2
0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 05:28:00 +00:00

37193 Commits

Author SHA1 Message Date
Mark Andrews
a2b51ca6ac Free 'rsa' if 'e' is NULL in opensslrsa_verify2 2022-09-28 09:24:34 +10:00
Ondřej Surý
1f670f4b69 Merge branch '3559-provide-custom-isc_mem-based-allocators-for-external-libraries' into 'main'
Use custom isc_mem based allocator for libuv, OpenSSL, and libxml2

Closes #3559

See merge request isc-projects/bind9!6807
2022-09-27 15:55:09 +00:00
Ondřej Surý
be3a159b54
Add CHANGES note for [GL #3559] 2022-09-27 17:53:04 +02:00
Ondřej Surý
3b31f7f563
Add autoconf option to enable memory leak detection in libraries
There's a known memory leak in the engine_pkcs11 at the time of writing
this and it interferes with the named ability to check for memory leaks
in the OpenSSL memory context by default.

Add an autoconf option to explicitly enable the memory leak detection,
and use it in the CI except for pkcs11 enabled builds.  When this gets
fixed in the engine_pkc11, the option can be enabled by default.
2022-09-27 17:53:04 +02:00
Ondřej Surý
d1cc847ab0
Check the libuv, OpenSSL and libxml2 memory context on exit
As we can't check the deallocations done in the library memory contexts
by default because it would always fail on non-clean exit (that happens
on error or by calling exit() early), we just want to enable the checks
to be done on normal exit.
2022-09-27 17:10:42 +02:00
Ondřej Surý
e537fea861
Use custom isc_mem based allocator for libxml2
The libxml2 library provides a way to replace the default allocator with
user supplied allocator (malloc, realloc, strdup and free).

Create a memory context specifically for libxml2 to allow tracking the
memory usage that has originated from within libxml2.  This will provide
a separate memory context for libxml2 to track the allocations and when
shutting down the application it will check that all libxml2 allocations
were returned to the allocator.

Additionally, move the xmlInitParser() and xmlCleanupParser() calls from
bin/named/main.c to library constructor/destructor in libisc library.
2022-09-27 17:10:42 +02:00
Ondřej Surý
236d4b7739
Use custom isc_mem based allocator for OpenSSL
The OpenSSL library provides a way to replace the default allocator with
user supplied allocator (malloc, realloc, and free).

Create a memory context specifically for OpenSSL to allow tracking the
memory usage that has originated from within OpenSSL.  This will provide
a separate memory context for OpenSSL to track the allocations and when
shutting down the application it will check that all OpenSSL allocations
were returned to the allocator.
2022-09-27 17:10:42 +02:00
Ondřej Surý
a32d06dd42
Use custom isc_mem based allocator for libuv
The libuv library provides a way to replace the default allocator with
user supplied allocator (malloc, realloc, calloc and free).

Create a memory context specifically for libuv to allow tracking the
memory usage that has originated from within libuv.  This requires
libuv >= 1.38.0 which provides uv_library_shutdown() function that
assures no more allocations will be made.
2022-09-27 17:10:42 +02:00
Ondřej Surý
a30e75db86
Check for working __builtin_mul_overflow() implementation
Instead of using generic HAVE_BUILTIN_OVERFLOW, we need to check whether
the overflow functions actually work as there was a bug in GCC that it
would not detect mul overflow when compiled with `-m32` option without
optimizations and the bug was fixed only for GCC 6.5+ and 7.3+/8+.

For further details see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82274
2022-09-27 17:10:42 +02:00
Ondřej Surý
2d2022a509
Make the debugging flags local to the memory context
Previously, the isc_mem_debugging would be single global variable that
would affect the behavior of the memory context whenever it would be
changed which could be after some allocation were already done.

Change the memory debugging options to be local to the memory context
and immutable, so all allocations within the same memory context are
treated the same.
2022-09-27 17:10:41 +02:00
Ondřej Surý
56f9c886aa Merge branch '3567-bump-the-minimal-libuv-version-to-1.34.0' into 'main'
Bump the libuv requirement to libuv >= 1.34.0

