2
0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 05:28:00 +00:00

36640 Commits

Author SHA1 Message Date
Petr Špaček
a691ebd0c9
Add helper to unify options and zone block grammars
A helper is needed to combine cfg_test output for generic options and
all the type-dependent zone block variants.
2022-07-01 08:59:22 +02:00
Petr Špaček
190004e46c
Add pretty printer for JSON grammar
It produces the same format as cfg_test --grammar. The advantage is that
it allows to print any node in configuration the tree, not just whole
blocks.
2022-07-01 08:59:22 +02:00
Petr Špaček
8960d51aa3
Add utility to search for context-dependent configuration statements
The utility detects statements which use the same name (e.g.
max-zone-ttl) but use different grammar in different contexts. These
typically need special case in docs.
2022-07-01 08:59:22 +02:00
Petr Špaček
df08982930
Add a new library to parse grammar format produced by cfg_test
It transforms named.conf/rndc.conf grammar from text format into Python
dictionary. This allows granular access to grammar elements.

Beware: It heavity depens on cfg_test output format!
2022-07-01 08:59:04 +02:00
Petr Špaček
fb474de3ab
Add rndc.conf grammar into doc/misc
It uses the same mechanism as all other grammars, but the file is named
differently to distinguish it from named.conf grammars.
2022-07-01 08:56:35 +02:00
Petr Špaček
699570cdec
Un-format grammar files in doc/misc
The next commit is going to add parser for ISC configuration format.
To simplify the parser the grammar files in doc/misc are no longer
line-wrapped as handling it would make the grammar parser unnecessairly
complicated.

This affects visible output in the ARM, but in the end we are going to
replace the auto-generated .rst files with grammar pretty printed, so
formatting of these files does not matter in practical terms.
2022-07-01 08:56:33 +02:00
Petr Špaček
af3683f436
Add missing comment markers to doc/misc/ grammar files
These files can be consumed by scripts, so obviously missing comment
markers wreak havoc.
2022-06-30 19:00:17 +02:00
Petr Špaček
b18fa6c7b2 Merge branch 'sgoldlust/arm-tag-query-transfer' into 'main'
Add tags and short descriptions for query and transfer statements

See merge request isc-projects/bind9!6502
2022-06-30 16:11:30 +00:00
Petr Špaček
563eb8e1b9
Accept rst syntax in .. statement:: short: text
Nested rst syntax is now parsed and rendered. E.g.:

.. namedconf:statement:: example
   :short: Use ``this`` **cool** syntax!
2022-06-30 18:04:44 +02:00
Petr Špaček
0e7ca5b5e0
Disambiguate address_match_list link anchor
Let's keep just the :term: produced by grammar glossary.
2022-06-30 18:04:41 +02:00
Suzanne Goldlust
3cf976bd78
Add the :tags: and :short: descriptions for the category "transfer" 2022-06-30 18:04:40 +02:00
Suzanne Goldlust
7187a5cf77
Add the :tags: and :short: descriptions for the category "query" 2022-06-30 18:04:40 +02:00
Petr Špaček
2630cf8e76
Resurrect DNS NOTIFY chapter in the ARM
It was accidentally removed in the heat of
25eb91d23c5a2056f36902c90dfe8ca69f6a9400.
2022-06-30 18:04:40 +02:00
Michał Kępień
692fb3eedd Merge branch '2147-obsolete-the-glue-cache-option' into 'main'
Obsolete the "glue-cache" option

Closes #2147

See merge request isc-projects/bind9!6500
2022-06-30 13:27:54 +00:00
Michał Kępień
f0d2d3c03f Add CHANGES entry and release note for GL #2147 2022-06-30 15:24:08 +02:00
Michał Kępień
887c666caf Obsolete the "glue-cache" option
The "glue-cache" option was marked as deprecated by commit
5ae33351f286feb25a965bf3c9e6b122ab495342 (first released in BIND 9.17.6,
back in October 2020), so now obsolete that option, removing all code
and documentation related to it.

