supported scheme is SIMPLE, and the supported hash algorithms
are SHA-384 and SHA-512.)
The test zones in RFC 8976 refused to load because one of the
ZONEMD records is too short for the specified digest type. This
change allows the test zone to load. There is an open errata
covering this. https://www.rfc-editor.org/errata/eid6425
A catalog zone with an unset ``default-primaries`` clause could cause
an unexpected termination of the :iscman:`named` process after two
reloading or reconfiguration commands. This has been fixed.
Closes#5494
Merge branch '5494-catz-crash-with-unset-default-primaries-and-double-reconfig' into 'main'
See merge request isc-projects/bind9!10896
When dns_catz_zone_add() returns ISC_R_EXISTS and there is no
'default-primaries' or 'default-masters', the ISC_R_EXISTS result
code doesn't get reset to ISC_R_SUCCESS, and the function returns
ISC_R_EXISTS instead of ISC_R_SUCCESS. Which means that the zone
is successfully added, but the caller assumes that the function has
failed.
Reset 'result' to ISC_R_SUCCESS when dns_catz_zone_add() returns
ISC_R_EXISTS (it's not an error condition).
Refactor the code go call dns_catz_zone_add() when all other error
conditions are already checked.
In gcc 15, __builtin_stdc_rotate_{left,right} was added. Use these
builtins when available otherwise rewrite the ISC_ROTATE_LEFT and
ISC_ROTATE_RIGHT using _Generic.
Merge branch 'ondrej/use-__builtin_stdc_rotate_left_right' into 'main'
See merge request isc-projects/bind9!10893
In gcc 15, __builtin_stdc_rotate_{left,right} was added. Use these
builtins when available otherwise rewrite the ISC_ROTATE_LEFT and
ISC_ROTATE_RIGHT using _Generic.
The list of keystores is owned by the single server object
(named_g_server), but dns_zone_t has a pointer into it in order to
preserve encapsulation (lib/dns won't link to bin/named for good
reasons).
However, getting the keystores from the zone uses the zone lock whereas
this is not needed (as the pointer value doesn't depends on the zone,
and is initialized only with the same named_g_server->keystores value);
also storing an extra pointer per zone is not needed; also, there was a
logic based on the zone->secure property which was not needed (as there
is only one keystore).
The keystores pointer is now accessible and lock-free at view level,
it also simplifies a bit the various zone configuration APIs (server.c,
zoneconf.c).
Merge branch 'colin/move-keystore-to-view' into 'main'
See merge request isc-projects/bind9!10895
The list of keystores is owned by the single server object
(named_g_server), but dns_zone_t has a pointer into it in order to
preserve encapsulation (lib/dns won't link to bin/named for good
reasons).
However, getting the keystores from the zone uses the zone lock whereas
this is not needed (as the pointer value doesn't depends on the zone,
and is initialized only with the same named_g_server->keystores value);
also storing an extra pointer per zone is not needed; also, there was a
logic based on the zone->secure property which was not needed (as there
is only one keystore).
The keystores pointer is now accessible and lock-free at view level,
it also simplifies a bit the various zone configuration APIs (server.c,
zoneconf.c).
Under certain circumstances, BIND 9 can return SERVFAIL when updating
existing entries in the cache with new NS, A, AAAA, or DS records with 0-TTL.
Closes#5294
Merge branch '5294-preserve-ZEROTTL-on-cache-update' into 'main'
See merge request isc-projects/bind9!10897
Under certain circumstances, cache entries with equivalent rdataset
might not get replaced. Previously such entry would get preserved
regardless of the new TTL and expire time on the existing header would
get updated when the expire time was less than the expire time on the
existing header. Change the logic to preserve the existing header only
if the new expire time is larger than the existing one and replace the
existing cache entry when the new expire time is less than the existing
one.
Co-authored-by: Jinmei Tatuya <jtatuya@infoblox.com>
Previously, BIND 9 would drop the ZEROTTL attribute when updating
previously cached NS entry with ZEROTTL attribute set.
Co-authored-by: Jinmei Tatuya <jtatuya@infoblox.com>
Use C23 stdckdint.h when available and define ckd_{mul,add,sub} shims to __builtin_{mul,add,sub}_overflow(). Require all the __builtin functions to be supported to further simplify the non-C23 implementation. Rename the <stdbit.h>-shims in <isc/bit.h> to their C23 names.
Merge branch 'ondrej/use-stdckdint.h-if-available' into 'main'
See merge request isc-projects/bind9!10818
Use C23 stdckdint.h when available and define ckd_{mul,add,sub} shims to
__builtin_{mul,add,sub}_overflow(). Require the __builtin functions
unconditionally.
Currently following __builtin functions are used:
__builtin_add_overflow
__builtin_mul_overflow
__builtin_prefetch
__builtin_sub_overflow
__builtin_unreachable
These are generally available on our supported platform, and also we use
some of these unconditionally anyway in qp.c. Thus make the support for
these functions mandatory so we fail early in the 'setup' step.
Make grammar check in CI more user friendly. Previously Sphinx docs
build might have failed because outdated grammar files and this would
have prevented CI from generating grammar file patch.
The fxhash implementation was missing a constant for 32-bit platforms.
This has been fixed. Constant for 64-bit platform was update to match
the current Rust constants.
Merge branch 'ondrej/update-fxhash-constants' into 'main'
See merge request isc-projects/bind9!10894
The fxhash implementation was missing a constant for 32-bit platforms.
This has been fixed. Constant for 64-bit platform was update to match
the current Rust constants.
