From 1b19a4f5cc34b194bdf4565a2d988287d894d9d1 Mon Sep 17 00:00:00 2001 From: erwin Date: Mon, 3 Mar 2014 09:18:19 +0000 Subject: [PATCH] MFV 262445: Update BIND to 9.9.5 Release note: https://lists.isc.org/pipermail/bind-announce/2013-September/000871.html https://lists.isc.org/pipermail/bind-announce/2014-January/000896.html Note this is a commit straight to stable as BIND no longer exists in head. Sponsored by: DK Hostmaster A/S git-svn-id: svn://svn.freebsd.org/base/stable/9@262706 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- contrib/bind9/CHANGES | 388 +- contrib/bind9/COPYRIGHT | 36 +- contrib/bind9/Makefile.in | 9 +- contrib/bind9/README | 132 +- contrib/bind9/bin/check/named-checkconf.8 | 14 +- contrib/bind9/bin/check/named-checkconf.c | 70 +- .../bind9/bin/check/named-checkconf.docbook | 19 +- contrib/bind9/bin/check/named-checkconf.html | 24 +- contrib/bind9/bin/confgen/ddns-confgen.c | 4 +- contrib/bind9/bin/confgen/rndc-confgen.c | 4 +- contrib/bind9/bin/dig/dig.1 | 12 +- contrib/bind9/bin/dig/dig.c | 12 +- contrib/bind9/bin/dig/dig.docbook | 14 +- contrib/bind9/bin/dig/dig.html | 18 +- contrib/bind9/bin/dig/dighost.c | 303 +- contrib/bind9/bin/dig/host.c | 4 +- contrib/bind9/bin/dig/include/dig/dig.h | 6 +- contrib/bind9/bin/dig/nslookup.1 | 9 +- contrib/bind9/bin/dig/nslookup.c | 22 +- contrib/bind9/bin/dig/nslookup.docbook | 21 +- contrib/bind9/bin/dig/nslookup.html | 20 +- contrib/bind9/bin/dnssec/Makefile.in | 10 +- contrib/bind9/bin/dnssec/dnssec-importkey.8 | 112 + contrib/bind9/bin/dnssec/dnssec-importkey.c | 434 + .../bind9/bin/dnssec/dnssec-importkey.docbook | 225 + .../bind9/bin/dnssec/dnssec-importkey.html | 113 + contrib/bind9/bin/dnssec/dnssec-keygen.c | 4 +- contrib/bind9/bin/dnssec/dnssec-settime.c | 4 +- contrib/bind9/bin/dnssec/dnssec-signzone.8 | 27 +- contrib/bind9/bin/dnssec/dnssec-signzone.c | 46 +- .../bind9/bin/dnssec/dnssec-signzone.docbook | 34 +- contrib/bind9/bin/dnssec/dnssec-signzone.html | 41 +- contrib/bind9/bin/dnssec/dnssectool.c | 49 +- contrib/bind9/bin/named/Makefile.in | 5 +- contrib/bind9/bin/named/bind9.ver3.xsl | 1110 +- contrib/bind9/bin/named/bind9.ver3.xsl.h | 245 +- contrib/bind9/bin/named/builtin.c | 17 +- contrib/bind9/bin/named/client.c | 281 +- contrib/bind9/bin/named/config.c | 29 +- contrib/bind9/bin/named/control.c | 9 +- contrib/bind9/bin/named/controlconf.c | 12 +- .../bind9/bin/named/include/named/globals.h | 1 + contrib/bind9/bin/named/include/named/main.h | 6 +- contrib/bind9/bin/named/include/named/query.h | 6 +- .../bind9/bin/named/include/named/server.h | 14 +- contrib/bind9/bin/named/interfacemgr.c | 15 +- contrib/bind9/bin/named/logconf.c | 61 +- contrib/bind9/bin/named/lwaddr.c | 10 +- contrib/bind9/bin/named/lwdgnba.c | 6 +- contrib/bind9/bin/named/lwdgrbn.c | 21 +- contrib/bind9/bin/named/main.c | 26 +- contrib/bind9/bin/named/named.conf.5 | 8 +- contrib/bind9/bin/named/named.conf.docbook | 7 +- contrib/bind9/bin/named/named.conf.html | 36 +- contrib/bind9/bin/named/query.c | 155 +- contrib/bind9/bin/named/server.c | 784 +- contrib/bind9/bin/named/statschannel.c | 93 +- contrib/bind9/bin/named/unix/os.c | 5 +- contrib/bind9/bin/named/update.c | 14 +- contrib/bind9/bin/named/zoneconf.c | 8 +- contrib/bind9/bin/nsupdate/Makefile.in | 6 +- contrib/bind9/bin/nsupdate/nsupdate.c | 40 +- contrib/bind9/bin/rndc/rndc.8 | 299 +- contrib/bind9/bin/rndc/rndc.c | 16 +- contrib/bind9/bin/rndc/rndc.docbook | 506 +- contrib/bind9/bin/rndc/rndc.html | 371 +- contrib/bind9/config.guess | 1077 +- contrib/bind9/config.h.in | 21 + contrib/bind9/config.sub | 472 +- contrib/bind9/configure.in | 179 +- contrib/bind9/doc/arm/Bv9ARM-book.xml | 872 +- contrib/bind9/doc/arm/Bv9ARM.ch03.html | 400 +- contrib/bind9/doc/arm/Bv9ARM.ch04.html | 171 +- contrib/bind9/doc/arm/Bv9ARM.ch05.html | 4 +- contrib/bind9/doc/arm/Bv9ARM.ch06.html | 470 +- contrib/bind9/doc/arm/Bv9ARM.ch07.html | 12 +- contrib/bind9/doc/arm/Bv9ARM.ch08.html | 16 +- contrib/bind9/doc/arm/Bv9ARM.ch09.html | 218 +- contrib/bind9/doc/arm/Bv9ARM.html | 160 +- contrib/bind9/doc/arm/Bv9ARM.pdf | 17897 ++++++++-------- contrib/bind9/doc/arm/man.arpaname.html | 6 +- contrib/bind9/doc/arm/man.ddns-confgen.html | 8 +- contrib/bind9/doc/arm/man.dig.html | 26 +- contrib/bind9/doc/arm/man.dnssec-checkds.html | 122 + .../bind9/doc/arm/man.dnssec-coverage.html | 205 + .../bind9/doc/arm/man.dnssec-dsfromkey.html | 14 +- .../doc/arm/man.dnssec-keyfromlabel.html | 12 +- contrib/bind9/doc/arm/man.dnssec-keygen.html | 14 +- contrib/bind9/doc/arm/man.dnssec-revoke.html | 8 +- contrib/bind9/doc/arm/man.dnssec-settime.html | 12 +- .../bind9/doc/arm/man.dnssec-signzone.html | 39 +- contrib/bind9/doc/arm/man.dnssec-verify.html | 8 +- contrib/bind9/doc/arm/man.genrandom.html | 8 +- contrib/bind9/doc/arm/man.host.html | 8 +- contrib/bind9/doc/arm/man.isc-hmac-fixup.html | 8 +- .../bind9/doc/arm/man.named-checkconf.html | 22 +- .../bind9/doc/arm/man.named-checkzone.html | 10 +- .../bind9/doc/arm/man.named-journalprint.html | 6 +- contrib/bind9/doc/arm/man.named.html | 14 +- contrib/bind9/doc/arm/man.nsec3hash.html | 8 +- contrib/bind9/doc/arm/man.nsupdate.html | 12 +- contrib/bind9/doc/arm/man.rndc-confgen.html | 10 +- contrib/bind9/doc/arm/man.rndc.conf.html | 10 +- contrib/bind9/doc/arm/man.rndc.html | 369 +- contrib/bind9/doc/arm/pkcs11.xml | 9 +- contrib/bind9/doc/misc/options | 2 - contrib/bind9/lib/bind9/api | 2 +- contrib/bind9/lib/bind9/check.c | 39 +- contrib/bind9/lib/dns/Makefile.in | 12 +- contrib/bind9/lib/dns/acache.c | 3 +- contrib/bind9/lib/dns/acl.c | 6 +- contrib/bind9/lib/dns/adb.c | 6 +- contrib/bind9/lib/dns/api | 6 +- contrib/bind9/lib/dns/client.c | 80 +- contrib/bind9/lib/dns/diff.c | 15 +- contrib/bind9/lib/dns/dispatch.c | 47 +- contrib/bind9/lib/dns/dns64.c | 16 +- contrib/bind9/lib/dns/dnssec.c | 117 +- contrib/bind9/lib/dns/dst_api.c | 27 + contrib/bind9/lib/dns/dst_internal.h | 5 +- contrib/bind9/lib/dns/dst_parse.c | 64 +- contrib/bind9/lib/dns/dst_result.c | 4 +- contrib/bind9/lib/dns/gen.c | 13 +- contrib/bind9/lib/dns/gssapi_link.c | 14 +- contrib/bind9/lib/dns/gssapictx.c | 40 +- contrib/bind9/lib/dns/hmac_link.c | 45 +- contrib/bind9/lib/dns/include/dns/Makefile.in | 7 +- contrib/bind9/lib/dns/include/dns/client.h | 15 +- contrib/bind9/lib/dns/include/dns/dnssec.h | 17 +- contrib/bind9/lib/dns/include/dns/log.h | 3 +- contrib/bind9/lib/dns/include/dns/master.h | 3 +- .../bind9/lib/dns/include/dns/masterdump.h | 7 +- contrib/bind9/lib/dns/include/dns/message.h | 1 + contrib/bind9/lib/dns/include/dns/nsec3.h | 4 +- contrib/bind9/lib/dns/include/dns/rdata.h | 5 +- contrib/bind9/lib/dns/include/dns/rrl.h | 278 + contrib/bind9/lib/dns/include/dns/view.h | 2 + contrib/bind9/lib/dns/include/dns/zone.h | 6 + contrib/bind9/lib/dns/include/dst/dst.h | 25 +- contrib/bind9/lib/dns/include/dst/gssapi.h | 4 +- contrib/bind9/lib/dns/journal.c | 47 +- contrib/bind9/lib/dns/keydata.c | 6 +- contrib/bind9/lib/dns/log.c | 3 +- contrib/bind9/lib/dns/master.c | 10 +- contrib/bind9/lib/dns/masterdump.c | 44 +- contrib/bind9/lib/dns/message.c | 10 +- contrib/bind9/lib/dns/name.c | 49 +- contrib/bind9/lib/dns/nsec.c | 8 +- contrib/bind9/lib/dns/nsec3.c | 44 +- contrib/bind9/lib/dns/openssldh_link.c | 6 +- contrib/bind9/lib/dns/openssldsa_link.c | 21 +- contrib/bind9/lib/dns/opensslecdsa_link.c | 57 +- contrib/bind9/lib/dns/opensslgost_link.c | 35 +- contrib/bind9/lib/dns/opensslrsa_link.c | 22 +- contrib/bind9/lib/dns/portlist.c | 14 +- contrib/bind9/lib/dns/rbt.c | 8 +- contrib/bind9/lib/dns/rbtdb.c | 141 +- contrib/bind9/lib/dns/rcode.c | 8 +- contrib/bind9/lib/dns/rdata.c | 40 +- contrib/bind9/lib/dns/rdata/ch_3/a_1.c | 6 +- .../bind9/lib/dns/rdata/generic/afsdb_18.c | 6 +- .../bind9/lib/dns/rdata/generic/dnskey_48.c | 22 +- .../bind9/lib/dns/rdata/generic/eui48_108.c | 4 +- .../bind9/lib/dns/rdata/generic/eui64_109.c | 4 +- contrib/bind9/lib/dns/rdata/generic/hip_55.c | 8 +- .../bind9/lib/dns/rdata/generic/ipseckey_45.c | 8 +- contrib/bind9/lib/dns/rdata/generic/isdn_20.c | 20 +- contrib/bind9/lib/dns/rdata/generic/key_25.c | 22 +- .../lib/dns/rdata/generic/keydata_65533.c | 26 +- contrib/bind9/lib/dns/rdata/generic/l32_105.c | 4 +- contrib/bind9/lib/dns/rdata/generic/l64_106.c | 4 +- contrib/bind9/lib/dns/rdata/generic/nid_104.c | 4 +- contrib/bind9/lib/dns/rdata/generic/opt_41.c | 46 +- .../bind9/lib/dns/rdata/generic/rrsig_46.c | 32 +- contrib/bind9/lib/dns/rdata/generic/rt_21.c | 6 +- contrib/bind9/lib/dns/rdata/generic/soa_6.c | 6 +- contrib/bind9/lib/dns/rdata/generic/spf_99.c | 4 +- contrib/bind9/lib/dns/rdata/generic/txt_16.c | 4 +- contrib/bind9/lib/dns/rdata/hs_4/a_1.c | 8 +- contrib/bind9/lib/dns/rdata/in_1/a6_38.c | 6 +- contrib/bind9/lib/dns/rdata/in_1/a_1.c | 8 +- contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c | 10 +- contrib/bind9/lib/dns/rdata/in_1/apl_42.c | 6 +- contrib/bind9/lib/dns/rdata/in_1/wks_11.c | 12 +- contrib/bind9/lib/dns/rdataslab.c | 19 +- contrib/bind9/lib/dns/resolver.c | 33 +- contrib/bind9/lib/dns/rootns.c | 2 +- contrib/bind9/lib/dns/rpz.c | 4 +- contrib/bind9/lib/dns/rrl.c | 1324 ++ contrib/bind9/lib/dns/spnego.c | 26 +- contrib/bind9/lib/dns/spnego_asn1.c | 20 +- contrib/bind9/lib/dns/ssu.c | 4 +- contrib/bind9/lib/dns/ssu_external.c | 4 +- contrib/bind9/lib/dns/time.c | 4 +- contrib/bind9/lib/dns/tkey.c | 12 +- contrib/bind9/lib/dns/tsig.c | 18 +- contrib/bind9/lib/dns/ttl.c | 6 +- contrib/bind9/lib/dns/update.c | 8 +- contrib/bind9/lib/dns/validator.c | 6 +- contrib/bind9/lib/dns/view.c | 45 +- contrib/bind9/lib/dns/xfrin.c | 97 +- contrib/bind9/lib/dns/zone.c | 927 +- contrib/bind9/lib/export/isc/Makefile.in | 11 +- contrib/bind9/lib/export/samples/nsprobe.c | 4 +- .../bind9/lib/export/samples/sample-request.c | 4 +- .../bind9/lib/export/samples/sample-update.c | 6 +- contrib/bind9/lib/export/samples/sample.c | 4 +- contrib/bind9/lib/irs/Makefile.in | 4 +- contrib/bind9/lib/irs/api | 4 +- contrib/bind9/lib/irs/getaddrinfo.c | 18 +- contrib/bind9/lib/irs/include/irs/Makefile.in | 4 +- contrib/bind9/lib/irs/include/irs/resconf.h | 14 +- contrib/bind9/lib/irs/resconf.c | 93 +- contrib/bind9/lib/isc/Makefile.in | 16 +- contrib/bind9/lib/isc/api | 6 +- contrib/bind9/lib/isc/app_api.c | 12 +- contrib/bind9/lib/isc/backtrace.c | 15 +- contrib/bind9/lib/isc/base32.c | 8 +- contrib/bind9/lib/isc/base64.c | 8 +- contrib/bind9/lib/isc/buffer.c | 6 +- contrib/bind9/lib/isc/commandline.c | 8 +- contrib/bind9/lib/isc/hash.c | 17 +- contrib/bind9/lib/isc/heap.c | 8 +- contrib/bind9/lib/isc/hex.c | 8 +- contrib/bind9/lib/isc/hmacmd5.c | 7 +- contrib/bind9/lib/isc/hmacsha.c | 43 +- contrib/bind9/lib/isc/httpd.c | 122 +- contrib/bind9/lib/isc/include/isc/Makefile.in | 16 +- contrib/bind9/lib/isc/include/isc/app.h | 11 +- contrib/bind9/lib/isc/include/isc/buffer.h | 6 +- contrib/bind9/lib/isc/include/isc/file.h | 12 +- contrib/bind9/lib/isc/include/isc/hash.h | 4 +- contrib/bind9/lib/isc/include/isc/httpd.h | 24 +- contrib/bind9/lib/isc/include/isc/namespace.h | 3 +- .../bind9/lib/isc/include/isc/platform.h.in | 13 +- contrib/bind9/lib/isc/include/isc/radix.h | 6 +- contrib/bind9/lib/isc/include/isc/safe.h | 36 + contrib/bind9/lib/isc/include/isc/socket.h | 7 +- contrib/bind9/lib/isc/include/isc/stdio.h | 10 +- contrib/bind9/lib/isc/include/isc/string.h | 9 +- contrib/bind9/lib/isc/include/isc/tm.h | 46 + contrib/bind9/lib/isc/include/isc/types.h | 4 +- contrib/bind9/lib/isc/inet_aton.c | 11 +- contrib/bind9/lib/isc/inet_pton.c | 13 +- contrib/bind9/lib/isc/lex.c | 25 +- contrib/bind9/lib/isc/log.c | 8 +- contrib/bind9/lib/isc/md5.c | 12 +- contrib/bind9/lib/isc/mem.c | 22 +- contrib/bind9/lib/isc/netaddr.c | 8 +- .../lib/isc/nothreads/include/isc/thread.h | 3 +- .../lib/isc/pthreads/include/isc/thread.h | 5 +- contrib/bind9/lib/isc/pthreads/thread.c | 15 + contrib/bind9/lib/isc/radix.c | 6 +- contrib/bind9/lib/isc/random.c | 4 +- contrib/bind9/lib/isc/safe.c | 42 + contrib/bind9/lib/isc/sha1.c | 8 +- contrib/bind9/lib/isc/sha2.c | 40 +- contrib/bind9/lib/isc/sockaddr.c | 6 +- contrib/bind9/lib/isc/stats.c | 6 +- contrib/bind9/lib/isc/string.c | 54 +- contrib/bind9/lib/isc/strtoul.c | 8 +- contrib/bind9/lib/isc/tm.c | 438 + contrib/bind9/lib/isc/unix/app.c | 31 +- contrib/bind9/lib/isc/unix/file.c | 37 +- .../bind9/lib/isc/unix/ifiter_getifaddrs.c | 4 +- contrib/bind9/lib/isc/unix/ifiter_ioctl.c | 20 +- contrib/bind9/lib/isc/unix/ifiter_sysctl.c | 10 +- .../lib/isc/unix/include/isc/Makefile.in | 4 +- contrib/bind9/lib/isc/unix/include/isc/time.h | 12 +- contrib/bind9/lib/isc/unix/interfaceiter.c | 18 +- contrib/bind9/lib/isc/unix/socket.c | 58 +- contrib/bind9/lib/isc/unix/stdio.c | 21 +- contrib/bind9/lib/isc/unix/time.c | 22 +- contrib/bind9/lib/isccc/api | 2 +- contrib/bind9/lib/isccc/base64.c | 10 +- contrib/bind9/lib/isccc/cc.c | 16 +- contrib/bind9/lib/isccc/include/isccc/util.h | 38 +- contrib/bind9/lib/isccc/sexpr.c | 6 +- contrib/bind9/lib/isccfg/api | 6 +- contrib/bind9/lib/isccfg/include/isccfg/cfg.h | 12 +- .../bind9/lib/isccfg/include/isccfg/grammar.h | 7 +- contrib/bind9/lib/isccfg/namedconf.c | 43 +- contrib/bind9/lib/isccfg/parser.c | 54 +- contrib/bind9/lib/lwres/api | 2 +- contrib/bind9/lib/lwres/context.c | 32 +- contrib/bind9/lib/lwres/getaddrinfo.c | 18 +- contrib/bind9/lib/lwres/gethost.c | 158 +- contrib/bind9/lib/lwres/getipnode.c | 70 +- contrib/bind9/lib/lwres/getrrset.c | 10 +- contrib/bind9/lib/lwres/herror.c | 8 +- contrib/bind9/lib/lwres/lwbuffer.c | 38 +- contrib/bind9/lib/lwres/lwconfig.c | 8 +- contrib/bind9/lib/lwres/lwinetaton.c | 11 +- contrib/bind9/lib/lwres/lwinetpton.c | 11 +- contrib/bind9/lib/lwres/lwres_gabn.c | 38 +- contrib/bind9/lib/lwres/lwres_gnba.c | 42 +- contrib/bind9/lib/lwres/lwres_grbn.c | 10 +- contrib/bind9/lib/lwres/lwres_noop.c | 38 +- contrib/bind9/lib/lwres/lwresutil.c | 46 +- contrib/bind9/lib/lwres/strtoul.c | 8 +- contrib/bind9/make/mkdep.in | 6 +- contrib/bind9/version | 7 +- lib/bind/config.h | 21 + lib/bind/dns/Makefile | 3 +- lib/bind/dns/code.h | 3 +- lib/bind/dns/dns/enumclass.h | 2 +- lib/bind/dns/dns/enumtype.h | 2 +- lib/bind/dns/dns/rdatastruct.h | 2 +- lib/bind/isc/Makefile | 5 +- lib/bind/isc/isc/platform.h | 6 + usr.sbin/dnssec-importkey/Makefile | 24 + usr.sbin/named/Makefile | 1 + 312 files changed, 22242 insertions(+), 13967 deletions(-) create mode 100644 contrib/bind9/bin/dnssec/dnssec-importkey.8 create mode 100644 contrib/bind9/bin/dnssec/dnssec-importkey.c create mode 100644 contrib/bind9/bin/dnssec/dnssec-importkey.docbook create mode 100644 contrib/bind9/bin/dnssec/dnssec-importkey.html create mode 100644 contrib/bind9/doc/arm/man.dnssec-checkds.html create mode 100644 contrib/bind9/doc/arm/man.dnssec-coverage.html create mode 100644 contrib/bind9/lib/dns/include/dns/rrl.h create mode 100644 contrib/bind9/lib/dns/rrl.c create mode 100644 contrib/bind9/lib/isc/include/isc/safe.h create mode 100644 contrib/bind9/lib/isc/include/isc/tm.h create mode 100644 contrib/bind9/lib/isc/safe.c create mode 100644 contrib/bind9/lib/isc/tm.c create mode 100644 usr.sbin/dnssec-importkey/Makefile diff --git a/contrib/bind9/CHANGES b/contrib/bind9/CHANGES index 4e3152fd0..00a0ffd0c 100644 --- a/contrib/bind9/CHANGES +++ b/contrib/bind9/CHANGES @@ -1,13 +1,395 @@ - --- 9.9.3-P2 released --- + --- 9.9.5 released --- + + --- 9.9.5rc2 released --- + +3710. [bug] Address double dns_zone_detach when switching to + using automatic empty zones from regular zones. + [RT #35177] + +3709. [port] Use built-in versions of strptime() and timegm() + on all platforms to avoid portability issues. + [RT #35183] + +3708. [bug] Address a portentry locking issue in dispatch.c. + [RT #35128] + +3707. [bug] irs_resconf_load now returns ISC_R_FILENOTFOUND + on a missing resolv.conf file and initializes the + structure as if it had been configured