2
0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 05:57:52 +00:00

41111 Commits

Author SHA1 Message Date
Tom Krizek
3c7291248c
Handle dig timing out gracefully in nsupdate 2024-01-08 17:03:35 +01:00
Tom Krizek
410aa5aeab
Handle dig timing out gracefully in names 2024-01-08 17:03:35 +01:00
Tom Krizek
0bf25138b6
Handle dig timing out gracefully in masterfile 2024-01-08 17:03:35 +01:00
Tom Krizek
8ece026848
Handle dig timing out gracefully in logfileconfig 2024-01-08 17:03:34 +01:00
Tom Krizek
2cc90a815e
Handle dig timing out gracefully in legacy 2024-01-08 17:03:34 +01:00
Tom Krizek
c6b267ce4d
Handle dig timing out gracefully in keepalive 2024-01-08 17:03:34 +01:00
Tom Krizek
fcce010045
Handle dig timing out gracefully in dnstap 2024-01-08 17:03:34 +01:00
Tom Krizek
343b3f0f84
Handle dig timing out gracefully in cookie 2024-01-08 17:03:33 +01:00
Tom Krizek
445ec7cc0f
Handle dig timing out gracefully in autosign 2024-01-08 17:03:33 +01:00
Tom Krizek
ddb41798d5
Handle dig timing out gracefully in auth 2024-01-08 17:03:33 +01:00
Tom Krizek
0d5df1fc02
Handle dig timing out gracefully in allow-query 2024-01-08 17:03:33 +01:00
Mark Andrews
4351076d48
Handle dig timing out gracefully in serve-stale 2024-01-08 17:03:32 +01:00
Mark Andrews
02d9f2eeb9
Handle dig timing out gracefully in rndc 2024-01-08 17:03:31 +01:00
Michal Nowak
cf56a27fbf Merge branch 'mnowak/set-up-version-and-release-notes-for-bind-9.19.21' into 'main'
Set up version and release notes for BIND 9.19.21

See merge request isc-projects/bind9!8627
2024-01-08 11:57:10 +00:00
Michal Nowak
1c7159c94e Set up release notes for BIND 9.19.21 2024-01-08 12:40:52 +01:00
Michal Nowak
168438c215 Update BIND version to 9.19.21-dev 2024-01-08 12:40:52 +01:00
Michal Nowak
aca85323d6
Update BIND version for release 2024-01-05 14:20:36 +01:00
Michal Nowak
b0b4a6f58c
Add a CHANGES marker 2024-01-05 14:19:30 +01:00
Michal Nowak
ed19836ecf Merge branch 'michal/prepare-documentation-for-bind-9.19.20' into 'v9.19.20-release'
Prepare documentation for BIND 9.19.20

See merge request isc-private/bind9!624
2024-01-05 13:17:42 +00:00
Michał Kępień
0fec404c64
Fix Danger rules for flagging release note issues
The logic contained in dangerfile.py incorrectly warns about missing
release note changes for merge requests preparing release documentation
as such merge requests rename files in the doc/notes/ directory.  This
(correctly) causes these files to be passed to dangerfile.py via
danger.git.created_files and danger.git.deleted_files rather than via
danger.git.modified_files, which in turn causes the logic checking the
use of the "Release Notes" label to assume that no release notes are
added, removed, or modified by a given merge request.

Fix by considering all types of file changes (modifications, additions,
and removals - which also covers file renaming) when checking whether a
given merge request modifies release notes.  Update the warning messages
accordingly.

However, when trying to find release notes added by a given merge
request, deleted files must not be considered.  Tweak the logic looking
for GitLab identifiers in the release notes added by a given merge
request so that it only scans modified and added (or renamed) files.
2024-01-05 12:51:13 +01:00
Michał Kępień
1708fe24b4
Tweak and reword release notes 2024-01-05 12:51:13 +01:00
Michał Kępień
8cad2c5923
Prepare release notes for BIND 9.19.20 2024-01-05 12:51:13 +01:00
Michał Kępień
07dce62da4 Merge branch '4383-limit-tree-pruning-overhead' into 'v9.19.20-release'
Limit isc_async_run() overhead for tree pruning

See merge request isc-private/bind9!619
2024-01-05 11:39:08 +00:00
Michał Kępień
04df558d57
Add CHANGES entry for GL #4383 2024-01-05 12:33:14 +01:00
Michał Kępień
24381cc36d
Limit isc_async_run() overhead for tree pruning
Instead of issuing a separate isc_async_run() call for every RBTDB node
that triggers tree pruning, maintain a list of nodes from which tree
pruning can be started from and only issue an isc_async_run() call if
pruning has not yet been triggered by another RBTDB node.

In some older BIND 9 branches, the extra queuing overhead eliminated by
this change could be remotely exploited to cause excessive memory use.
Due to architectural shift, this branch is not vulnerable to that issue,
but applying the fix to the latter is nevertheless deemed prudent for
consistency and to make the code future-proof.
2024-01-05 12:33:14 +01:00
Michał Kępień
cddf3b267b Merge branch '4334-confidential-dns64-and-serve-stale' into 'v9.19.20-release'
[CVE-2023-5679] Fix a bad interaction between DNS64 and serve-stale

See merge request isc-private/bind9!588
2024-01-05 11:22:24 +00:00
Mark Andrews
c4faf5c69f
Add release note for [GL #4334] 2024-01-05 12:17:00 +01:00
Mark Andrews
26671f8c47
Add CHANGES note for [GL #4334] 2024-01-05 12:17:00 +01:00
Mark Andrews
1fcc483df1
Restore dns64 state during serve-stale processing
If we are in the process of looking for the A records as part of
dns64 processing and the server-stale timeout triggers, redo the
dns64 changes that had been made to the orignal qctx.
2024-01-05 12:17:00 +01:00
Michał Kępień
9fbafe83d2 Merge branch '4281-confidential-redirect-rfc1918-check-failure' into 'v9.19.20-release'
[CVE-2023-5517] Fix handling of RFC 1918 reverse queries with "nxdomain-redirect" enabled

See merge request isc-private/bind9!584
2024-01-05 11:09:29 +00:00
Mark Andrews
2fbafc2675
Add release note for [GL #4281] 2024-01-05 12:01:28 +01:00
Mark Andrews
0748965b7c
Add CHANGES note for [GL #4281] 2024-01-05 12:01:28 +01:00
Mark Andrews
9d0fa07c5e
Save the correct result value to resume with nxdomain-redirect
The wrong result value was being saved for resumption with
nxdomain-redirect when performing the fetch.  This lead to an assert
when checking that RFC 1918 reverse queries where not leaking to
the global internet.
2024-01-05 12:01:28 +01:00
Michał Kępień
720e737de4 Merge branch '4234-confidential-use-hashmap-when-parsing' into 'v9.19.20-release'
[CVE-2023-4408] Use hashmap when parsing DNS messages

See merge request isc-private/bind9!560
2024-01-05 10:43:31 +00:00
Ondřej Surý
30d27928cf
Add CHANGES and release note for [GL #4234] 2024-01-05 11:35:25 +01:00
Ondřej Surý
b8a9631754
Use hashmap when parsing a message
When parsing messages use a hashmap instead of a linear search to reduce
the amount of work done in findname when there's more than one name in
the section.

There are two hashmaps:

1) hashmap for owner names - that's constructed for each section when we
hit the second name in the section and destroyed right after parsing
that section;

2) per-name hashmap - for each name in the section, we construct a new
hashmap for that name if there are more than one rdataset for that
particular name.
2024-01-05 11:35:25 +01:00
Michał Kępień
e087391a96 Merge branch '4182-confidential-fix-races-in-dns-tsigkey-find' into 'v9.19.20-release'
Address races in dns_tsigkey_find()

See merge request isc-private/bind9!548
2024-01-05 10:18:28 +00:00
Mark Andrews
a62cda787f
Add CHANGES note for [GL #4182] 2024-01-05 11:16:12 +01:00
Mark Andrews
d2ba96488e
Address races in dns_tsigkey_find()
1) Restart the process with a write lock if we discover an expired key
while holding the read lock.

2) Move incrementing the key reference inside the lock block of code.
2024-01-05 11:16:12 +01:00
Michał Kępień
9074bfa38d Merge branch 'michal/add-placeholder-entries-to-CHANGES' into 'main'
Add placeholder entries to CHANGES

See merge request isc-projects/bind9!8625
2024-01-05 09:05:44 +00:00
Michał Kępień
82ecaabb12
Add placeholder entries to CHANGES
Add placeholders for the following issues:

  - [GL #4182]
  - [GL #4234]
  - [GL #4281]
  - [GL #4334]
  - [GL #4356]
  - [GL #4383]
2024-01-05 09:22:39 +01:00
Aydın Mercan
e112d0775e Merge branch 'aydin/isc_header_atomic_fix' into 'main'
Use and check for <isc/atomic.h> instead of <stdatomic.h> directly

See merge request isc-projects/bind9!8582
2024-01-03 17:47:53 +00:00
Aydın Mercan
ca9a05f9ce Check for atomic operations consistency in checklibs.sh
isc/atomic.h and its defined macros should be preferred over
stdatomic.h and explicit atomic operations.

Fix the redundant stdatomic.h header in histo.c found by the introduced
check.
2024-01-03 17:04:31 +00:00
Aydın Mercan
294329da3a Use <isc/atomic.h> instead of <stdatomic.h> directly in <isc/types.h> 2024-01-03 17:04:31 +00:00
Mark Andrews
7d170900bf Merge branch '4466-cds-is-stuck-on-an-old-key' into 'main'
Resolve "CDS is stuck on an old key."

Closes #4466

See merge request isc-projects/bind9!8565
2024-01-03 01:47:52 +00:00
Mark Andrews
531420bac0 Add CHANGES note for [GL #4466] 2024-01-03 12:09:12 +11:00
Mark Andrews
882b1a4449 Set the DNSKEY TTLs to match the dnssec policy
This prevents the DNSKEY records being updated and the statistics
not matching as a consequence
2024-01-03 12:09:12 +11:00
Mark Andrews
7a6570a911 Create keys with TTLs that match the policies TTL 2024-01-03 12:09:12 +11:00
Mark Andrews
16a720357b Make $TTL match dnskey-ttl 2024-01-03 12:09:11 +11:00
Matthijs Mekking
b770740b44 Write new DNSKEY TTL to key file
When the current DNSKEY TTL does not match the one from the policy,
write the new TTL to disk.
2024-01-03 12:09:11 +11:00