Note: this causes the glue cache feature to be permanently enabled, not
disabled.
2022-06-30 15:24:08 +02:00
Michal Nowak
3fb7ab8476 Merge branch '2371-add-stress-testing-with-rpz' into 'main'
Run the "stress" test in RPZ mode in GitLab CI

Closes #2371

See merge request isc-projects/bind9!4526
2022-06-28 18:36:30 +00:00
Michal Nowak
d272574653
Add stress testing with RPZ 2022-06-28 20:32:37 +02:00
Petr Špaček
accc2440ee Merge branch '3408-drop-debian-9-stretch' into 'main'
Drop support for Debian 9 (Stretch)

See merge request isc-projects/bind9!6486
2022-06-28 15:56:06 +00:00
Petr Špaček
4ce1f25210
Declare Debian 9 (Stretch) community-maintained 2022-06-28 17:54:48 +02:00
Petr Špaček
aa86a8bcf0
Drop Debian 9 (Stretch) from CI 2022-06-28 17:54:44 +02:00
Artem Boldariev
7a90169fee Merge branch '3415-update-http-listeners-on-reconfig' into 'main'
Update HTTP listeners settings on reconfiguration

Closes #3415

See merge request isc-projects/bind9!6482
2022-06-28 13:10:20 +00:00
Artem Boldariev
7822670d0f doth test: extend with HTTP endpoints reconfiguration check
This commit add a check which verifies that HTTP endpoints are being
picked up properly by the BIND instance on a reconfiguration.
2022-06-28 15:43:19 +03:00
Artem Boldariev
502c78c339 Update CHANGES [GL #3415]
Mention that the settings are now applied properly on reconfiguration.
2022-06-28 15:43:18 +03:00
Artem Boldariev
d2e13ddf22 Update the set of HTTP endpoints on reconfiguration
This commit ensures that on reconfiguration the set of HTTP
endpoints (=paths) is being updated within HTTP listeners.
2022-06-28 15:42:38 +03:00
Artem Boldariev
e72962d5f1 Update max concurrent streams limit in HTTP listeners on reconfig
This commit ensures that HTTP listeners concurrent streams limit gets
updated properly on reconfiguration.
2022-06-28 15:42:38 +03:00
Artem Boldariev
a2379135fa Update HTTP listeners quotas on reconfiguration
This commit ensures that on reconfiguration a proper value for HTTP
connections limit is picked up.

The commit also refactors how listeners settings are updated so that
there is less code duplication.
2022-06-28 15:42:38 +03:00
Artem Boldariev
3f0b310772 Store HTTP quota size inside a listenlist instead of the quota
This way only quota size is passed to the interface/listener
management code instead of a quota object. Thus, we can implement
updating the quota object size instead of recreating the object.
2022-06-28 15:42:38 +03:00
Matthijs Mekking
806b89abe1 Merge branch 'matthijs-dnssec-policy-defaults-in-config-dot-c' into 'main'
Move built-in dnssec-policies into defaultconf

See merge request isc-projects/bind9!6467
2022-06-28 12:35:46 +00:00
Matthijs Mekking
d8dae61832 Add isccfg duration utility functions
Add function isccfg_duration_toseconds and isccfg_parse_duration to get
rid of code duplication.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
8e18fa5874 Fix a bug in the duration_fromtext function
The function actually did not enforce that the duration string starts
with a P (or p), just that there is a P (or p) in the string.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
c2a7950417 Also inherit from "default" for "insecure" policy
Remove the duplication from the defaultconf and inherit the values
not set in the "insecure" policy from the "default" policy. Therefore,
we must insist that the first read built-in policy is the default one.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
80b55f9cfa Add change entry for dnssec-policy in defaultconf 2022-06-28 11:56:31 +02:00
Matthijs Mekking
5d6f0de84b Nit changes in keymgr and kasp
Use the ISC_MAX define instead of "x = a > b ? a : b" paradigm.

Remove an unneeded include.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
20acb8d3a3 When loading dnssec-policies, inherit from default
Most of the settings (durations) are already inheriting from the default
because they use the constants from lib/dns/kasp.h. We need them as
constants so we can use them in named-checkconf to verify the policy
parameters.