with: + + nameserver ::1 + nameserver 127.0.0.1 + + Note: Callers will need to be updated to treat + ISC_R_FILENOTFOUND as a qualified success or else + they will leak memory. The following code fragment + will work with both old and new versions without + changing the behaviour of the existing code. + + resconf = NULL; + result = irs_resconf_load(mctx, "/etc/resolv.conf", + &resconf); + if (result != ISC_SUCCESS) { + if (resconf != NULL) + irs_resconf_destroy(&resconf); + .... + } + + [RT #35194] + +3706. [contrib] queryperf: Fixed a possible integer overflow when + printing results. [RT #35182] + +3704. [protocol] Accept integer timestamps in RRSIG records. [RT #35185] + + --- 9.9.5rc1 released --- + +3701. [func] named-checkconf can now obscure shared secrets + when printing by specifying '-x'. [RT #34465] + +3699. [bug] Improvements to statistics channel XSL stylesheet: + the stylesheet can now be cached by the browser; + section headers are omitted from the stats display + when there is no data in those sections to be + displayed; counters are now right-justified for + easier readability. (Only available with + configure --enable-newstats.) [RT #35117] + +3698. [cleanup] Replaced all uses of memcpy() with memmove(). + [RT #35120] + +3697. [bug] Handle "." as a search list element when IDN support + is enabled. [RT #35133] + +3696. [bug] dig failed to handle AXFR style IXFR responses which + span multiple messages. [RT #35137] + +3695. [bug] Address a possible race in dispatch.c. [RT #35107] + +3694. [bug] Warn when a key-directory is configured for a zone, + but does not exist or is not a directory. [RT #35108] + +3693. [security] memcpy was incorrectly called with overlapping + ranges resulting in malformed names being generated + on some platforms. This could cause INSIST failures + when serving NSEC3 signed zones (CVE-2014-0591). + [RT #35120] + +3692. [bug] Two calls to dns_db_getoriginnode were fatal if there + was no data at the node. [RT #35080] + +3690. [bug] Iterative responses could be missed when the source + port for an upstream query was the same as the + listener port (53). [RT #34925] + +3689. [bug] Fixed a bug causing an insecure delegation from one + static-stub zone to another to fail with a broken + trust chain. [RT #35081] + + --- 9.9.5b1 released --- + +3688. [bug] loadnode could return a freed node on out of memory. + [RT #35106] + +3687. [bug] Address null pointer dereference in zone_xfrdone. + [RT #35042] + +3686. [func] "dnssec-signzone -Q" drops signatures from keys + that are still published but no longer active. + [RT #34990] + +3685. [bug] "rndc refresh" didn't work correctly with slave + zones using inline-signing. [RT #35105] + +3683. [cleanup] Add a more detailed "not found" message to rndc + commands which specify a zone name. [RT #35059] + +3682. [bug] Correct the behavior of rndc retransfer to allow + inline-signing slave zones to retain NSEC3 parameters + instead of reverting to NSEC. [RT #34745] + +3681. [port] Update the Windows build system to support feature + selection and WIN64 builds. This is a work in + progress. [RT #34160] + +3679. [bug] dig could fail to clean up TCP sockets still + waiting on connect(). [RT #35074] + +3678. [port] Update config.guess and config.sub. [RT #35060] + +3677. [bug] 'nsupdate' leaked memory if 'realm' was used multiple + times. [RT #35073] + +3676. [bug] "named-checkconf -z" now checks zones of type + hint and redirect as well as master. [RT #35046] + +3675. [misc] Provide a place for third parties to add version + information for their extensions in the version + file by setting the EXTENSIONS variable. + +3674. [bug] RPZ zeroed ttls if the query type was '*'. [RT #35026] + +3672. [func] Local address can now be specified when using + dns_client API. [RT #34811] + +3671. [bug] Don't allow dnssec-importkey overwrite a existing + non-imported private key. + +3670. [bug] Address read after free in server side of + lwres_getrrsetbyname. [RT #29075] + +3669. [port] freebsd: --with-gssapi needs -lhx509. [RT #35001] + +3668. [bug] Fix cast in lex.c which could see 0xff treated as eof. + [RT #34993] + +3667. [test] dig: add support to keep the TCP socket open between + successive queries (+[no]keepopen). [RT #34918] + +3665. [bug] Failure to release lock on error in receive_secure_db. + [RT #34944] + +3664. [bug] Updated OpenSSL PKCS#11 patches to fix active list + locking and other bugs. [RT #34855] + +3663. [bug] Address bugs in dns_rdata_fromstruct and + dns_rdata_tostruct for WKS and ISDN types. [RT #34910] + +3662. [bug] 'host' could die if a UDP query timed out. [RT #34870] + +3661. [bug] Address lock order reversal deadlock with inline zones. + [RT #34856] + +3660. [cleanup] Changed the name of "isc-config.sh" to "bind9-config". + [RT #23825] + +3659. [port] solaris: don't add explict dependancies/rules for + python programs as make won't use the implicit rules. + [RT #34835] + +3658. [port] linux: Address platform specific compilation issue + when libcap-devel is installed. [RT #34838] + +3657. [port] Some readline clones don't accept NULL pointers when + calling add_history. [RT #34842] + +3656. [security] Treat an all zero netmask as invalid when generating + the localnets acl. (The prior behavior could + allow unexpected matches when using some versions + of Winsock: CVE-2013-6320.) [RT #34687] + +3655. [cleanup] Simplify TCP message processing when requesting a + zone transfer. [RT #34825] + +3654. [bug] Address race condition with manual notify requests. + [RT #34806] + +3653. [func] Create delegations for all "children" of empty zones + except "forward first". [RT #34826] + +3651. [tuning] Adjust when a master server is deemed unreachable. + [RT #27075] + +3650. [tuning] Use separate rate limiting queues for refresh and + notify requests. [RT #30589] + +3649. [cleanup] Include a comment in .nzf files, giving the name of + the associated view. [RT #34765] + +3648. [test] Updated the ATF test framework to version 0.17. + [RT #25627] + +3647. [bug] Address a race condition when shutting down a zone. + [RT #34750] + +3646. [bug] Journal filename string could be set incorrectly, + causing garbage in log messages. [RT #34738] + +3645. [protocol] Use case sensitive compression when responding to + queries. [RT #34737] + +3644. [protocol] Check that EDNS subnet client options are well formed. + [RT #34718] + +3642. [func] Allow externally generated DNSKEY to be imported + into the DNSKEY management framework. A new tool + dnssec-importkey is used to do this. [RT #34698] + +3641. [bug] Handle changes to sig-validity-interval settings + better. [RT #34625] + +3640. [bug] ndots was not being checked when searching. Only + continue searching on NXDOMAIN responses. Add the + ability to specify ndots to nslookup. [RT #34711] + +3639. [bug] Treat type 65533 (KEYDATA) as opaque except when used + in a key zone. [RT #34238] + + --- 9.9.4 released --- + +3643. [doc] Clarify RRL "slip" documentation. + +3638. [cleanup] Add the ability to handle ENOPROTOOPT in case it is + encountered. [RT #34668] + + --- 9.9.4rc2 released --- + +3637. [bug] 'allow-query-on' was checking the source address + rather than the destination address. [RT #34590] + +3636. [bug] Automatic empty zones now behave better with + forward only "zones" beneath them. [RT #34583] + +3635. [bug] Signatures were not being removed from a zone with + only KSK keys for a algorithm. [RT #34439] + +3634. [func] Report build-id in rndc status. Report build-id + when building from a git repository. [RT #20422] + +3633. [cleanup] Refactor OPT processing in named to make it easier + to support new EDNS options. [RT #34414] + +3632. [bug] Signature from newly inactive keys were not being + removed. [RT #32178] + +3631. [bug] Remove spurious warning about missing signatures when + qtype is SIG. [RT #34600] + +3630. [bug] Ensure correct ID computation