The previous refactoring added an assertion failure when negative RRSIG
would be added to the cache database. As result, any query for RRSIG in
any unsigned zone would trigger that assertion failure.
Allow the negative RRSIG entries to be stored in the cache database
again as not caching these would trigger new remote fetch every time
such query would be received from a client.
Closes#5489
Merge branch '5489-allow-negative-RRSIGs-in-qpcache' into 'main'
See merge request isc-projects/bind9!10876
The previous refactoring added an assertion failure when negative RRSIG
would be added to the cache database. As result, any query for RRSIG in
any unsigned zone would trigger that assertion failure.
Allow the negative RRSIG entries to be stored in the cache database
again as not caching these would trigger new remote fetch every time
such query would be received from a client.
The following check:
__builtin_types_compatible_p(size_t, uint64_t)
doesn't work with default compiler on macOS. Workaround the issue
by typing the size_t to matching unsigned int type.
Using `static inline` functions in the headers break gcov as it cannot
properly track the hits. To fix the issue, convert the expressions to
statement macros. The added static assertions will ensure integer
promotion cannot occur unlike its previous function counterpart.
Merge branch 'aydin/rotate-as-macro' into 'main'
See merge request isc-projects/bind9!10878
Using `static inline` functions in the headers break gcov as it cannot
properly track the hits. To fix the issue, convert the expressions to
statement macros. The added static assertions will ensure integer
promotion cannot occur unlike its previous function counterpart.
By default, when :iscman:`named` is started it may start answering to
queries before the response policy zones are completely loaded
and processed. This new feature gives an option to the users to
tell :iscman:`named` that incoming requests should result in SERVFAIL answer
until all the response policy zones are processed and ready. Note that if
one or more response policy zones fail to load, :iscman:`named` starts
responding to queries according to those zones that did load.
Closes#5222
Merge branch '5222-stop-sending-responses-until-rpz-is-ready' into 'main'
See merge request isc-projects/bind9!10839
Test whether 'servfail-until-ready yes' works by enabling slow
RPZ loading with a USDT probe activation, and checking that named
returns SERVFAIL during the initial RPZ zones processing stage.
The test requires SystemTap (stap, dtrace) to activate the USDT
probe.
By default, when named is started it may start answering to
queries before the response policy zones are completely loaded
and processed. This new feature gives an option to the users to
tell named that incoming requests should result in SERVFAIL anwser
until all the response policy zones are procesed and ready.
During the initial configuration of named after startup, 'first_time'
is true. This is needed for implementing the new 'servfail-until-ready'
configuration option, which should take into effect only during the
initial configuration.
Add a new option ``manual-mode`` to :any:`dnssec-policy`. The intended use is that if it is enabled, it will not automatically move to the
next state transition, but instead the transition is logged. Only after manual confirmation with ``rndc dnssec -step`` the transition is made.
Closes#4606
Merge branch '4606-dnssec-policy-dry-run' into 'main'
See merge request isc-projects/bind9!10774
If we hit an error when issuing an 'rndc dnssec -step' command, and the
keymgr runs again at a later scheduled time, we don't want to enforce
transitions.
Similar to previous commit.
Parametrize each test case and in case of manual-mode, execute
additional checks. First a keymgr run should not change the existing
key state (with exceptions of timing events such as moving from
RUMOURED to OMNIPRESENT, and from UNRETENTIVE to HIDDEN). Appropriate
messages must be logged.
After enforcing the next step with 'rndc dnssec -step', the key state
should be the same as if the step were to be taken automatically.
Similar to previous commit.
Parametrize each test case and in case of manual-mode, execute
additional checks. First a keymgr run should not change the existing
key state (with exceptions of timing events such as moving from
RUMOURED to OMNIPRESENT, and from UNRETENTIVE to HIDDEN). Appropriate
messages must be logged.
After enforcing the next step with 'rndc dnssec -step', the key state
should be the same as if the step were to be taken automatically.
Similar to previous commit.
Parametrize each test case and in case of manual-mode, execute
additional checks. First a keymgr run should not change the existing
key state (with exceptions of timing events such as moving from
RUMOURED to OMNIPRESENT, and from UNRETENTIVE to HIDDEN). Appropriate
messages must be logged.
After enforcing the next step with 'rndc dnssec -step', the key state
should be the same as if the step were to be taken automatically.
Similar to previous commit.
Parametrize each test case and in case of manual-mode, execute
additional checks. First a keymgr run should not change the existing
key state (with exceptions of timing events such as moving from
RUMOURED to OMNIPRESENT, and from UNRETENTIVE to HIDDEN). Appropriate
messages must be logged.
After enforcing the next step with 'rndc dnssec -step', the key state
should be the same as if the step were to be taken automatically.
Similar to previous commits.
Parametrize each test case and in case of manual-mode, execute
additional checks. First a keymgr run should not change the existing
key state (with exceptions of timing events such as moving from
RUMOURED to OMNIPRESENT, and from UNRETENTIVE to HIDDEN). Appropriate
messages must be logged.
After enforcing the next step with 'rndc dnssec -step', the key state
should be the same as if the step were to be taken automatically.
Similar to the previous commit that tests CSK algorithm rollover.
Parametrize each test case and in case of manual-mode, execute
additional checks. First a keymgr run should not change the existing
key state (with exceptions of timing events such as moving from
RUMOURED to OMNIPRESENT, and from UNRETENTIVE to HIDDEN). Appropriate
messages must be logged.
After enforcing the next step with 'rndc dnssec -step', the key state
should be the same as if the step were to be taken automatically.