The NSEC(3) parameters and keys should come from the actual default
policy. Change the call to cfg_kasp_fromconfig() to include the default
kasp. We also no longer need to corner case where config is NULL we load
the built-in policy: the built-in policies are now loaded when config is
set to named_g_config.

Finally, add a debug log (it is useful to see which policies are being
loaded).
2022-06-28 11:56:31 +02:00
Matthijs Mekking
5ff414e986 Store built-in dnssec-policies in defaultconf
Update the defaultconf with the built-in policies. These will now be
printed with "named -C".

Change the defines in kasp.h to be strings, so they can be concatenated
in the defaultconf. This means when creating a kasp structure, we no
longer initialize the defaults (this is fine because only kaspconf.c
uses dns_kasp_create() and it inherits from the default policy).

In kaspconf.c, the default values now need to be parsed from string.

Introduce some variables so we don't need to do get_duration multiple
times on the same configuration option.

Finally, clang-format-14 decided to do some random formatting changes.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
a28d919503 Move duration structure to libisccfg/duration
Having the duration structure and parsing code here, it becomes
more accessible to be used in other places.
2022-06-28 11:56:31 +02:00
Michał Kępień
1854bd93ba Merge branch '3216-run-sslyze-in-gitlab-ci' into 'main'
[CVE-2022-1183] Run sslyze in GitLab CI

Closes #3216

See merge request isc-projects/bind9!6365
2022-06-27 21:08:40 +00:00
Michał Kępień
4f12892740 Also test DNS-over-TLS code using sslyze
Since sslyze can test any TLS-enabled server, also use it for exercising
DNS-over-TLS code rather than just DNS-over-HTTPS code.
2022-06-27 22:50:00 +02:00
Michał Kępień
e97b4697cf Add regression test for CVE-2022-1183
If sslyze is available in PATH, run it in a loop as part of the "doth"
system test.
2022-06-27 22:50:00 +02:00
Matthijs Mekking
c7146ce90a Merge branch '3422-dnssec-policy-clarifications' into 'main'
Add some clarifications wrt dynamic zones

Closes #3422

See merge request isc-projects/bind9!6487
2022-06-27 09:03:54 +00:00
Matthijs Mekking
fb517eb52a Add some clarifications wrt dynamic zones
These were suggested by GitLab user @elmaimbo.
2022-06-27 11:01:33 +02:00
Petr Špaček
24908151a9 Merge branch '3169-named-conf-intro-and-links' into 'main'
Reworked named.conf introduction and link anchors

See merge request isc-projects/bind9!6459
2022-06-24 14:38:46 +00:00
Ron Aitchison
d44cb9f194
Added explanations or Argument, Value, and Directive to the ARM 2022-06-24 16:20:46 +02:00
Petr Špaček
bb2a19d655
Add link to glob definition for include directive 2022-06-24 09:40:51 +02:00
Suzanne Goldlust
f4503061ba
Minor text nitpicking around dnssec-policy grammar reference 2022-06-24 09:40:51 +02:00
Petr Špaček
fbcaa44851
Remove ambiguous link anchors for logging { file } statement
Unfortunatelly logging and zone blocks use file statements with
different semantics but the same name.

There is no sane way to disambiguate them in text, so let's remove the
link anchor from logging so we can link to the file statement in zone.

My assumption is that linking to logging { file } is very unlikely
because logging is self-contained in one block but zone config is all
over the place.
2022-06-24 09:40:51 +02:00
Petr Špaček
d6b2423c99
Remove ambiguous link anchors for keys statement
Unfortunatelly dnssec-policy and servers blocks use keys statements with
a totally different grammar and semantics but the same name.
There is no sane way to disambiguate them in text, so let's remove the
link anchors to prevent errorneous linking.
2022-06-24 09:40:51 +02:00
Petr Špaček
caf2675ef8
Change statement->argument terminology for control channel
control { inet ... allow keys read-only }; are not actual statements
but in fact arguments of a statement. Remove .. namedconf:statement::
syntax to avoid collisions with other statements of the same name.
2022-06-24 09:40:51 +02:00
Petr Špaček
3233414a53
Deduplicate dnssec-policy definition in the ARM 2022-06-24 09:40:51 +02:00