for MD5 keys. [RT #33033] + +3627. [bug] RPZ changes were not effective on slaves. [RT #34450] + +3625. [bug] Don't send notify messages to machines outside of the + test setup. + +3623. [bug] zone-statistics was only effective in new statistics. + [RT #34466] + + --- 9.9.4rc1 released --- 3621. [security] Incorrect bounds checking on private type 'keydata' can lead to a remotely triggerable REQUIRE failure (CVE-2013-4854). [RT #34238] - --- 9.9.3-P1 released --- +3617. [bug] Named was failing to answer queries during + "rndc reload" [RT #34098] + +3616. [bug] Change #3613 was incomplete. [RT #34177] + +3615. [cleanup] "configure" now finishes by printing a summary + of optional BIND features and whether they are + active or inactive. ("configure --enable-full-report" + increases the verbosity of the summary.) [RT #31777] + +3614. [port] Check for . [RT #34162] + +3613. [bug] named could crash when deleting inline-signing + zones with "rndc delzone". [RT #34066] + +3611. [bug] Improved resistance to a theoretical authentication + attack based on differential timing. [RT #33939] + +3610. [cleanup] win32: Some executables had been omitted from the + installer. [RT #34116] + +3608. [port] win32: added todos.pl script to ensure all text files + the win32 build depends on are converted to DOS + newline format. [RT #22067] + +3607. [bug] dnssec-keygen had broken 'Invalid keyfile' error + message. [RT #34045] + + --- 9.9.4b1 released --- + +3605. [port] win32: Addressed several compatibility issues + with newer versions of Visual Studio. [RT #33916] + +3603. [bug] Install . [RT #33956] + +3601. [bug] Added to PKCS#11 openssl patches a value len + attribute in DH derive key. [RT #33928] + +3600. [cleanup] dig: Fixed a typo in the warning output when receiving + an oversized response. [RT #33910] + +3599. [tuning] Check for pointer equivalence in name comparisons. + [RT #18125] + +3596. [port] Updated win32 build documentation, added + dnssec-verify. [RT #22067] + +3594. [maint] Update config.guess and config.sub. [RT #33816] + +3592. [doc] Moved documentation of rndc command options to the + rndc man page. [RT #33506] + +3590. [bug] When using RRL on recursive servers, defer + rate-limiting until after recursion is complete; + also, use correct rcode for slipped NXDOMAIN + responses. [RT #33604] + +3588. [bug] dig: addressed a memory leak in the sigchase code + that could cause a shutdown crash. [RT #33733] + +3587. [func] 'named -g' now checks the logging configuration but + does not use it. [RT #33473] + +3586. [bug] Handle errors in xmlDocDumpFormatMemoryEnc. [RT #33706] 3584. [security] Caching data from an incompletely signed zone could - trigger an assertion failure in resolver.c [RT #33690] + trigger an assertion failure in resolver.c + (CVE-2013-3919). [RT #33690] + +3583. [bug] Address memory leak in GSS-API processing [RT #33574] + +3582. [bug] Silence false positive warning regarding missing file + directive for inline slave zones. [RT #33662] + +3581. [bug] Changed the tcp-listen-queue default to 10. [RT #33029] + +3580. [bug] Addressed a possible race in acache.c [RT #33602] + +3579. [maint] Updates to PKCS#11 openssl patches, supporting + versions 0.9.8y, 1.0.0k, 1.0.1e [RT #33463] + +3578. [bug] 'rndc -c file' now fails if 'file' does not exist. + [RT #33571] + +3577. [bug] Handle zero TTL values better. [RT #33411] + +3576. [bug] Address a shutdown race when validating. [RT #33573] + +3575. [func] Changed the logging category for RRL events from + 'queries' to 'query-errors'. [RT #33540] + +3574. [doc] The 'hostname' keyword was missing from server-id + description in the named.conf man page. [RT #33476] + +3573. [bug] "rndc addzone" and "rndc delzone" incorrectly handled + zone names containing punctuation marks and other + nonstandard characters. [RT #33419] + +3571. [bug] Address race condition in dns_client_startresolve(). + [RT #33234] + +3566. [func] Log when forwarding updates to master. [RT #33240] + +3554. [bug] RRL failed to correctly rate-limit upward + referrals and failed to count dropped error + responses in the statistics. [RT #33225] + +3545. [bug] RRL slip behavior was incorrect when set to 1. + [RT #33111] + +3518. [bug] Increase the size of dns_rrl_key.s.rtype by one bit + so that all dns_rrl_rtype_t enum values fit regardless + of whether it is teated as signed or unsigned by + the compiler. [RT #32792] + +3494. [func] DNS RRL: Blunt the impact of DNS reflection and + amplification attacks by rate-limiting substantially- + identical responses. To enable, use "configure + --enable-rrl". [RT #28130] --- 9.9.3 released --- diff --git a/contrib/bind9/COPYRIGHT b/contrib/bind9/COPYRIGHT index 525c2228d..514dbe7e2 100644 --- a/contrib/bind9/COPYRIGHT +++ b/contrib/bind9/COPYRIGHT @@ -1,4 +1,4 @@ -Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") +Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") Copyright (C) 1996-2003 Internet Software Consortium. Permission to use, copy, modify, and/or distribute this software for any @@ -13,8 +13,6 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -$Id: COPYRIGHT,v 1.19 2012/01/03 23:46:59 tbox Exp $ - Portions of this code release fall under one or more of the following Copyright notices. Please see individual source files for details. @@ -99,11 +97,7 @@ are met: 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. -3. All advertising materials mentioning features or use of this software - must display the following acknowledgement: - This product includes software developed by the University of - California, Berkeley and its contributors. -4. Neither the name of the University nor the names of its contributors +3. Neither the name of the University nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. @@ -516,3 +510,29 @@ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +----------------------------------------------------------------------------- + +Copyright (c) 1995, 1997, 1998 The NetBSD Foundation, Inc. +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS +``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED +TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS +BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + diff --git a/contrib/bind9/Makefile.in b/contrib/bind9/Makefile.in index 7c1d66523..2c5985f81 100644 --- a/contrib/bind9/Makefile.in +++ b/contrib/bind9/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2009, 2011-2014 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -54,7 +54,11 @@ installdirs: install:: isc-config.sh installdirs ${INSTALL_SCRIPT} isc-config.sh ${DESTDIR}${bindir} + rm -f ${DESTDIR}${bindir}/bind9-config + @LN@ ${DESTDIR}${bindir}/isc-config.sh ${DESTDIR}${bindir}/bind9-config ${INSTALL_DATA} ${top_srcdir}/isc-config.sh.1 ${DESTDIR}${mandir}/man1 + rm -f ${DESTDIR}${mandir}/man1/bind9-config.1 + @LN@ ${DESTDIR}${mandir}/man1/isc-config.sh.1 ${DESTDIR}${mandir}/man1/bind9-config.1 ${INSTALL_DATA} ${top_srcdir}/bind.keys ${DESTDIR}${sysconfdir} tags: @@ -86,5 +90,8 @@ FAQ: FAQ.xml LC_ALL=C ${W3M} -T text/html -dump -cols 72 >$@.tmp mv $@.tmp $@ +unit:: + sh ${top_srcdir}/unit/unittest.sh + clean:: rm -f FAQ.tmp diff --git a/contrib/bind9/README b/contrib/bind9/README index 88d799e4f..718b71a97 100644 --- a/contrib/bind9/README +++ b/contrib/bind9/README @@ -48,8 +48,34 @@ BIND 9 For a detailed list of user-visible changes from previous releases, see the CHANGES file. - For up-to-date release notes and errata, see - http://www.isc.org/software/bind9/releasenotes + For up-to-date release notes and errata, see + http://www.isc.org/software/bind9/releasenotes + +BIND 9.9.5 + + BIND 9.9.5 is a maintenance release, and patches the security + flaws described in CVE-2013-6320 and CVE-2014-0591. It also + includes the following functional enhancements: + + - "named" now preserves the capitalization of names when + responding to queries. + - new "dnssec-importkey" command allows the use of offline + DNSSEC keys with automatic DNSKEY management. + - When re-signing a zone, the new "dnssec-signzone -Q" option + drops signatures from keys that are still published but are + no longer active. + - "named-checkconf -px" will print the contents of configuration + files with the shared secrets obscured, making it easier to + share configuration (e.g. when submitting a bug report) + without revealing private information. + +BIND 9.9.4 + + BIND 9.9.4 is a maintenance release, and patches the security + flaws described in CVE-2013-3919 and CVE-2013-4854. It also + introduces DNS Response Rate Limiting (DNS RRL) as a + compile-time option. To use this feature, configure with + the "--enable-rrl" option. BIND 9.9.3 @@ -70,45 +96,45 @@ BIND 9.9.0 BIND 9.9.0 includes a number of changes from BIND 9.8 and earlier releases. New features include: - - Inline signing, allowing automatic DNSSEC signing of - master zones without modification of the zonefile, or - "bump in the wire" signing in slaves. - - NXDOMAIN redirection. - - New 'rndc flushtree' command clears all data under a given - name from the DNS cache. - - New 'rndc sync' command dumps pending changes in a dynamic - zone to disk without a freeze/thaw cycle. - - New 'rndc signing' command displays or clears signing status - records in 'auto-dnssec' zones. - - NSEC3 parameters for 'auto-dnssec' zones can now be set prior - to signing, eliminating the need to initially sign with NSEC. - - Startup time improvements on large authoritative servers. - - Slave zones are now saved in raw format by default. - - Several improvements to response policy zones (RPZ). - - Improved hardware scalability by using multiple threads - to listen for queries and using finer-grained client locking - - The 'also-notify' option now takes the same syntax as - 'masters', so it can used named masterlists and TSIG keys. - - 'dnssec-signzone -D' writes an output file containing only DNSSEC - data, which can be included by the primary zone file. - - 'dnssec-signzone -R' forces removal of signatures that are - not expired but were created by a key which no longer exists. - - 'dnssec-signzone -X' allows a separate expiration date to - be specified for DNSKEY signatures from other signatures. - - New '-L' option to dnssec-keygen, dnssec-settime, and - dnssec-keyfromlabel sets the default TTL for the key. - - dnssec-dsfromkey now supports reading from standard input, - to make it easier to convert DNSKEY to DS. - - RFC 1918 reverse zones have been added to the empty-zones - table per RFC 6303. - - Dynamic updates can now optionally set the zone's SOA serial - number to the current UNIX time. - - DLZ modules can now retrieve the source IP address of - the querying client. - - 'request-ixfr' option can now be set at the per-zone level. - - 'dig +rrcomments' turns on comments about DNSKEY records, - indicating their key ID, algorithm and function - - Simplified nsupdate syntax and added readline support + - Inline signing, allowing automatic DNSSEC signing of + master zones without modification of the zonefile, or + "bump in the wire" signing in slaves. + - NXDOMAIN redirection. + - New 'rndc flushtree' command clears all data under a given + name from the DNS cache. + - New 'rndc sync' command dumps pending changes in a dynamic + zone to disk without a freeze/thaw cycle. + - New 'rndc signing' command displays or clears signing status + records in 'auto-dnssec' zones. + - NSEC3 parameters for 'auto-dnssec' zones can now be set prior + to signing, eliminating the need to initially sign with NSEC. + - Startup time improvements on large authoritative servers. + - Slave zones are now saved in raw format by default. + - Several improvements to response policy zones (RPZ). + - Improved hardware scalability by using multiple threads + to listen for queries and using finer-grained client locking + - The 'also-notify' option now takes the same syntax as + 'masters', so it can used named masterlists and TSIG keys. + - 'dnssec-signzone -D' writes an output file containing only DNSSEC + data, which can be included by the primary zone file. + - 'dnssec-signzone -R' forces removal of signatures that are + not expired but were created by a key which no longer exists. + - 'dnssec-signzone -X' allows a separate expiration date to + be specified for DNSKEY signatures from other signatures. + - New '-L' option to dnssec-keygen, dnssec-settime, and + dnssec-keyfromlabel sets the default TTL for the key. + - dnssec-dsfromkey now supports reading from standard input, + to make it easier to convert DNSKEY to DS. + - RFC 1918 reverse zones have been added to the empty-zones + table per RFC 6303. + - Dynamic updates can now optionally set the zone's SOA serial + number to the current UNIX time. + - DLZ modules can now retrieve the source IP address of + the querying client. + - 'request-ixfr' option can now be set at the per-zone level. + - 'dig +rrcomments' turns on comments about DNSKEY records, + indicating their key ID, algorithm and function + - Simplified nsupdate syntax and added readline support Building @@ -128,9 +154,9 @@ Building Ubuntu 7.04, 7.10 Windows XP/2003/2008 - NOTE: As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of - Windows, including Windows NT and Windows 2000, are no longer - supported. + NOTE: As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of + Windows, including Windows NT and Windows 2000, are no longer + supported. We have recent reports from the user community that a supported version of BIND will build and run on the following systems: @@ -231,10 +257,10 @@ Building on the configure command line. The default is operating system dependent. - Support for the "fixed" rrset-order option can be enabled - or disabled by specifying "--enable-fixed-rrset" or - "--disable-fixed-rrset" on the configure command line. - The default is "disabled", to reduce memory footprint. + Support for the "fixed" rrset-order option can be enabled + or disabled by specifying "--enable-fixed-rrset" or + "--disable-fixed-rrset" on the configure command line. + The default is "disabled", to reduce memory footprint. If your operating system has integrated support for IPv6, it will be used automatically. If you have installed KAME IPv6 @@ -305,8 +331,8 @@ Documentation Frequently asked questions and their answers can be found in FAQ. - Additional information on various subjects can be found - in the other README files. + Additional information on various subjects can be found + in the other README files. Change Log @@ -337,10 +363,10 @@ Change Log [protocol] Updates to the DNS protocol such as new RR types - [test] Changes to the automatic tests, not - affecting server functionality + [test] Changes to the automatic tests, not + affecting server functionality - [cleanup] Minor corrections and refactoring + [cleanup] Minor corrections and refactoring [doc] Documentation diff --git a/contrib/bind9/bin/check/named-checkconf.8 b/contrib/bind9/bin/check/named-checkconf.8 index 67a8f4a3d..909184ef2 100644 --- a/contrib/bind9/bin/check/named-checkconf.8 +++ b/contrib/bind9/bin/check/named-checkconf.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2002 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -33,7 +33,7 @@ named\-checkconf \- named configuration file syntax checking tool .SH "SYNOPSIS" .HP 16 -\fBnamed\-checkconf\fR [\fB\-h\fR] [\fB\-v\fR] [\fB\-j\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename} [\fB\-p\fR] [\fB\-z\fR] +\fBnamed\-checkconf\fR [\fB\-h\fR] [\fB\-v\fR] [\fB\-j\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename} [\fB\-p\fR] [\fB\-x\fR] [\fB\-z\fR] .SH "DESCRIPTION" .PP \fBnamed\-checkconf\fR @@ -84,6 +84,14 @@ Print out the and included files in canonical form if no errors were detected. .RE .PP +\-x +.RS 4 +When printing the configuration files in canonical form, obscure shared secrets by replacing them with strings of question marks ('?'). This allows the contents of +\fInamed.conf\fR +and related files to be shared \(em for example, when submitting bug reports \(em without compromising private data. This option cannot be used without +\fB\-p\fR. +.RE +.PP \-z .RS 4 Perform a test load of all master zones found in @@ -113,7 +121,7 @@ BIND 9 Administrator Reference Manual. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2002 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/check/named-checkconf.c b/contrib/bind9/bin/check/named-checkconf.c index 0b3c508f2..fd3795a57 100644 --- a/contrib/bind9/bin/check/named-checkconf.c +++ b/contrib/bind9/bin/check/named-checkconf.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009-2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009-2014 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -39,10 +39,13 @@ #include +#include #include #include #include +#include #include +#include #include #include "check-tool.h" @@ -151,6 +154,30 @@ config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) { } } +static isc_result_t +configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) { + isc_result_t result; + dns_db_t *db = NULL; + dns_rdataclass_t rdclass; + isc_textregion_t r; + + if (zfile == NULL) + return (ISC_R_FAILURE); + + DE_CONST(zclass, r.base); + r.length = strlen(zclass); + result = dns_rdataclass_fromtext(&rdclass, &r); + if (result != ISC_R_SUCCESS) + return (result); + + result = dns_rootns_create(mctx, rdclass, zfile, &db); + if (result != ISC_R_SUCCESS) + return (result); + + dns_db_detach(&db); + return (ISC_R_SUCCESS); +} + /*% configure the zone */ static isc_result_t configure_zone(const char *vclass, const char *view, @@ -161,7 +188,7 @@ configure_zone(const char *vclass, const char *view, isc_result_t result; const char *zclass; const char *zname; - const char *zfile; + const char *zfile = NULL; const cfg_obj_t *maps[4]; const cfg_obj_t *zoptions = NULL; const cfg_obj_t *classobj = NULL; @@ -195,15 +222,28 @@ configure_zone(const char *vclass, const char *view, cfg_map_get(zoptions, "type", &typeobj); if (typeobj == NULL) return (ISC_R_FAILURE); - if (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) + + cfg_map_get(zoptions, "file", &fileobj); + if (fileobj != NULL) + zfile = cfg_obj_asstring(fileobj); + + /* + * Check hints files for hint zones. + * Skip loading checks for any type other than + * master and redirect + */ + if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) + return (configure_hint(zfile, zclass, mctx)); + else if ((strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) && + (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0)) return (ISC_R_SUCCESS); + + if (zfile == NULL) + return (ISC_R_FAILURE); + cfg_map_get(zoptions, "database", &dbobj); if (dbobj != NULL) return (ISC_R_SUCCESS); - cfg_map_get(zoptions, "file", &fileobj); - if (fileobj == NULL) - return (ISC_R_FAILURE); - zfile = cfg_obj_asstring(fileobj); obj = NULL; if (get_maps(maps, "check-dup-records", &obj)) { @@ -341,7 +381,7 @@ configure_zone(const char *vclass, const char *view, if (result != ISC_R_SUCCESS) fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass, dns_result_totext(result)); - return(result); + return (result); } /*% configure a view */ @@ -442,10 +482,11 @@ main(int argc, char **argv) { isc_entropy_t *ectx = NULL; isc_boolean_t load_zones = ISC_FALSE; isc_boolean_t print = ISC_FALSE; + unsigned int flags = 0; isc_commandline_errprint = ISC_FALSE; - while ((c = isc_commandline_parse(argc, argv, "dhjt:pvz")) != EOF) { + while ((c = isc_commandline_parse(argc, argv, "dhjt:pvxz")) != EOF) { switch (c) { case 'd': debug++; @@ -472,6 +513,10 @@ main(int argc, char **argv) { printf(VERSION "\n"); exit(0); + case 'x': + flags |= CFG_PRINTER_XKEY; + break; + case 'z': load_zones = ISC_TRUE; docheckmx = ISC_FALSE; @@ -494,6 +539,11 @@ main(int argc, char **argv) { } } + if (((flags & CFG_PRINTER_XKEY) != 0) && !print) { + fprintf(stderr, "%s: -x cannot be used without -p\n", program); + exit(1); + } + if (isc_commandline_index + 1 < argc) usage(); if (argv[isc_commandline_index] != NULL) @@ -534,7 +584,7 @@ main(int argc, char **argv) { } if (print && exit_status == 0) - cfg_print(config, output, NULL); + cfg_printx(config, flags, output, NULL); cfg_obj_destroy(parser, &config); cfg_parser_destroy(&parser); diff --git a/contrib/bind9/bin/check/named-checkconf.docbook b/contrib/bind9/bin/check/named-checkconf.docbook index 9535e2843..485dc42a9 100644 --- a/contrib/bind9/bin/check/named-checkconf.docbook +++ b/contrib/bind9/bin/check/named-checkconf.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> + + + + + August 30, 2013 + + + + dnssec-importkey + 8 + BIND9 + + + + dnssec-importkey + Import DNSKEY records from external systems so they can be managed. + + + + + 2013 + Internet Systems Consortium, Inc. ("ISC") + + + + + + dnssec-importkey + + + + + + + + + + dnssec-importkey + + + + + + + + + + + + + DESCRIPTION + dnssec-importkey + reads a public DNSKEY record and generates a pair of + .key/.private files. The DNSKEY record may be read from an + existing .key file, in which case a corresponding .private file + will be generated, or it may be read from any other file or + from the standard input, in which case both .key and .private + files will be generated. + + + The newly-created .private file does not + contain private key data, and cannot be used for signing. + However, having a .private file makes it possible to set + publication () and deletion + () times for the key, which means the + public key can be added to and removed from the DNSKEY RRset + on schedule even if the true private key is stored offline. + + + + + OPTIONS + + + + -f filename + + + Zone file mode: instead of a public keyfile name, the argument + is the DNS domain name of a zone master file, which can be read + from . If the domain name is the same as + , then it may be omitted. + + + If is set to "-", then + the zone data is read from the standard input. + + + + + + -K directory + + + Sets the directory in which the key files are to reside. + + + + + + -L ttl + + + Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + 0 or none removes it. + + + + + + -h + + + Emit usage message and exit. + + + + + + -v level + + + Sets the debugging level. + + + + + + + + + TIMING OPTIONS + + Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. + If the argument begins with a '+' or '-', it is interpreted as + an offset from the present time. For convenience, if such an offset + is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', + then the offset is computed in years (defined as 365 24-hour days, + ignoring leap years), months (defined as 30 24-hour days), weeks, + days, hours, or minutes, respectively. Without a suffix, the offset + is computed in seconds. To unset a date, use 'none'. + + + + + -P date/offset + + + Sets the date on which a key is to be published to the zone. + After that date, the key will be included in the zone but will + not be used to sign it. + + + + + + -D date/offset + + + Sets the date on which the key is to be deleted. After that + date, the key will no longer be included in the zone. (It + may remain in the key repository, however.) + + + + + + + + + FILES + + A keyfile can be designed by the key identification + Knnnn.+aaa+iiiii or the full file name + Knnnn.+aaa+iiiii.key as generated by + dnssec-keygen8. + + + + + SEE ALSO + + dnssec-keygen8 + , + + dnssec-signzone8 + , + BIND 9 Administrator Reference Manual, + RFC 5011. + + + + + AUTHOR + Internet Systems Consortium + + + + diff --git a/contrib/bind9/bin/dnssec/dnssec-importkey.html b/contrib/bind9/bin/dnssec/dnssec-importkey.html new file mode 100644 index 000000000..55729ba56 --- /dev/null +++ b/contrib/bind9/bin/dnssec/dnssec-importkey.html @@ -0,0 +1,113 @@ + + + + + + +dnssec-importkey + + +
+
+
+