Closes #3567

See merge request isc-projects/bind9!6826
2022-09-27 15:09:53 +00:00
Ondřej Surý
178e0317a6
Add CHANGES and release note for [GL #3567] 2022-09-27 17:09:11 +02:00
Ondřej Surý
0086ebf3fc
Bump the libuv requirement to libuv >= 1.34.0
By bumping the minimum libuv version to 1.34.0, it allows us to remove
all libuv shims we ever had and makes the code much cleaner.  The
up-to-date libuv is available in all distributions supported by BIND
9.19+ either natively or as a backport.
2022-09-27 17:09:10 +02:00
Ondřej Surý
d5bead54c0
Drop Ubuntu 18.04 bionic from the CI
The Ubuntu 18.04 bionic will go EOL in April 2023 before the next stable
BIND 9 release, so we can drop this for the next stable BIND 9 release.
2022-09-27 17:09:10 +02:00
Ondřej Surý
7238c85c88
Drop Debian buster from the CI
The Debian buster is official EOL and in the LTS mode, so we can drop
this for the next stable BIND 9 release.
2022-09-27 17:09:10 +02:00
Matthijs Mekking
444461e9b1 Merge branch 'matthijs-dnssec-guide-dnssec-policy-requires-inline-signing' into 'main'
Add dnssec-policy inline-signing requirement to documentation

See merge request isc-projects/bind9!6823
2022-09-27 15:08:03 +00:00
Matthijs Mekking
18d230a584 Add inline-signing to config examples
Add 'inline-signing yes;' to configuration examples to have working
copy paste configurations.
2022-09-27 17:06:30 +02:00
Matthijs Mekking
5d454a7158 Update inline-signing requirement to ARM
This change was made in !6403, but the appropriate documentation
changes were not applied to the ARM.
2022-09-27 17:06:30 +02:00
Matthijs Mekking
09522c8d73 Add inline-signing requirement to DNSSEC Guide
This change was made in !6403, but the appropriate documentation
changes were not applied to the DNSSEC Guide.
2022-09-27 17:06:30 +02:00
Petr Špaček
489320e961 Merge branch '3541-have-named-v-report-supported-algorithms' into 'main'
Report supported crypto algorithms

Closes #3541

See merge request isc-projects/bind9!6771
2022-09-27 14:55:11 +00:00
Petr Špaček
c138a8aa59
Add release note for new crypto algorithm logging 2022-09-27 16:54:39 +02:00
Petr Špaček
c648e280e4
Document list of crypto algorithms in named -V output 2022-09-27 16:54:39 +02:00
Mark Andrews
d34ecdb366
Deduplicate string formating 2022-09-27 16:54:39 +02:00
Mark Andrews
e876de442e
Add CHANGES entry for [GL #3541] 2022-09-27 16:54:39 +02:00
Mark Andrews
3156d36495
silence scan-build false positive 2022-09-27 16:54:39 +02:00
Mark Andrews
cb1515e71f
Report algorithms supported by named at startup 2022-09-27 16:54:39 +02:00
Mark Andrews
b308f866c0
Have 'named -V' report supported algorithms
These cover DNSSEC, DS, HMAC and TKEY algorithms.
2022-09-27 16:54:39 +02:00
Mark Andrews
151cc2fff9
Replace alg_totext with dst_hmac_algorithm_totext
The new library function will be reused by subsequent commits.
2022-09-27 16:54:39 +02:00
Mark Andrews
09f7e0607a
Convert DST_ALG defines to enum and group HMAC algorithms
The HMACs and GSSAPI are just using unallocated values.
Moving them around shouldn't cause issues.
Only the dnssec system test knew the internal number in use for hmacmd5.
2022-09-27 16:54:36 +02:00
Arаm Sаrgsyаn
a84c422fc8 Merge branch '3513-cid-356329-error-handling-in-dnssec-signzone.c' into 'main'
Resolve "CID 356329: Error handling issues in bin/dnssec/dnssec-signzone.c"

Closes #3513

See merge request isc-projects/bind9!6714
2022-09-27 14:34:23 +00:00
Aram Sargsyan
4509c4f1bd Use the return value of isc_task_create()
Improve the error handling by checking the isc_task_create()
function's return value.

CID 356329:

    /bin/dnssec/dnssec-signzone.c: 3732 in main()
    3726     	if (directory == NULL) {
    3727     		directory = ".";
    3728     	}
    3729
    3730     	isc_managers_create(&mctx, ntasks, &loopmgr, &netmgr, &taskmgr);
    3731
    >>>     CID 356329:  Error handling issues  (CHECKED_RETURN)
    >>>     Calling "isc__task_create" without checking return value (as is done elsewhere 16 out of 18 times).
    3732     	isc_task_create(taskmgr, &write_task, 0);
    3733
    3734     	result = dst_lib_init(mctx, engine);
    3735     	if (result != ISC_R_SUCCESS) {
    3736     		fatal("could not initialize dst: %s",
    3737
2022-09-27 12:22:34 +00:00
Mark Andrews
eb7b068bf8 Merge branch '3557-catalog-zone-check-key-names' into 'main'
Resolve "Catalog zone processing failed to detect TSIG key changes for primaries"

Closes #3557

See merge request isc-projects/bind9!6806
2022-09-27 12:17:08 +00:00
Mark Andrews
eacf41a20a Add release note for [GL #3557] 2022-09-27 21:54:02 +10:00
Mark Andrews
0774dacf2d Add CHANGES note for [GL #3557] 2022-09-27 21:54:02 +10:00
Mark Andrews
176e172210 Check that changing the TSIG key is successful
Switch the primary to require 'next_key' for zone transfers then
update the catalog zone to say to use 'next_key'.  Next update the
zones contents then check that those changes are seen on the
secondary.
2022-09-27 21:54:02 +10:00
Mark Andrews
9172bd9b5a Check that primary key names have not changed
When looking for changes in a catalog zone member zone we need to
also check if the TSIG key name associated with a primary server
has be added, removed or changed.
2022-09-27 21:54:02 +10:00
Petr Špaček
75424ec23a Merge branch 'pspacek/fix-dns_message_checksig-out-of-tree' into 'main'
Fix dns_message_checksig fuzzer

Closes #3565

See merge request isc-projects/bind9!6822
2022-09-27 11:22:56 +00:00
Ondřej Surý
16377100ae
Fix stack-use-after-scope in dns_message_checksig test
Previously stack with buffer for test dns message went out of scope
before the message was processed. For fuzz testing its better to avoid
allocation, so let's avoid allocations completely and use simplest
possible static buffer.

Fixes: #3565
2022-09-27 13:06:01 +02:00
Petr Špaček
4108d79c9a
Fix dns_message_checksig in out-of-tree setup
Hardcoded path was missing FUZZDIR prefix.

Related: !5923
2022-09-27 11:21:42 +02:00
Petr Špaček
d102c59b96
Detect errors in fuzzer initialization
Incomplete initialization typically causes mysterious failures later on,
so let's err out early.
2022-09-27 11:21:38 +02:00
Michał Kępień
547f15ff11 Merge branch 'mnowak/add-fedora-36' into 'main'
Add Fedora 36

See merge request isc-projects/bind9!6297
2022-09-27 07:39:31 +00:00
Michal Nowak
a313c49a3b Add Fedora 36 2022-09-27 09:37:09 +02:00
Evan Hunt
df51d22726 Merge branch '3553-static-buffer-functions' into 'main'
change ISC__BUFFER macros to inline functions

See merge request isc-projects/bind9!6801
2022-09-27 07:23:06 +00:00
Evan Hunt
1926ddc987 change ISC__BUFFER macros to inline functions
previously, when ISC_BUFFER_USEINLINE was defined, macros were
used to implement isc_buffer primitives (isc_buffer_init(),
isc_buffer_region(), etc). these macros were missing the DbC
assertions for those primitives, which made it possible for
coding errors to go undetected.

adding the assertions to the macros caused compiler warnings on
some platforms. therefore, this commit converts the ISC__BUFFER
macros to static inline functions instead, with assertions included,
and eliminates the non-inline implementation from buffer.c.

the --enable-buffer-useinline configure option has been removed.
2022-09-26 23:49:27 -07:00
Petr Špaček
c42d980d4a Merge branch 'bug/main/doc-arm-rhel9' into 'main'
Compatibility for building ARM on older sphinx

See merge request isc-projects/bind9!6815
2022-09-26 15:15:27 +00:00
Petr Menšík
3db7e241d2
Simplify allowing warnings during ARM build
RHEL8 Sphinx does not support all features used in ARM building. But
with few emitted warnings it can build the documentation fine. Simplify
warnings acceptance by allowing make doc SPHINX_W=''.
2022-09-26 17:09:56 +02:00
Petr Menšík
bc6c6b1184
Compatibility for building ARM on older sphinx
Make documentation building successful even on RHEL9 sphinx 3.4.3. It
does not like case-insensitive matching of terms, so provide lowercase
text description with Uppercase word reference.
2022-09-26 17:09:51 +02:00
Petr Špaček
12bce9e69b Merge branch 'ondrej-add-dns_message_checktsig-fuzzer' into 'main'
Add dns_message_checksig() fuzzer

See merge request isc-projects/bind9!5923
2022-09-26 14:30:16 +00:00
Petr Špaček
983822abcf
Add seed to reproduce issue memory leak in dns_message_checktsig
Related: #3547
2022-09-26 16:29:36 +02:00
Mark Andrews
6237273205
Add CHANGES notes for [GL !5923] 2022-09-26 16:29:35 +02:00