Name

+

dnssec-importkey — Import DNSKEY records from external systems so they can be managed.

+
+
+

Synopsis

+

dnssec-importkey [-f filename] [-K directory] [-P date/offset] [-D date/offset] [-h] [-v level] [keyname]

+
+
+

DESCRIPTION

+

dnssec-importkey + read a DNSKEY record and generated a .key/.private key pair. + Publication (-P) and deletions (-D) + times can be set for the key. +

+
+
+

OPTIONS

+
+
-f filename
+

+ Filename to read the key from. +

+
-K directory
+

+ Sets the directory in which the key files are to reside. +

+
-L ttl
+

+ Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. importkey the default TTL to + 0 or none removes it. +

+
-h
+

+ Emit usage message and exit. +

+
-v level
+

+ Sets the debugging level. +

+
+
+
+

TIMING OPTIONS

+

+ Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. + If the argument begins with a '+' or '-', it is interpreted as + an offset from the present time. For convenience, if such an offset + is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', + then the offset is computed in years (defined as 365 24-hour days, + ignoring leap years), months (defined as 30 24-hour days), weeks, + days, hours, or minutes, respectively. Without a suffix, the offset + is computed in seconds. To unset a date, use 'none'. +

+
+
-P date/offset
+

+ Sets the date on which a key is to be published to the zone. + After that date, the key will be included in the zone but will + not be used to sign it. +

+
-D date/offset
+

+ Sets the date on which the key is to be deleted. After that + date, the key will no longer be included in the zone. (It + may remain in the key repository, however.) +

+
+
+
+

SEE ALSO

+

dnssec-keygen(8), + dnssec-signzone(8), + BIND 9 Administrator Reference Manual, + RFC 5011. +

+
+
+

AUTHOR

+

Internet Systems Consortium +

+
+
+ diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.c b/contrib/bind9/bin/dnssec/dnssec-keygen.c index 1e61ca392..706182977 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keygen.c +++ b/contrib/bind9/bin/dnssec/dnssec-keygen.c @@ -655,9 +655,9 @@ main(int argc, char **argv) { mctx, &prevkey); if (ret != ISC_R_SUCCESS) fatal("Invalid keyfile %s: %s", - filename, isc_result_totext(ret)); + predecessor, isc_result_totext(ret)); if (!dst_key_isprivate(prevkey)) - fatal("%s is not a private key", filename); + fatal("%s is not a private key", predecessor); name = dst_key_name(prevkey); alg = dst_key_alg(prevkey); diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.c b/contrib/bind9/bin/dnssec/dnssec-settime.c index 4c88a07ac..108d8033c 100644 --- a/contrib/bind9/bin/dnssec/dnssec-settime.c +++ b/contrib/bind9/bin/dnssec/dnssec-settime.c @@ -370,7 +370,7 @@ main(int argc, char **argv) { if (result != ISC_R_SUCCESS) fatal("Invalid keyfile %s: %s", filename, isc_result_totext(result)); - if (!dst_key_isprivate(prevkey)) + if (!dst_key_isprivate(prevkey) && !dst_key_isexternal(prevkey)) fatal("%s is not a private key", filename); name = dst_key_name(prevkey); @@ -462,7 +462,7 @@ main(int argc, char **argv) { fatal("Invalid keyfile %s: %s", filename, isc_result_totext(result)); - if (!dst_key_isprivate(key)) + if (!dst_key_isprivate(key) && !dst_key_isexternal(key)) fatal("%s is not a private key", filename); dst_key_format(key, keystr, sizeof(keystr)); diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.8 b/contrib/bind9/bin/dnssec/dnssec-signzone.8 index c91749569..d35a54b99 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.8 +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -260,15 +260,25 @@ Disable post sign verification tests. The post sign verification test ensures that for each algorithm in use there is at least one non revoked self signed KSK key, that all revoked KSK keys are self signed, and that all records in the zone are signed by the algorithm. This option skips these tests. .RE .PP -\-R +\-Q .RS 4 -Remove signatures from keys that no longer exist. +Remove signatures from keys that are no longer active. .sp Normally, when a previously\-signed zone is passed as input to the signer, and a DNSKEY record has been removed and replaced with a new one, signatures from the old key that are still within their validity period are retained. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset. The -\fB\-R\fR +\fB\-Q\fR forces \fBdnssec\-signzone\fR -to remove all orphaned signatures. +to remove signatures from keys that are no longer active. This enables ZSK rollover using the procedure described in RFC 4641, section 4.2.1.1 ("Pre\-Publish Key Rollover"). +.RE +.PP +\-R +.RS 4 +Remove signatures from keys that are no longer published. +.sp +This option is similar to +\fB\-Q\fR, except it forces +\fBdnssec\-signzone\fR +to signatures from keys that are no longer published. This enables ZSK rollover using the procedure described in RFC 4641, section 4.2.1.2 ("Double Signature Zone Signing Key Rollover"). .RE .PP \-r \fIrandomdev\fR @@ -359,7 +369,7 @@ Generate an NSEC3 chain with the given hex encoded salt. A dash (\fIsalt\fR) can .PP \-H \fIiterations\fR .RS 4 -When generating an NSEC3 chain, use this many interations. The default is 10. +When generating an NSEC3 chain, use this many iterations. The default is 10. .RE .PP \-A @@ -423,12 +433,13 @@ db.example.com.signed .PP \fBdnssec\-keygen\fR(8), BIND 9 Administrator Reference Manual, -RFC 4033. +RFC 4033, +RFC 4641. .SH "AUTHOR" .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2004\-2009, 2011 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2004\-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000\-2003 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.c b/contrib/bind9/bin/dnssec/dnssec-signzone.c index 83456a7db..0a13d9fa0 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.c +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.c @@ -1,5 +1,5 @@ /* - * Portions Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -175,7 +175,8 @@ static isc_boolean_t update_chain = ISC_FALSE; static isc_boolean_t set_keyttl = ISC_FALSE; static dns_ttl_t keyttl; static isc_boolean_t smartsign = ISC_FALSE; -static isc_boolean_t remove_orphans = ISC_FALSE; +static isc_boolean_t remove_orphansigs = ISC_FALSE; +static isc_boolean_t remove_inactkeysigs = ISC_FALSE; static isc_boolean_t output_dnssec_only = ISC_FALSE; static isc_boolean_t output_stdout = ISC_FALSE; @@ -554,9 +555,14 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name, "private dnskey not found\n", sigstr); } else if (key == NULL || future) { - keep = (!expired && !remove_orphans); + keep = (!expired && !remove_orphansigs); vbprintf(2, "\trrsig by %s %s - dnskey not found\n", keep ? "retained" : "dropped", sigstr); + } else if (!dns_dnssec_keyactive(key->key, now) && + remove_inactkeysigs) { + keep = ISC_FALSE; + vbprintf(2, "\trrsig by %s dropped - key inactive\n", + sigstr); } else if (issigningkey(key)) { wassignedby[key->index] = ISC_TRUE; @@ -571,7 +577,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name, "ttl change" : "failed to verify"); resign = ISC_TRUE; } - } else if (!ispublishedkey(key) && remove_orphans) { + } else if (!ispublishedkey(key) && remove_orphansigs) { vbprintf(2, "\trrsig by %s dropped - dnskey removed\n", sigstr); } else if (iszonekey(key)) { @@ -724,7 +730,7 @@ hashlist_add(hashlist_t *l, const unsigned char *hash, size_t len) fatal("unable to grow hashlist: out of memory"); } memset(l->hashbuf + l->entries * l->length, 0, l->length); - memcpy(l->hashbuf + l->entries * l->length, hash, len); + memmove(l->hashbuf + l->entries * l->length, hash, len); l->entries++; } @@ -739,7 +745,8 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name, unsigned int len; size_t i; - len = isc_iterated_hash(hash, hashalg, iterations, salt, salt_length, + len = isc_iterated_hash(hash, hashalg, iterations, + salt, (int)salt_length, name->ndata, name->length); if (verbose) { dns_name_format(name, nametext, sizeof nametext); @@ -791,7 +798,7 @@ static const unsigned char * hashlist_findnext(const hashlist_t *l, const unsigned char hash[NSEC3_MAX_HASH_LENGTH]) { - unsigned int entries = l->entries; + size_t entries = l->entries; const unsigned char *next = bsearch(hash, l->hashbuf, l->entries, l->length, hashlist_comp); INSIST(next != NULL); @@ -803,8 +810,8 @@ hashlist_findnext(const hashlist_t *l, next = l->hashbuf; if (next[l->length - 1] == 0) break; - } while (entries-- > 1); - INSIST(entries != 0); + } while (entries-- > 1U); + INSIST(entries != 0U); return (next); } @@ -1809,7 +1816,7 @@ nsecify(void) { static void addnsec3param(const unsigned char *salt, size_t salt_length, - unsigned int iterations) + dns_iterations_t iterations) { dns_dbnode_t *node = NULL; dns_rdata_nsec3param_t nsec3param; @@ -1829,7 +1836,7 @@ addnsec3param(const unsigned char *salt, size_t salt_length, nsec3param.flags = 0; nsec3param.hash = unknownalg ? DNS_NSEC3_UNKNOWNALG : dns_hash_sha1; nsec3param.iterations = iterations; - nsec3param.salt_length = salt_length; + nsec3param.salt_length = (unsigned char)salt_length; DE_CONST(salt, nsec3param.salt); isc_buffer_init(&b, nsec3parambuf, sizeof(nsec3parambuf)); @@ -2126,7 +2133,7 @@ remove_duplicates(void) { * Generate NSEC3 records for the zone. */ static void -nsec3ify(unsigned int hashalg, unsigned int iterations, +nsec3ify(unsigned int hashalg, dns_iterations_t iterations, const unsigned char *salt, size_t salt_length, hashlist_t *hashlist) { dns_dbiterator_t *dbiter = NULL; @@ -2661,7 +2668,7 @@ set_nsec3params(isc_boolean_t update_chain, isc_boolean_t set_salt, "Use -u to update it."); } else if (!set_salt) { salt_length = orig_saltlen; - memcpy(saltbuf, orig_salt, orig_saltlen); + memmove(saltbuf, orig_salt, orig_saltlen); salt = saltbuf; } @@ -2948,6 +2955,9 @@ usage(void) { fprintf(stderr, "use pseudorandom data (faster but less secure)\n"); fprintf(stderr, "\t-P:\t"); fprintf(stderr, "disable post-sign verification\n"); + fprintf(stderr, "\t-Q:\t"); + fprintf(stderr, "remove signatures from keys that are no " + "longer active\n"); fprintf(stderr, "\t-R:\t"); fprintf(stderr, "remove signatures from keys that no longer exist\n"); fprintf(stderr, "\t-T TTL:\tTTL for newly added DNSKEYs\n"); @@ -3051,8 +3061,9 @@ main(int argc, char *argv[]) { isc_boolean_t set_iter = ISC_FALSE; isc_boolean_t nonsecify = ISC_FALSE; + /* Unused letters: Bb G J M q Yy (and F is reserved). */ #define CMDLINE_FLAGS \ - "3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:n:N:o:O:PpRr:s:ST:tuUv:X:xzZ:" + "3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:n:N:o:O:PpQRr:s:ST:tuUv:X:xzZ:" /* * Process memory debugging argument first. @@ -3255,8 +3266,12 @@ main(int argc, char *argv[]) { pseudorandom = ISC_TRUE; break; + case 'Q': + remove_inactkeysigs = ISC_TRUE; + break; + case 'R': - remove_orphans = ISC_TRUE; + remove_orphansigs = ISC_TRUE; break; case 'r': @@ -3343,7 +3358,6 @@ main(int argc, char *argv[]) { if (result != ISC_R_SUCCESS) fatal("could not initialize dst: %s", isc_result_totext(result)); - isc_stdtime_get(&now); if (startstr != NULL) { diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.docbook b/contrib/bind9/bin/dnssec/dnssec-signzone.docbook index e427fc126..a1adafd04 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - +