summaryrefslogtreecommitdiff
path: root/external
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2011-09-11 18:55:24 +0000
committerchristos <christos@NetBSD.org>2011-09-11 18:55:24 +0000
commitd4ecc50fcd7f252a8bb7d9ee91a0fec6246e0bd2 (patch)
tree2dec4b792c2ba583292531441bd69b0dd9ed1ce8 /external
parent9feded47959dc7443fc9ce7c3c26af5d36f2523a (diff)
merge bind-9.9.0a1
Diffstat (limited to 'external')
-rw-r--r--external/bsd/bind/bin/Makefile4
-rw-r--r--external/bsd/bind/bin/named/Makefile4
-rw-r--r--external/bsd/bind/bin/tools/Makefile7
-rw-r--r--external/bsd/bind/bin/tools/Makefile.inc19
-rw-r--r--external/bsd/bind/bin/tools/arpaname/Makefile7
-rw-r--r--external/bsd/bind/bin/tools/named-journalprint/Makefile7
-rw-r--r--external/bsd/bind/bin/tools/nsec3hash/Makefile7
-rw-r--r--external/bsd/bind/dist/bin/check/named-checkconf.c8
-rw-r--r--external/bsd/bind/dist/bin/confgen/ddns-confgen.c7
-rw-r--r--external/bsd/bind/dist/bin/confgen/rndc-confgen.c7
-rw-r--r--external/bsd/bind/dist/bin/dig/dig.126
-rw-r--r--external/bsd/bind/dist/bin/dig/dig.c121
-rw-r--r--external/bsd/bind/dist/bin/dig/dighost.c61
-rw-r--r--external/bsd/bind/dist/bin/dig/host.c11
-rw-r--r--external/bsd/bind/dist/bin/dig/include/dig/dig.h9
-rw-r--r--external/bsd/bind/dist/bin/dig/nslookup.c36
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.817
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c56
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.815
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c29
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-keygen.819
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c44
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-settime.821
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-settime.c38
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-signzone.849
-rw-r--r--external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c352
-rw-r--r--external/bsd/bind/dist/bin/named/builtin.c5
-rw-r--r--external/bsd/bind/dist/bin/named/client.c136
-rw-r--r--external/bsd/bind/dist/bin/named/config.c9
-rw-r--r--external/bsd/bind/dist/bin/named/control.c12
-rw-r--r--external/bsd/bind/dist/bin/named/controlconf.c8
-rw-r--r--external/bsd/bind/dist/bin/named/include/named/control.h8
-rw-r--r--external/bsd/bind/dist/bin/named/include/named/globals.h8
-rw-r--r--external/bsd/bind/dist/bin/named/include/named/interfacemgr.h13
-rw-r--r--external/bsd/bind/dist/bin/named/include/named/server.h18
-rw-r--r--external/bsd/bind/dist/bin/named/interfacemgr.c73
-rw-r--r--external/bsd/bind/dist/bin/named/logconf.c59
-rw-r--r--external/bsd/bind/dist/bin/named/main.c37
-rw-r--r--external/bsd/bind/dist/bin/named/named.conf.515
-rw-r--r--external/bsd/bind/dist/bin/named/named.conf.docbook13
-rw-r--r--external/bsd/bind/dist/bin/named/named.conf.html21
-rw-r--r--external/bsd/bind/dist/bin/named/query.c174
-rw-r--r--external/bsd/bind/dist/bin/named/server.c671
-rw-r--r--external/bsd/bind/dist/bin/named/statschannel.c8
-rw-r--r--external/bsd/bind/dist/bin/named/unix/os.c13
-rw-r--r--external/bsd/bind/dist/bin/named/update.c67
-rw-r--r--external/bsd/bind/dist/bin/named/xfrout.c54
-rw-r--r--external/bsd/bind/dist/bin/named/zoneconf.c188
-rw-r--r--external/bsd/bind/dist/bin/nsupdate/nsupdate.c14
-rw-r--r--external/bsd/bind/dist/bin/rndc/rndc.c9
-rw-r--r--external/bsd/bind/dist/bin/tests/db/t_db.c37
-rw-r--r--external/bsd/bind/dist/bin/tests/dst/gsstest.c26
-rw-r--r--external/bsd/bind/dist/bin/tests/dst/t_dst.c72
-rw-r--r--external/bsd/bind/dist/bin/tests/master/t_master.c7
-rw-r--r--external/bsd/bind/dist/bin/tests/names/t_names.c15
-rw-r--r--external/bsd/bind/dist/bin/tests/rbt/t_rbt.c17
-rw-r--r--external/bsd/bind/dist/bin/tests/rdata_test.c33
-rw-r--r--external/bsd/bind/dist/bin/tests/resolver/t_resolver.c4
-rw-r--r--external/bsd/bind/dist/bin/tests/system/dlv/ns1/root.db24
-rw-r--r--external/bsd/bind/dist/bin/tests/system/dlzexternal/ns1/named.conf47
-rw-r--r--external/bsd/bind/dist/bin/tests/system/filter-aaaa/filter-aaaa.c13
-rw-r--r--external/bsd/bind/dist/bin/tests/system/ixfr/ans2/ans.pl157
-rw-r--r--external/bsd/bind/dist/bin/tests/system/tsiggss/ns1/example.nil.db51
-rw-r--r--external/bsd/bind/dist/bin/tests/tasks/t_tasks.c162
-rw-r--r--external/bsd/bind/dist/bin/tests/timers/t_timers.c48
-rw-r--r--external/bsd/bind/dist/bin/tools/genrandom.810
-rw-r--r--external/bsd/bind/dist/bin/tools/nsec3hash.c4
-rw-r--r--external/bsd/bind/dist/config.h.in17
-rw-r--r--external/bsd/bind/dist/contrib/dlz/drivers/dlz_dlopen_driver.c2
-rw-r--r--external/bsd/bind/dist/contrib/dlz/drivers/dlz_drivers.c18
-rw-r--r--external/bsd/bind/dist/contrib/dlz/drivers/dlz_ldap_driver.c132
-rw-r--r--external/bsd/bind/dist/contrib/dlz/drivers/include/dlz/dlz_dlopen_driver.h56
-rw-r--r--external/bsd/bind/dist/doc/draft/draft-ietf-dnsext-rfc2671bis-edns0-02.txt616
-rw-r--r--external/bsd/bind/dist/doc/draft/draft-ietf-dnsop-default-local-zones-10.txt728
-rw-r--r--external/bsd/bind/dist/doc/draft/draft-ietf-dnsop-dnssec-key-timing-00.txt1960
-rw-r--r--external/bsd/bind/dist/lib/bind9/check.c145
-rw-r--r--external/bsd/bind/dist/lib/dns/acl.c15
-rw-r--r--external/bsd/bind/dist/lib/dns/adb.c15
-rw-r--r--external/bsd/bind/dist/lib/dns/cache.c213
-rw-r--r--external/bsd/bind/dist/lib/dns/client.c14
-rw-r--r--external/bsd/bind/dist/lib/dns/diff.c20
-rw-r--r--external/bsd/bind/dist/lib/dns/dispatch.c145
-rw-r--r--external/bsd/bind/dist/lib/dns/dlz.c11
-rw-r--r--external/bsd/bind/dist/lib/dns/dns64.c8
-rw-r--r--external/bsd/bind/dist/lib/dns/dnssec.c101
-rw-r--r--external/bsd/bind/dist/lib/dns/dst_api.c36
-rw-r--r--external/bsd/bind/dist/lib/dns/dst_internal.h5
-rw-r--r--external/bsd/bind/dist/lib/dns/dst_openssl.h21
-rw-r--r--external/bsd/bind/dist/lib/dns/dst_parse.c21
-rw-r--r--external/bsd/bind/dist/lib/dns/gssapi_link.c10
-rw-r--r--external/bsd/bind/dist/lib/dns/gssapictx.c22
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/acl.h23
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/cache.h51
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/db.h12
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/dispatch.h15
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/dlz.h12
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/dnssec.h29
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/masterdump.h10
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/nsec.h9
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/rdata.h16
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/rdataset.h6
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/resolver.h4
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/result.h7
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/sdlz.h38
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/types.h20
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/view.h32
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dns/zone.h81
-rw-r--r--external/bsd/bind/dist/lib/dns/include/dst/dst.h27
-rw-r--r--external/bsd/bind/dist/lib/dns/journal.c9
-rw-r--r--external/bsd/bind/dist/lib/dns/key.c18
-rw-r--r--external/bsd/bind/dist/lib/dns/master.c16
-rw-r--r--external/bsd/bind/dist/lib/dns/masterdump.c84
-rw-r--r--external/bsd/bind/dist/lib/dns/message.c6
-rw-r--r--external/bsd/bind/dist/lib/dns/name.c23
-rw-r--r--external/bsd/bind/dist/lib/dns/ncache.c4
-rw-r--r--external/bsd/bind/dist/lib/dns/nsec.c12
-rw-r--r--external/bsd/bind/dist/lib/dns/nsec3.c9
-rw-r--r--external/bsd/bind/dist/lib/dns/openssl_link.c20
-rw-r--r--external/bsd/bind/dist/lib/dns/openssldsa_link.c5
-rw-r--r--external/bsd/bind/dist/lib/dns/opensslrsa_link.c22
-rw-r--r--external/bsd/bind/dist/lib/dns/private.c9
-rw-r--r--external/bsd/bind/dist/lib/dns/rbt.c11
-rw-r--r--external/bsd/bind/dist/lib/dns/rbtdb.c61
-rw-r--r--external/bsd/bind/dist/lib/dns/rbtdb.h19
-rw-r--r--external/bsd/bind/dist/lib/dns/rcode.c15
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata.c196
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c18
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c13
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c12
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c48
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c12
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c11
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c19
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c34
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c49
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.h51
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c14
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c21
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c13
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c8
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c12
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c20
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c13
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/in_1/naptr_35.c712
-rw-r--r--external/bsd/bind/dist/lib/dns/rdata/in_1/naptr_35.h42
-rw-r--r--external/bsd/bind/dist/lib/dns/rdatalist.c26
-rw-r--r--external/bsd/bind/dist/lib/dns/rdataset.c7
-rw-r--r--external/bsd/bind/dist/lib/dns/rdataslab.c4
-rw-r--r--external/bsd/bind/dist/lib/dns/request.c8
-rw-r--r--external/bsd/bind/dist/lib/dns/resolver.c25
-rw-r--r--external/bsd/bind/dist/lib/dns/result.c5
-rw-r--r--external/bsd/bind/dist/lib/dns/sdb.c6
-rw-r--r--external/bsd/bind/dist/lib/dns/sdlz.c23
-rw-r--r--external/bsd/bind/dist/lib/dns/spnego.c70
-rw-r--r--external/bsd/bind/dist/lib/dns/ssu_external.c31
-rw-r--r--external/bsd/bind/dist/lib/dns/time.c48
-rw-r--r--external/bsd/bind/dist/lib/dns/tkey.c14
-rw-r--r--external/bsd/bind/dist/lib/dns/tsig.c6
-rw-r--r--external/bsd/bind/dist/lib/dns/ttl.c7
-rw-r--r--external/bsd/bind/dist/lib/dns/validator.c114
-rw-r--r--external/bsd/bind/dist/lib/dns/view.c42
-rw-r--r--external/bsd/bind/dist/lib/dns/xfrin.c8
-rw-r--r--external/bsd/bind/dist/lib/dns/zone.c1379
-rw-r--r--external/bsd/bind/dist/lib/dns/zt.c14
-rw-r--r--external/bsd/bind/dist/lib/export/samples/nsprobe.c12
-rw-r--r--external/bsd/bind/dist/lib/irs/getnameinfo.c12
-rw-r--r--external/bsd/bind/dist/lib/irs/resconf.c7
-rw-r--r--external/bsd/bind/dist/lib/isc/heap.c11
-rw-r--r--external/bsd/bind/dist/lib/isc/httpd.c52
-rw-r--r--external/bsd/bind/dist/lib/isc/include/isc/file.h25
-rw-r--r--external/bsd/bind/dist/lib/isc/include/isc/mem.h8
-rw-r--r--external/bsd/bind/dist/lib/isc/include/isc/namespace.h8
-rw-r--r--external/bsd/bind/dist/lib/isc/include/isc/socket.h20
-rw-r--r--external/bsd/bind/dist/lib/isc/include/isc/task.h4
-rw-r--r--external/bsd/bind/dist/lib/isc/include/isc/taskpool.h53
-rw-r--r--external/bsd/bind/dist/lib/isc/include/isc/util.h11
-rw-r--r--external/bsd/bind/dist/lib/isc/log.c11
-rw-r--r--external/bsd/bind/dist/lib/isc/netaddr.c26
-rw-r--r--external/bsd/bind/dist/lib/isc/powerpc/include/isc/atomic.h24
-rw-r--r--external/bsd/bind/dist/lib/isc/radix.c8
-rw-r--r--external/bsd/bind/dist/lib/isc/rwlock.c7
-rw-r--r--external/bsd/bind/dist/lib/isc/sha1.c9
-rw-r--r--external/bsd/bind/dist/lib/isc/sha2.c27
-rw-r--r--external/bsd/bind/dist/lib/isc/sockaddr.c9
-rw-r--r--external/bsd/bind/dist/lib/isc/socket_api.c21
-rw-r--r--external/bsd/bind/dist/lib/isc/string.c13
-rw-r--r--external/bsd/bind/dist/lib/isc/task.c4
-rw-r--r--external/bsd/bind/dist/lib/isc/taskpool.c106
-rw-r--r--external/bsd/bind/dist/lib/isc/timer.c11
-rw-r--r--external/bsd/bind/dist/lib/isc/unix/dir.c8
-rw-r--r--external/bsd/bind/dist/lib/isc/unix/file.c21
-rw-r--r--external/bsd/bind/dist/lib/isc/unix/include/isc/stdtime.h10
-rw-r--r--external/bsd/bind/dist/lib/isc/unix/socket.c269
-rw-r--r--external/bsd/bind/dist/lib/isc/unix/stdio.c7
-rw-r--r--external/bsd/bind/dist/lib/isc/unix/time.c8
-rw-r--r--external/bsd/bind/dist/lib/isc/win32/dir.c8
-rw-r--r--external/bsd/bind/dist/lib/isc/win32/file.c21
-rw-r--r--external/bsd/bind/dist/lib/isc/win32/include/isc/ipv6.h4
-rw-r--r--external/bsd/bind/dist/lib/isc/win32/include/isc/stdtime.h10
-rw-r--r--external/bsd/bind/dist/lib/isc/win32/socket.c99
-rw-r--r--external/bsd/bind/dist/lib/isccfg/aclconf.c85
-rw-r--r--external/bsd/bind/dist/lib/isccfg/include/isccfg/aclconf.h24
-rw-r--r--external/bsd/bind/dist/lib/isccfg/namedconf.c60
-rw-r--r--external/bsd/bind/dist/lib/isccfg/parser.c15
-rw-r--r--external/bsd/bind/dist/lib/lwres/assert_p.h9
-rw-r--r--external/bsd/bind/dist/lib/lwres/herror.c8
-rw-r--r--external/bsd/bind/dist/lib/lwres/lwconfig.c7
-rw-r--r--external/bsd/bind/dist/lib/lwres/print.c7
-rw-r--r--external/bsd/bind/include/config.h21
-rw-r--r--external/bsd/bind/include/dns/code.h99
-rw-r--r--external/bsd/bind/include/dns/enumtype.h2
-rw-r--r--external/bsd/bind/include/dns/rdatastruct.h96
-rw-r--r--external/bsd/bind/include/isc/platform.h4
-rw-r--r--external/bsd/bind/lib/libbind9/shlib_version4
-rw-r--r--external/bsd/bind/lib/libdns/Makefile4
-rw-r--r--external/bsd/bind/lib/libdns/shlib_version4
-rw-r--r--external/bsd/bind/lib/libisc/shlib_version4
-rw-r--r--external/bsd/bind/lib/libisccc/shlib_version4
-rw-r--r--external/bsd/bind/lib/libisccfg/shlib_version4
-rw-r--r--external/bsd/bind/lib/liblwres/shlib_version4
220 files changed, 5810 insertions, 7181 deletions
diff --git a/external/bsd/bind/bin/Makefile b/external/bsd/bind/bin/Makefile
index 014258934e3..78f77f4b75a 100644
--- a/external/bsd/bind/bin/Makefile
+++ b/external/bsd/bind/bin/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.2 2009/10/25 00:18:38 christos Exp $
+# $NetBSD: Makefile,v 1.3 2011/09/11 18:55:24 christos Exp $
-SUBDIR= html dig host named nslookup nsupdate rndc dnssec check
+SUBDIR= html dig host named nslookup nsupdate rndc dnssec check tools
.include "Makefile.inc"
diff --git a/external/bsd/bind/bin/named/Makefile b/external/bsd/bind/bin/named/Makefile
index 22fefbd3c1b..98a3e8d5435 100644
--- a/external/bsd/bind/bin/named/Makefile
+++ b/external/bsd/bind/bin/named/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.3 2011/06/20 07:43:57 mrg Exp $
+# $NetBSD: Makefile,v 1.4 2011/09/11 18:55:24 christos Exp $
.include <bsd.own.mk>
@@ -21,7 +21,7 @@ COPTS.${f}.c+= -fno-strict-aliasing
.PATH: ${DIST}/unix ${DIST}
-SRCS_UNIX= os.c
+SRCS_UNIX= os.c dlz_dlopen_driver.c
SRCS= builtin.c client.c config.c control.c controlconf.c \
interfacemgr.c listenlist.c log.c logconf.c \
lwaddr.c lwdclient.c lwderror.c \
diff --git a/external/bsd/bind/bin/tools/Makefile b/external/bsd/bind/bin/tools/Makefile
new file mode 100644
index 00000000000..d5fc1c88e61
--- /dev/null
+++ b/external/bsd/bind/bin/tools/Makefile
@@ -0,0 +1,7 @@
+# $NetBSD: Makefile,v 1.1 2011/09/11 18:55:24 christos Exp $
+
+SUBDIR= arpaname named-journalprint nsec3hash
+
+.include "Makefile.inc"
+
+.include <bsd.subdir.mk>
diff --git a/external/bsd/bind/bin/tools/Makefile.inc b/external/bsd/bind/bin/tools/Makefile.inc
new file mode 100644
index 00000000000..0c7e3da6ded
--- /dev/null
+++ b/external/bsd/bind/bin/tools/Makefile.inc
@@ -0,0 +1,19 @@
+# $NetBSD: Makefile.inc,v 1.1 2011/09/11 18:55:24 christos Exp $
+
+.include <bsd.own.mk>
+
+.include "${.CURDIR}/../../Makefile.inc"
+
+TOOLS=${IDIST}/bin/tools
+
+.PATH: ${TOOLS}
+
+PROG=${BASE}
+SRCS=${BASE}.c
+.if exists(${TOOLS}/${BASE}.8)
+BINDIR=/usr/sbin
+MAN=${BASE}.8
+.elif exists(${TOOLS}/${BASE}.1)
+BINDIR=/usr/bin
+MAN=${BASE}.1
+.endif
diff --git a/external/bsd/bind/bin/tools/arpaname/Makefile b/external/bsd/bind/bin/tools/arpaname/Makefile
new file mode 100644
index 00000000000..a9473e3fb0a
--- /dev/null
+++ b/external/bsd/bind/bin/tools/arpaname/Makefile
@@ -0,0 +1,7 @@
+# $NetBSD: Makefile,v 1.1 2011/09/11 18:55:24 christos Exp $
+
+BASE= ${.CURDIR:T}
+
+.include "${.CURDIR}/../Makefile.inc"
+
+.include <bsd.prog.mk>
diff --git a/external/bsd/bind/bin/tools/named-journalprint/Makefile b/external/bsd/bind/bin/tools/named-journalprint/Makefile
new file mode 100644
index 00000000000..a9473e3fb0a
--- /dev/null
+++ b/external/bsd/bind/bin/tools/named-journalprint/Makefile
@@ -0,0 +1,7 @@
+# $NetBSD: Makefile,v 1.1 2011/09/11 18:55:24 christos Exp $
+
+BASE= ${.CURDIR:T}
+
+.include "${.CURDIR}/../Makefile.inc"
+
+.include <bsd.prog.mk>
diff --git a/external/bsd/bind/bin/tools/nsec3hash/Makefile b/external/bsd/bind/bin/tools/nsec3hash/Makefile
new file mode 100644
index 00000000000..a9473e3fb0a
--- /dev/null
+++ b/external/bsd/bind/bin/tools/nsec3hash/Makefile
@@ -0,0 +1,7 @@
+# $NetBSD: Makefile,v 1.1 2011/09/11 18:55:24 christos Exp $
+
+BASE= ${.CURDIR:T}
+
+.include "${.CURDIR}/../Makefile.inc"
+
+.include <bsd.prog.mk>
diff --git a/external/bsd/bind/dist/bin/check/named-checkconf.c b/external/bsd/bind/dist/bin/check/named-checkconf.c
index 54818cd89cd..639da62469c 100644
--- a/external/bsd/bind/dist/bin/check/named-checkconf.c
+++ b/external/bsd/bind/dist/bin/check/named-checkconf.c
@@ -1,7 +1,7 @@
-/* $NetBSD: named-checkconf.c,v 1.2 2011/02/16 03:46:44 christos Exp $ */
+/* $NetBSD: named-checkconf.c,v 1.3 2011/09/11 18:55:25 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: named-checkconf.c,v 1.54 2010-09-07 01:49:08 marka Exp */
+/* Id: named-checkconf.c,v 1.56 2011-03-12 04:59:46 tbox Exp */
/*! \file */
@@ -192,7 +192,7 @@ configure_zone(const char *vclass, const char *view,
if (obj != NULL)
maps[i++] = obj;
}
- maps[i++] = NULL;
+ maps[i] = NULL;
cfg_map_get(zoptions, "type", &typeobj);
if (typeobj == NULL)
diff --git a/external/bsd/bind/dist/bin/confgen/ddns-confgen.c b/external/bsd/bind/dist/bin/confgen/ddns-confgen.c
index b67576a608a..f182ceb11d6 100644
--- a/external/bsd/bind/dist/bin/confgen/ddns-confgen.c
+++ b/external/bsd/bind/dist/bin/confgen/ddns-confgen.c
@@ -1,7 +1,7 @@
-/* $NetBSD: ddns-confgen.c,v 1.2 2011/02/16 03:46:44 christos Exp $ */
+/* $NetBSD: ddns-confgen.c,v 1.3 2011/09/11 18:55:25 christos Exp $ */
/*
- * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: ddns-confgen.c,v 1.9 2009-09-29 15:06:05 fdupont Exp */
+/* Id: ddns-confgen.c,v 1.11 2011-03-12 04:59:46 tbox Exp */
/*! \file */
@@ -162,6 +162,7 @@ main(int argc, char **argv) {
argc -= isc_commandline_index;
argv += isc_commandline_index;
+ POST(argv);
if (self_domain != NULL && zone != NULL)
usage(1); /* -s and -z cannot coexist */
diff --git a/external/bsd/bind/dist/bin/confgen/rndc-confgen.c b/external/bsd/bind/dist/bin/confgen/rndc-confgen.c
index 744bf84788b..506cbb36354 100644
--- a/external/bsd/bind/dist/bin/confgen/rndc-confgen.c
+++ b/external/bsd/bind/dist/bin/confgen/rndc-confgen.c
@@ -1,7 +1,7 @@
-/* $NetBSD: rndc-confgen.c,v 1.2 2011/02/16 03:46:44 christos Exp $ */
+/* $NetBSD: rndc-confgen.c,v 1.3 2011/09/11 18:55:25 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rndc-confgen.c,v 1.5 2009-09-29 15:06:05 fdupont Exp */
+/* Id: rndc-confgen.c,v 1.7 2011-03-12 04:59:46 tbox Exp */
/*! \file */
@@ -202,6 +202,7 @@ main(int argc, char **argv) {
argc -= isc_commandline_index;
argv += isc_commandline_index;
+ POST(argv);
if (argc > 0)
usage(1);
diff --git a/external/bsd/bind/dist/bin/dig/dig.1 b/external/bsd/bind/dist/bin/dig/dig.1
index fc9ca03e8a0..26f4ff8ae55 100644
--- a/external/bsd/bind/dist/bin/dig/dig.1
+++ b/external/bsd/bind/dist/bin/dig/dig.1
@@ -1,6 +1,6 @@
-.\" $NetBSD: dig.1,v 1.2 2011/02/16 03:46:45 christos Exp $
+.\" $NetBSD: dig.1,v 1.3 2011/09/11 18:55:25 christos Exp $
.\"
-.\" Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000-2003 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" Id: dig.1,v 1.54 2010-03-05 01:14:15 tbox Exp
+.\" Id: dig.1,v 1.55 2011-03-06 01:14:19 tbox Exp
.\"
.hy 0
.ad l
@@ -360,6 +360,24 @@ option is enabled. If short form answers are requested, the default is not to sh
Toggle the display of comment lines in the output. The default is to print comments.
.RE
.PP
+\fB+[no]rrcomments\fR
+.RS 4
+Toggle the display of per\-record comments in the output (for example, human\-readable key information about DNSKEY records). The default is not to print record comments unless multiline mode is active.
+.RE
+.PP
+\fB+split=W\fR
+.RS 4
+Split long hex\- or base64\-formatted fields in resource records into chunks of
+\fIW\fR
+characters (where
+\fIW\fR
+is rounded up to the nearest multiple of 4).
+\fI+nosplit\fR
+or
+\fI+split=0\fR
+causes fields not to be split at all. The default is 56 characters, or 44 characters when multiline mode is active.
+.RE
+.PP
\fB+[no]stats\fR
.RS 4
This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics.
@@ -569,7 +587,7 @@ RFC1035.
.PP
There are probably too many query options.
.SH "COPYRIGHT"
-Copyright \(co 2004\-2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2011 Internet Systems Consortium, Inc. ("ISC")
.br
Copyright \(co 2000\-2003 Internet Software Consortium.
.br
diff --git a/external/bsd/bind/dist/bin/dig/dig.c b/external/bsd/bind/dist/bin/dig/dig.c
index 297b613238e..1c9b3a99b45 100644
--- a/external/bsd/bind/dist/bin/dig/dig.c
+++ b/external/bsd/bind/dist/bin/dig/dig.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dig.c,v 1.2 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: dig.c,v 1.3 2011/09/11 18:55:25 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dig.c,v 1.237 2010-05-13 00:40:46 marka Exp */
+/* Id: dig.c,v 1.242 2011-03-11 06:11:20 marka Exp */
/*! \file */
@@ -46,8 +46,6 @@
#include <dns/result.h>
#include <dns/tsig.h>
-#include <bind9/getaddresses.h>
-
#include <dig/dig.h>
#define ADD_STRING(b, s) { \
@@ -71,7 +69,8 @@ static char domainopt[DNS_NAME_MAXTEXT];
static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE,
- onesoa = ISC_FALSE;
+ onesoa = ISC_FALSE, rrcomments = ISC_FALSE;
+static isc_uint32_t splitwidth = 0xffffffff;
/*% opcode text */
static const char * const opcodetext[] = {
@@ -205,6 +204,8 @@ help(void) {
" +[no]cl (Control display of class in records)\n"
" +[no]cmd (Control display of command line)\n"
" +[no]comments (Control display of comment lines)\n"
+" +[no]rrcomments (Control display of per-record "
+ "comments)\n"
" +[no]question (Control display of question)\n"
" +[no]answer (Control display of answer)\n"
" +[no]authority (Control display of authority)\n"
@@ -227,6 +228,7 @@ help(void) {
" +[no]topdown (Do DNSSEC validation top down mode)\n"
#endif
#endif
+" +[no]split=## (Split hex/base64 fields into chunks)\n"
" +[no]multiline (Print records in an expanded format)\n"
" +[no]onesoa (AXFR prints only one soa record)\n"
" global d-opts and servers (before host name) affect all queries.\n"
@@ -395,6 +397,8 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
styleflags |= DNS_STYLEFLAG_NO_TTL;
if (noclass)
styleflags |= DNS_STYLEFLAG_NO_CLASS;
+ if (rrcomments)
+ styleflags |= DNS_STYLEFLAG_RRCOMMENT;
if (multiline) {
styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -403,16 +407,21 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
styleflags |= DNS_STYLEFLAG_TTL;
styleflags |= DNS_STYLEFLAG_MULTILINE;
styleflags |= DNS_STYLEFLAG_COMMENT;
+ styleflags |= DNS_STYLEFLAG_RRCOMMENT;
}
+
if (multiline || (nottl && noclass))
- result = dns_master_stylecreate(&style, styleflags,
- 24, 24, 24, 32, 80, 8, mctx);
+ result = dns_master_stylecreate2(&style, styleflags,
+ 24, 24, 24, 32, 80, 8,
+ splitwidth, mctx);
else if (nottl || noclass)
- result = dns_master_stylecreate(&style, styleflags,
- 24, 24, 32, 40, 80, 8, mctx);
+ result = dns_master_stylecreate2(&style, styleflags,
+ 24, 24, 32, 40, 80, 8,
+ splitwidth, mctx);
else
- result = dns_master_stylecreate(&style, styleflags,
- 24, 32, 40, 48, 80, 8, mctx);
+ result = dns_master_stylecreate2(&style, styleflags,
+ 24, 32, 40, 48, 80, 8,
+ splitwidth, mctx);
check_result(result, "dns_master_stylecreate");
result = dns_master_rdatasettotext(owner_name, rdataset, style, target);
@@ -437,6 +446,10 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
unsigned int styleflags = 0;
styleflags |= DNS_STYLEFLAG_REL_OWNER;
+ if (query->lookup->comments)
+ styleflags |= DNS_STYLEFLAG_COMMENT;
+ if (rrcomments)
+ styleflags |= DNS_STYLEFLAG_RRCOMMENT;
if (nottl)
styleflags |= DNS_STYLEFLAG_NO_TTL;
if (noclass)
@@ -448,17 +461,20 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
styleflags |= DNS_STYLEFLAG_OMIT_TTL;
styleflags |= DNS_STYLEFLAG_TTL;
styleflags |= DNS_STYLEFLAG_MULTILINE;
- styleflags |= DNS_STYLEFLAG_COMMENT;
+ styleflags |= DNS_STYLEFLAG_RRCOMMENT;
}
if (multiline || (nottl && noclass))
- result = dns_master_stylecreate(&style, styleflags,
- 24, 24, 24, 32, 80, 8, mctx);
+ result = dns_master_stylecreate2(&style, styleflags,
+ 24, 24, 24, 32, 80, 8,
+ splitwidth, mctx);
else if (nottl || noclass)
- result = dns_master_stylecreate(&style, styleflags,
- 24, 24, 32, 40, 80, 8, mctx);
+ result = dns_master_stylecreate2(&style, styleflags,
+ 24, 24, 32, 40, 80, 8,
+ splitwidth, mctx);
else
- result = dns_master_stylecreate(&style, styleflags,
- 24, 32, 40, 48, 80, 8, mctx);
+ result = dns_master_stylecreate2(&style, styleflags,
+ 24, 32, 40, 48, 80, 8,
+ splitwidth, mctx);
check_result(result, "dns_master_stylecreate");
if (query->lookup->cmdline[0] != 0) {
@@ -481,8 +497,6 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
if (!query->lookup->comments)
flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;
- result = ISC_R_SUCCESS;
-
result = isc_buffer_allocate(mctx, &buf, len);
check_result(result, "isc_buffer_allocate");
@@ -760,6 +774,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
lookup->section_answer = state;
lookup->section_additional = state;
lookup->comments = state;
+ rrcomments = state;
lookup->stats = state;
printcmd = state;
break;
@@ -918,6 +933,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
lookup->identify = ISC_TRUE;
lookup->stats = ISC_FALSE;
lookup->comments = ISC_FALSE;
+ rrcomments = ISC_FALSE;
lookup->section_additional = ISC_FALSE;
lookup->section_authority = ISC_FALSE;
lookup->section_question = ISC_FALSE;
@@ -978,6 +994,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
goto invalid_option;
}
break;
+ case 'r': /* rrcomments */
+ FULLCHECK("rrcomments");
+ rrcomments = state;
+ break;
default:
goto invalid_option;
}
@@ -1004,6 +1024,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
lookup->section_authority = ISC_FALSE;
lookup->section_question = ISC_FALSE;
lookup->comments = ISC_FALSE;
+ rrcomments = ISC_FALSE;
lookup->stats = ISC_FALSE;
}
break;
@@ -1026,6 +1047,36 @@ plus_option(char *option, isc_boolean_t is_batchfile,
lookup->dnssec = ISC_TRUE;
break;
#endif
+ case 'p': /* split */
+ FULLCHECK("split");
+ if (value != NULL && !state)
+ goto invalid_option;
+ if (!state) {
+ splitwidth = 0;
+ break;
+ } else if (value == NULL)
+ break;
+
+ result = parse_uint(&splitwidth, value,
+ 1023, "split");
+ if (splitwidth % 4 != 0) {
+ splitwidth = ((splitwidth + 3) / 4) * 4;
+ fprintf(stderr, ";; Warning, split must be "
+ "a multiple of 4; adjusting "
+ "to %d\n", splitwidth);
+ }
+ /*
+ * There is an adjustment done in the
+ * totext_<rrtype>() functions which causes
+ * splitwidth to shrink. This is okay when we're
+ * using the default width but incorrect in this
+ * case, so we correct for it
+ */
+ if (splitwidth)
+ splitwidth += 3;
+ if (result != ISC_R_SUCCESS)
+ fatal("Couldn't parse retries");
+ break;
case 't': /* stats */
FULLCHECK("stats");
lookup->stats = state;
@@ -1070,6 +1121,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
lookup->recurse = ISC_FALSE;
lookup->identify = ISC_TRUE;
lookup->comments = ISC_FALSE;
+ rrcomments = ISC_FALSE;
lookup->stats = ISC_FALSE;
lookup->section_additional = ISC_FALSE;
lookup->section_authority = ISC_TRUE;
@@ -1440,30 +1492,6 @@ preparse_args(int argc, char **argv) {
}
static void
-getaddresses(dig_lookup_t *lookup, const char *host) {
- isc_result_t result;
- isc_sockaddr_t sockaddrs[DIG_MAX_ADDRESSES];
- isc_netaddr_t netaddr;
- int count, i;
- dig_server_t *srv;
- char tmp[ISC_NETADDR_FORMATSIZE];
-
- result = bind9_getaddresses(host, 0, sockaddrs,
- DIG_MAX_ADDRESSES, &count);
- if (result != ISC_R_SUCCESS)
- fatal("couldn't get address for '%s': %s",
- host, isc_result_totext(result));
-
- for (i = 0; i < count; i++) {
- isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
- isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
- srv = make_server(tmp, host);
- ISC_LIST_APPEND(lookup->my_server_list, srv, link);
- }
- addresscount = count;
-}
-
-static void
parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
int argc, char **argv) {
isc_result_t result;
@@ -1557,7 +1585,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
if (strncmp(rv[0], "%", 1) == 0)
break;
if (strncmp(rv[0], "@", 1) == 0) {
- getaddresses(lookup, &rv[0][1]);
+ addresscount = getaddresses(lookup, &rv[0][1]);
} else if (rv[0][0] == '+') {
plus_option(&rv[0][1], is_batchfile,
lookup);
@@ -1594,7 +1622,6 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
(isc_textregion_t *)&tr);
if (result == ISC_R_SUCCESS &&
rdtype == dns_rdatatype_ixfr) {
- result = DNS_R_UNKNOWN;
fprintf(stderr, ";; Warning, "
"ixfr requires a "
"serial number\n");
diff --git a/external/bsd/bind/dist/bin/dig/dighost.c b/external/bsd/bind/dist/bin/dig/dighost.c
index 236f2accea6..4a80d207b0d 100644
--- a/external/bsd/bind/dist/bin/dig/dighost.c
+++ b/external/bsd/bind/dist/bin/dig/dighost.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dighost.c,v 1.7 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: dighost.c,v 1.8 2011/09/11 18:55:25 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dighost.c,v 1.336 2010-12-09 00:54:33 marka Exp */
+/* Id: dighost.c,v 1.340 2011-03-11 06:11:20 marka Exp */
/*! \file
* \note
@@ -568,10 +568,8 @@ make_server(const char *servname, const char *userarg) {
if (srv == NULL)
fatal("memory allocation failure in %s:%d",
__FILE__, __LINE__);
- strncpy(srv->servername, servname, MXNAME);
- strncpy(srv->userarg, userarg, MXNAME);
- srv->servername[MXNAME-1] = 0;
- srv->userarg[MXNAME-1] = 0;
+ strlcpy(srv->servername, servname, MXNAME);
+ strlcpy(srv->userarg, userarg, MXNAME);
ISC_LINK_INIT(srv, link);
return (srv);
}
@@ -1769,8 +1767,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
dns_rdata_freestruct(&ns);
/* Initialize lookup if we've not yet */
- debug("found NS %d %s", numLookups, namestr);
- numLookups++;
+ debug("found NS %s", namestr);
if (!success) {
success = ISC_TRUE;
lookup_counter++;
@@ -1792,9 +1789,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
domain = dns_fixedname_name(&lookup->fdomain);
dns_name_copy(name, domain, NULL);
}
- srv = make_server(namestr, namestr);
- debug("adding server %s", srv->servername);
- ISC_LIST_APPEND(lookup->my_server_list, srv, link);
+ debug("adding server %s", namestr);
+ numLookups += getaddresses(lookup, namestr);
dns_rdata_reset(&rdata);
}
}
@@ -1810,17 +1806,25 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
if (numLookups > 1) {
isc_uint32_t i, j;
dig_serverlist_t my_server_list;
+ dig_server_t *next;
ISC_LIST_INIT(my_server_list);
- for (i = numLookups; i > 0; i--) {
+ i = numLookups;
+ for (srv = ISC_LIST_HEAD(lookup->my_server_list);
+ srv != NULL;
+ srv = ISC_LIST_HEAD(lookup->my_server_list)) {
+ INSIST(i > 0);
isc_random_get(&j);
j %= i;
- srv = ISC_LIST_HEAD(lookup->my_server_list);
- while (j-- > 0)
- srv = ISC_LIST_NEXT(srv, link);
+ next = ISC_LIST_NEXT(srv, link);
+ while (j-- > 0 && next != NULL) {
+ srv = next;
+ next = ISC_LIST_NEXT(srv, link);
+ }
ISC_LIST_DEQUEUE(lookup->my_server_list, srv, link);
ISC_LIST_APPEND(my_server_list, srv, link);
+ i--;
}
ISC_LIST_APPENDLIST(lookup->my_server_list,
my_server_list, link);
@@ -3543,6 +3547,31 @@ get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
return (ISC_R_SUCCESS);
}
+int
+getaddresses(dig_lookup_t *lookup, const char *host) {
+ isc_result_t result;
+ isc_sockaddr_t sockaddrs[DIG_MAX_ADDRESSES];
+ isc_netaddr_t netaddr;
+ int count, i;
+ dig_server_t *srv;
+ char tmp[ISC_NETADDR_FORMATSIZE];
+
+ result = bind9_getaddresses(host, 0, sockaddrs,
+ DIG_MAX_ADDRESSES, &count);
+ if (result != ISC_R_SUCCESS)
+ fatal("couldn't get address for '%s': %s",
+ host, isc_result_totext(result));
+
+ for (i = 0; i < count; i++) {
+ isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
+ isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
+ srv = make_server(tmp, host);
+ ISC_LIST_APPEND(lookup->my_server_list, srv, link);
+ }
+
+ return count;
+}
+
/*%
* Initiate either a TCP or UDP lookup
*/
diff --git a/external/bsd/bind/dist/bin/dig/host.c b/external/bsd/bind/dist/bin/dig/host.c
index a7ee462fa7b..0574bd3d340 100644
--- a/external/bsd/bind/dist/bin/dig/host.c
+++ b/external/bsd/bind/dist/bin/dig/host.c
@@ -1,7 +1,7 @@
-/* $NetBSD: host.c,v 1.2 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: host.c,v 1.3 2011/09/11 18:55:26 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: host.c,v 1.124 2010-11-16 05:38:30 marka Exp */
+/* Id: host.c,v 1.127 2011-03-11 06:11:20 marka Exp */
/*! \file */
@@ -523,6 +523,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0) {
printf("%scd", did_flag ? " " : "");
did_flag = ISC_TRUE;
+ POST(did_flag);
}
printf("; QUERY: %u, ANSWER: %u, "
"AUTHORITY: %u, ADDITIONAL: %u\n",
@@ -826,8 +827,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
if (isc_commandline_index >= argc)
show_usage();
- strncpy(hostname, argv[isc_commandline_index], sizeof(hostname));
- hostname[sizeof(hostname)-1]=0;
+ strlcpy(hostname, argv[isc_commandline_index], sizeof(hostname));
+
if (argc > isc_commandline_index + 1) {
set_nameserver(argv[isc_commandline_index+1]);
debug("server is %s", argv[isc_commandline_index+1]);
diff --git a/external/bsd/bind/dist/bin/dig/include/dig/dig.h b/external/bsd/bind/dist/bin/dig/include/dig/dig.h
index 0e204b3289e..7a6720fe18e 100644
--- a/external/bsd/bind/dist/bin/dig/include/dig/dig.h
+++ b/external/bsd/bind/dist/bin/dig/include/dig/dig.h
@@ -1,7 +1,7 @@
-/* $NetBSD: dig.h,v 1.4 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: dig.h,v 1.5 2011/09/11 18:55:26 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dig.h,v 1.111 2009-09-29 15:06:06 fdupont Exp */
+/* Id: dig.h,v 1.113 2011-03-01 23:48:05 tbox Exp */
#ifndef DIG_H
#define DIG_H
@@ -290,6 +290,9 @@ extern int idnoptions;
isc_result_t
get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr);
+int
+getaddresses(dig_lookup_t *lookup, const char *host);
+
isc_result_t
get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
isc_boolean_t strict);
diff --git a/external/bsd/bind/dist/bin/dig/nslookup.c b/external/bsd/bind/dist/bin/dig/nslookup.c
index 657ad9eb7b5..7fcc2b14f10 100644
--- a/external/bsd/bind/dist/bin/dig/nslookup.c
+++ b/external/bsd/bind/dist/bin/dig/nslookup.c
@@ -1,7 +1,7 @@
-/* $NetBSD: nslookup.c,v 1.2 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: nslookup.c,v 1.3 2011/09/11 18:55:26 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: nslookup.c,v 1.127 2010-11-17 23:47:08 tbox Exp */
+/* Id: nslookup.c,v 1.129 2011-02-21 23:47:44 tbox Exp */
#include <config.h>
@@ -538,12 +538,6 @@ testclass(char *typetext) {
}
static void
-safecpy(char *dest, char *src, int size) {
- strncpy(dest, src, size);
- dest[size-1] = 0;
-}
-
-static void
set_port(const char *value) {
isc_uint32_t n;
isc_result_t result = parse_uint(&n, value, 65535, "port");
@@ -573,34 +567,34 @@ setoption(char *opt) {
show_settings(ISC_TRUE, ISC_FALSE);
} else if (strncasecmp(opt, "class=", 6) == 0) {
if (testclass(&opt[6]))
- safecpy(defclass, &opt[6], sizeof(defclass));
+ strlcpy(defclass, &opt[6], sizeof(defclass));
} else if (strncasecmp(opt, "cl=", 3) == 0) {
if (testclass(&opt[3]))
- safecpy(defclass, &opt[3], sizeof(defclass));
+ strlcpy(defclass, &opt[3], sizeof(defclass));
} else if (strncasecmp(opt, "type=", 5) == 0) {
if (testtype(&opt[5]))
- safecpy(deftype, &opt[5], sizeof(deftype));
+ strlcpy(deftype, &opt[5], sizeof(deftype));
} else if (strncasecmp(opt, "ty=", 3) == 0) {
if (testtype(&opt[3]))
- safecpy(deftype, &opt[3], sizeof(deftype));
+ strlcpy(deftype, &opt[3], sizeof(deftype));
} else if (strncasecmp(opt, "querytype=", 10) == 0) {
if (testtype(&opt[10]))
- safecpy(deftype, &opt[10], sizeof(deftype));
+ strlcpy(deftype, &opt[10], sizeof(deftype));
} else if (strncasecmp(opt, "query=", 6) == 0) {
if (testtype(&opt[6]))
- safecpy(deftype, &opt[6], sizeof(deftype));
+ strlcpy(deftype, &opt[6], sizeof(deftype));
} else if (strncasecmp(opt, "qu=", 3) == 0) {
if (testtype(&opt[3]))
- safecpy(deftype, &opt[3], sizeof(deftype));
+ strlcpy(deftype, &opt[3], sizeof(deftype));
} else if (strncasecmp(opt, "q=", 2) == 0) {
if (testtype(&opt[2]))
- safecpy(deftype, &opt[2], sizeof(deftype));
+ strlcpy(deftype, &opt[2], sizeof(deftype));
} else if (strncasecmp(opt, "domain=", 7) == 0) {
- safecpy(domainopt, &opt[7], sizeof(domainopt));
+ strlcpy(domainopt, &opt[7], sizeof(domainopt));
set_search_domain(domainopt);
usesearch = ISC_TRUE;
} else if (strncasecmp(opt, "do=", 3) == 0) {
- safecpy(domainopt, &opt[3], sizeof(domainopt));
+ strlcpy(domainopt, &opt[3], sizeof(domainopt));
set_search_domain(domainopt);
usesearch = ISC_TRUE;
} else if (strncasecmp(opt, "port=", 5) == 0) {
@@ -679,11 +673,11 @@ addlookup(char *opt) {
lookup = make_empty_lookup();
if (get_reverse(store, sizeof(store), opt, lookup->ip6_int, ISC_TRUE)
== ISC_R_SUCCESS) {
- safecpy(lookup->textname, store, sizeof(lookup->textname));
+ strlcpy(lookup->textname, store, sizeof(lookup->textname));
lookup->rdtype = dns_rdatatype_ptr;
lookup->rdtypeset = ISC_TRUE;
} else {
- safecpy(lookup->textname, opt, sizeof(lookup->textname));
+ strlcpy(lookup->textname, opt, sizeof(lookup->textname));
lookup->rdtype = rdtype;
lookup->rdtypeset = ISC_TRUE;
}
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8 b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8
index 97f82286e14..f237b433441 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8
@@ -1,6 +1,6 @@
-.\" $NetBSD: dnssec-dsfromkey.8,v 1.2 2011/02/16 03:46:45 christos Exp $
+.\" $NetBSD: dnssec-dsfromkey.8,v 1.3 2011/09/11 18:55:26 christos Exp $
.\"
-.\" Copyright (C) 2008-2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2011 Internet Systems Consortium, Inc. ("ISC")
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" Id: dnssec-dsfromkey.8,v 1.13 2010-12-24 01:14:20 tbox Exp
+.\" Id: dnssec-dsfromkey.8,v 1.14 2011-03-28 01:14:34 tbox Exp
.\"
.hy 0
.ad l
@@ -73,6 +73,15 @@ files) in
Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from
\fBfile\fR. If the zone name is the same as
\fBfile\fR, then it may be omitted.
+.sp
+If
+\fBfile\fR
+is set to
+"\-", then the zone data is read from the standard input. This makes it possible to use the output of the
+\fBdig\fR
+command as input, as in:
+.sp
+\fBdig dnskey example.com | dnssec\-dsfromkey \-f \- example.com\fR
.RE
.PP
\-A
@@ -141,5 +150,5 @@ RFC 4509.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2008\-2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008\-2011 Internet Systems Consortium, Inc. ("ISC")
.br
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c
index e8556866a55..ff36f47746c 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dnssec-dsfromkey.c,v 1.2 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: dnssec-dsfromkey.c,v 1.3 2011/09/11 18:55:26 christos Exp $ */
/*
- * Copyright (C) 2008-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dnssec-dsfromkey.c,v 1.19 2010-12-23 04:07:59 marka Exp */
+/* Id: dnssec-dsfromkey.c,v 1.22 2011-08-18 04:52:35 marka Exp */
/*! \file */
@@ -33,12 +33,13 @@
#include <isc/string.h>
#include <isc/util.h>
+#include <dns/callbacks.h>
#include <dns/db.h>
#include <dns/dbiterator.h>
#include <dns/ds.h>
#include <dns/fixedname.h>
-#include <dns/log.h>
#include <dns/keyvalues.h>
+#include <dns/log.h>
#include <dns/master.h>
#include <dns/name.h>
#include <dns/rdata.h>
@@ -78,8 +79,28 @@ initname(char *setname) {
return (result);
}
+static void
+db_load_from_stream(dns_db_t *db, FILE *fp) {
+ isc_result_t result;
+ dns_rdatacallbacks_t callbacks;
+
+ dns_rdatacallbacks_init(&callbacks);
+ result = dns_db_beginload(db, &callbacks.add, &callbacks.add_private);
+ if (result != ISC_R_SUCCESS)
+ fatal("dns_db_beginload failed: %s", isc_result_totext(result));
+
+ result = dns_master_loadstream(fp, name, name, rdclass, 0,
+ &callbacks, mctx);
+ if (result != ISC_R_SUCCESS)
+ fatal("can't load from input: %s", isc_result_totext(result));
+
+ result = dns_db_endload(db, &callbacks.add_private);
+ if (result != ISC_R_SUCCESS)
+ fatal("dns_db_endload failed: %s", isc_result_totext(result));
+}
+
static isc_result_t
-loadsetfromfile(char *filename, dns_rdataset_t *rdataset) {
+loadset(const char *filename, dns_rdataset_t *rdataset) {
isc_result_t result;
dns_db_t *db = NULL;
dns_dbnode_t *node = NULL;
@@ -92,9 +113,15 @@ loadsetfromfile(char *filename, dns_rdataset_t *rdataset) {
if (result != ISC_R_SUCCESS)
fatal("can't create database");
- result = dns_db_load(db, filename);
- if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
- fatal("can't load %s: %s", filename, isc_result_totext(result));
+ if (strcmp(filename, "-") == 0) {
+ db_load_from_stream(db, stdin);
+ filename = "input";
+ } else {
+ result = dns_db_load(db, filename);
+ if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
+ fatal("can't load %s: %s", filename,
+ isc_result_totext(result));
+ }
result = dns_db_findnode(db, name, ISC_FALSE, &node);
if (result != ISC_R_SUCCESS)
@@ -143,7 +170,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
return (ISC_R_NOSPACE);
isc_buffer_putuint8(&buf, 0);
- return (loadsetfromfile(filename, rdataset));
+ return (loadset(filename, rdataset));
}
static void
@@ -267,12 +294,10 @@ emit(unsigned int dtype, isc_boolean_t showall, char *lookaside,
fatal("can't print class");
isc_buffer_usedregion(&nameb, &r);
- isc_util_fwrite(r.base, 1, r.length, stdout);
-
- putchar(' ');
+ printf("%.*s ", (int)r.length, r.base);
isc_buffer_usedregion(&classb, &r);
- isc_util_fwrite(r.base, 1, r.length, stdout);
+ printf("%.*s", (int)r.length, r.base);
if (lookaside == NULL)
printf(" DS ");
@@ -280,8 +305,7 @@ emit(unsigned int dtype, isc_boolean_t showall, char *lookaside,
printf(" DLV ");
isc_buffer_usedregion(&textb, &r);
- isc_util_fwrite(r.base, 1, r.length, stdout);
- putchar('\n');
+ printf("%.*s\n", (int)r.length, r.base);
}
ISC_PLATFORM_NORETURN_PRE static void
@@ -468,7 +492,7 @@ main(int argc, char **argv) {
if (usekeyset)
result = loadkeyset(dir, &rdataset);
else
- result = loadsetfromfile(filename, &rdataset);
+ result = loadset(filename, &rdataset);
if (result != ISC_R_SUCCESS)
fatal("could not load DNSKEY set: %s\n",
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.8 b/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.8
index c7103d9b55a..27c0f42f89f 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.8
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.8
@@ -1,4 +1,4 @@
-.\" $NetBSD: dnssec-keyfromlabel.8,v 1.3 2011/07/05 21:59:18 spz Exp $
+.\" $NetBSD: dnssec-keyfromlabel.8,v 1.4 2011/09/11 18:55:26 christos Exp $
.\"
.\" Copyright (C) 2008-2011 Internet Systems Consortium, Inc. ("ISC")
.\"
@@ -14,7 +14,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" Id: dnssec-keyfromlabel.8,v 1.18.14.1.2.1 2011-06-09 03:41:05 tbox Exp
+.\" Id: dnssec-keyfromlabel.8,v 1.20 2011-03-18 01:14:33 tbox Exp
.\"
.hy 0
.ad l
@@ -34,7 +34,7 @@
dnssec\-keyfromlabel \- DNSSEC key generation tool
.SH "SYNOPSIS"
.HP 20
-\fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-y\fR] {name}
+\fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-y\fR] {name}
.SH "DESCRIPTION"
.PP
\fBdnssec\-keyfromlabel\fR
@@ -124,6 +124,15 @@ Sets the directory in which the key files are to be written.
Generate KEY records rather than DNSKEY records.
.RE
.PP
+\-L \fIttl\fR
+.RS 4
+Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to
+0
+or
+none
+removes it.
+.RE
+.PP
\-p \fIprotocol\fR
.RS 4
Sets the protocol value for the key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors.
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c b/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c
index 25d03b35e8a..8d7a006eccb 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dnssec-keyfromlabel.c,v 1.5 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: dnssec-keyfromlabel.c,v 1.6 2011/09/11 18:55:26 christos Exp $ */
/*
- * Copyright (C) 2007-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dnssec-keyfromlabel.c,v 1.32 2010-12-23 04:07:59 marka Exp */
+/* Id: dnssec-keyfromlabel.c,v 1.36 2011-03-18 02:16:43 marka Exp */
/*! \file */
@@ -86,6 +86,7 @@ usage(void) {
fprintf(stderr, " -K directory: directory in which to place "
"key files\n");
fprintf(stderr, " -k: generate a TYPE=KEY key\n");
+ fprintf(stderr, " -L ttl: default key TTL\n");
fprintf(stderr, " -n nametype: ZONE | HOST | ENTITY | USER | OTHER\n");
fprintf(stderr, " (DNSKEY generation defaults to ZONE\n");
fprintf(stderr, " -p protocol: default: 3 [dnssec]\n");
@@ -139,12 +140,13 @@ main(int argc, char **argv) {
dns_rdataclass_t rdclass;
int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
char *label = NULL;
+ dns_ttl_t ttl = 0;
isc_stdtime_t publish = 0, activate = 0, revoke = 0;
isc_stdtime_t inactive = 0, delete = 0;
isc_stdtime_t now;
isc_boolean_t setpub = ISC_FALSE, setact = ISC_FALSE;
isc_boolean_t setrev = ISC_FALSE, setinact = ISC_FALSE;
- isc_boolean_t setdel = ISC_FALSE;
+ isc_boolean_t setdel = ISC_FALSE, setttl = ISC_FALSE;
isc_boolean_t unsetpub = ISC_FALSE, unsetact = ISC_FALSE;
isc_boolean_t unsetrev = ISC_FALSE, unsetinact = ISC_FALSE;
isc_boolean_t unsetdel = ISC_FALSE;
@@ -166,7 +168,7 @@ main(int argc, char **argv) {
isc_stdtime_get(&now);
while ((ch = isc_commandline_parse(argc, argv,
- "3a:Cc:E:f:K:kl:n:p:t:v:yFhGP:A:R:I:D:")) != -1)
+ "3a:Cc:E:f:K:kl:L:n:p:t:v:yFhGP:A:R:I:D:")) != -1)
{
switch (ch) {
case '3':
@@ -204,6 +206,13 @@ main(int argc, char **argv) {
case 'k':
options |= DST_TYPE_KEY;
break;
+ case 'L':
+ if (strcmp(isc_commandline_argument, "none") == 0)
+ ttl = 0;
+ else
+ ttl = strtottl(isc_commandline_argument);
+ setttl = ISC_TRUE;
+ break;
case 'l':
label = isc_mem_strdup(mctx, isc_commandline_argument);
break;
@@ -511,6 +520,10 @@ main(int argc, char **argv) {
dst_key_setprivateformat(key, 1, 2);
}
+ /* Set default key TTL */
+ if (setttl)
+ dst_key_setttl(key, ttl);
+
/*
* Do not overwrite an existing key. Warn LOUDLY if there
* is a risk of ID collision due to this key or another key
@@ -520,6 +533,9 @@ main(int argc, char **argv) {
{
isc_buffer_clear(&buf);
ret = dst_key_buildfilename(key, 0, directory, &buf);
+ if (ret != ISC_R_SUCCESS)
+ fatal("dst_key_buildfilename returned: %s\n",
+ isc_result_totext(ret));
if (exact)
fatal("%s: %s already exists\n", program, filename);
@@ -544,6 +560,9 @@ main(int argc, char **argv) {
isc_buffer_clear(&buf);
ret = dst_key_buildfilename(key, 0, NULL, &buf);
+ if (ret != ISC_R_SUCCESS)
+ fatal("dst_key_buildfilename returned: %s\n",
+ isc_result_totext(ret));
printf("%s\n", filename);
dst_key_free(&key);
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.8 b/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.8
index fa859652cb5..7ab0d73f1eb 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.8
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.8
@@ -1,6 +1,6 @@
-.\" $NetBSD: dnssec-keygen.8,v 1.2 2011/02/16 03:46:45 christos Exp $
+.\" $NetBSD: dnssec-keygen.8,v 1.3 2011/09/11 18:55:26 christos Exp $
.\"
-.\" Copyright (C) 2004, 2005, 2007-2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007-2011 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000-2003 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" Id: dnssec-keygen.8,v 1.55 2010-12-24 01:14:19 tbox Exp
+.\" Id: dnssec-keygen.8,v 1.56 2011-03-18 01:14:33 tbox Exp
.\"
.hy 0
.ad l
@@ -35,7 +35,7 @@
dnssec\-keygen \- DNSSEC key generation tool
.SH "SYNOPSIS"
.HP 14
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-k\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
.SH "DESCRIPTION"
.PP
\fBdnssec\-keygen\fR
@@ -141,6 +141,15 @@ Sets the directory in which the key files are to be written.
Deprecated in favor of \-T KEY.
.RE
.PP
+\-L \fIttl\fR
+.RS 4
+Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to
+0
+or
+none
+removes it.
+.RE
+.PP
\-p \fIprotocol\fR
.RS 4
Sets the protocol value for the generated key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors.
@@ -300,7 +309,7 @@ RFC 4034.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007\-2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007\-2011 Internet Systems Consortium, Inc. ("ISC")
.br
Copyright \(co 2000\-2003 Internet Software Consortium.
.br
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c b/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c
index a06fcc224de..aeddd36267c 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dnssec-keygen.c,v 1.6 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: dnssec-keygen.c,v 1.7 2011/09/11 18:55:26 christos Exp $ */
/*
- * Portions Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -31,7 +31,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dnssec-keygen.c,v 1.115 2010-12-23 04:07:59 marka Exp */
+/* Id: dnssec-keygen.c,v 1.118 2011-03-17 01:40:34 each Exp */
/*! \file */
@@ -127,7 +127,9 @@ usage(void) {
fprintf(stderr, " -f <keyflag>: KSK | REVOKE\n");
fprintf(stderr, " -g <generator>: use specified generator "
"(DH only)\n");
+ fprintf(stderr, " -L <ttl>: default key TTL\n");
fprintf(stderr, " -p <protocol>: (default: 3 [dnssec])\n");
+ fprintf(stderr, " -r <randomdev>: a file containing random data\n");
fprintf(stderr, " -s <strength>: strength value this key signs DNS "
"records with (default: 0)\n");
fprintf(stderr, " -T <rrtype>: DNSKEY | KEY (default: DNSKEY; "
@@ -136,8 +138,6 @@ usage(void) {
fprintf(stderr, " -t <type>: "
"AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF "
"(default: AUTHCONF)\n");
- fprintf(stderr, " -r <randomdev>: a file containing random data\n");
-
fprintf(stderr, " -h: print usage and exit\n");
fprintf(stderr, " -m <memory debugging mode>:\n");
fprintf(stderr, " usage | trace | record | size | mctx\n");
@@ -229,6 +229,7 @@ main(int argc, char **argv) {
dns_rdataclass_t rdclass;
int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
int dbits = 0;
+ dns_ttl_t ttl = 0;
isc_boolean_t use_default = ISC_FALSE, use_nsec3 = ISC_FALSE;
isc_stdtime_t publish = 0, activate = 0, revoke = 0;
isc_stdtime_t inactive = 0, delete = 0;
@@ -236,7 +237,7 @@ main(int argc, char **argv) {
int prepub = -1;
isc_boolean_t setpub = ISC_FALSE, setact = ISC_FALSE;
isc_boolean_t setrev = ISC_FALSE, setinact = ISC_FALSE;
- isc_boolean_t setdel = ISC_FALSE;
+ isc_boolean_t setdel = ISC_FALSE, setttl = ISC_FALSE;
isc_boolean_t unsetpub = ISC_FALSE, unsetact = ISC_FALSE;
isc_boolean_t unsetrev = ISC_FALSE, unsetinact = ISC_FALSE;
isc_boolean_t unsetdel = ISC_FALSE;
@@ -255,7 +256,7 @@ main(int argc, char **argv) {
/*
* Process memory debugging argument first.
*/
-#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:km:n:P:p:qR:r:S:s:T:t:v:"
+#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:v:"
while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
switch (ch) {
case 'm':
@@ -338,6 +339,13 @@ main(int argc, char **argv) {
"To generate a key-signing key, use -f KSK.\n"
"To generate a key with TYPE=KEY, use -T KEY.\n");
break;
+ case 'L':
+ if (strcmp(isc_commandline_argument, "none") == 0)
+ ttl = 0;
+ else
+ ttl = strtottl(isc_commandline_argument);
+ setttl = ISC_TRUE;
+ break;
case 'n':
nametype = isc_commandline_argument;
break;
@@ -962,6 +970,10 @@ main(int argc, char **argv) {
dst_key_setprivateformat(key, 1, 2);
}
+ /* Set the default key TTL */
+ if (setttl)
+ dst_key_setttl(key, ttl);
+
/*
* Do not overwrite an existing key, or create a key
* if there is a risk of ID collision due to this key
@@ -977,12 +989,15 @@ main(int argc, char **argv) {
if (verbose > 0) {
isc_buffer_clear(&buf);
- dst_key_buildfilename(key, 0, directory, &buf);
- fprintf(stderr,
- "%s: %s already exists, or might "
- "collide with another key upon "
- "revokation. Generating a new key\n",
- program, filename);
+ ret = dst_key_buildfilename(key, 0,
+ directory, &buf);
+ if (ret == ISC_R_SUCCESS)
+ fprintf(stderr,
+ "%s: %s already exists, or "
+ "might collide with another "
+ "key upon revokation. "
+ "Generating a new key\n",
+ program, filename);
}
dst_key_free(&key);
@@ -1003,6 +1018,9 @@ main(int argc, char **argv) {
isc_buffer_clear(&buf);
ret = dst_key_buildfilename(key, 0, NULL, &buf);
+ if (ret != ISC_R_SUCCESS)
+ fatal("dst_key_buildfilename returned: %s\n",
+ isc_result_totext(ret));
printf("%s\n", filename);
dst_key_free(&key);
if (prevkey != NULL)
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-settime.8 b/external/bsd/bind/dist/bin/dnssec/dnssec-settime.8
index 7c652dccc72..3fc6a88b97d 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-settime.8
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-settime.8
@@ -1,6 +1,6 @@
-.\" $NetBSD: dnssec-settime.8,v 1.2 2011/02/16 03:46:45 christos Exp $
+.\" $NetBSD: dnssec-settime.8,v 1.3 2011/09/11 18:55:26 christos Exp $
.\"
-.\" Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" Id: dnssec-settime.8,v 1.14 2010-08-17 01:15:26 tbox Exp
+.\" Id: dnssec-settime.8,v 1.16 2011-03-22 01:14:25 tbox Exp
.\"
.hy 0
.ad l
@@ -34,7 +34,7 @@
dnssec\-settime \- Set the key timing metadata for a DNSSEC key
.SH "SYNOPSIS"
.HP 15
-\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
+\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
.SH "DESCRIPTION"
.PP
\fBdnssec\-settime\fR
@@ -61,7 +61,7 @@ and
.RS 4
Force an update of an old\-format key with no metadata fields. Without this option,
\fBdnssec\-settime\fR
-will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be set to the present time.
+will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be set to the present time. If no other values are specified, then the key's publication and activation dates will also be set to the present time.
.RE
.PP
\-K \fIdirectory\fR
@@ -69,6 +69,15 @@ will fail when attempting to update a legacy key. With this option, the key will
Sets the directory in which the key files are to reside.
.RE
.PP
+\-L \fIttl\fR
+.RS 4
+Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to
+0
+or
+none
+removes it.
+.RE
+.PP
\-h
.RS 4
Emit usage message and exit.
@@ -164,5 +173,5 @@ RFC 5011.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009\-2011 Internet Systems Consortium, Inc. ("ISC")
.br
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-settime.c b/external/bsd/bind/dist/bin/dnssec/dnssec-settime.c
index 3c0599a8db1..4c9cf064564 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-settime.c
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-settime.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dnssec-settime.c,v 1.2 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: dnssec-settime.c,v 1.3 2011/09/11 18:55:26 christos Exp $ */
/*
- * Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dnssec-settime.c,v 1.28 2010-12-19 07:29:36 each Exp */
+/* Id: dnssec-settime.c,v 1.32 2011-06-02 20:24:45 each Exp */
/*! \file */
@@ -68,6 +68,7 @@ usage(void) {
fprintf(stderr, " -f: force update of old-style "
"keys\n");
fprintf(stderr, " -K directory: set key file location\n");
+ fprintf(stderr, " -L ttl: set default key TTL\n");
fprintf(stderr, " -v level: set level of verbosity\n");
fprintf(stderr, " -h: help\n");
fprintf(stderr, "Timing options:\n");
@@ -83,8 +84,7 @@ usage(void) {
"deletion date\n");
fprintf(stderr, "Printing options:\n");
fprintf(stderr, " -p C/P/A/R/I/D/all: print a particular time "
- "value or values "
- "[default: all]\n");
+ "value or values\n");
fprintf(stderr, " -u: print times in unix epoch "
"format\n");
fprintf(stderr, "Output:\n");
@@ -140,11 +140,12 @@ main(int argc, char **argv) {
unsigned int size = 0;
isc_uint16_t flags = 0;
int prepub = -1;
+ dns_ttl_t ttl = 0;
isc_stdtime_t now;
isc_stdtime_t pub = 0, act = 0, rev = 0, inact = 0, del = 0;
isc_boolean_t setpub = ISC_FALSE, setact = ISC_FALSE;
isc_boolean_t setrev = ISC_FALSE, setinact = ISC_FALSE;
- isc_boolean_t setdel = ISC_FALSE;
+ isc_boolean_t setdel = ISC_FALSE, setttl = ISC_FALSE;
isc_boolean_t unsetpub = ISC_FALSE, unsetact = ISC_FALSE;
isc_boolean_t unsetrev = ISC_FALSE, unsetinact = ISC_FALSE;
isc_boolean_t unsetdel = ISC_FALSE;
@@ -168,7 +169,7 @@ main(int argc, char **argv) {
isc_stdtime_get(&now);
-#define CMDLINE_FLAGS "A:D:E:fhI:i:K:P:p:R:S:uv:"
+#define CMDLINE_FLAGS "A:D:E:fhI:i:K:L:P:p:R:S:uv:"
while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
switch (ch) {
case 'E':
@@ -232,6 +233,13 @@ main(int argc, char **argv) {
"directory");
}
break;
+ case 'L':
+ if (strcmp(isc_commandline_argument, "none") == 0)
+ ttl = 0;
+ else
+ ttl = strtottl(isc_commandline_argument);
+ setttl = ISC_TRUE;
+ break;
case 'v':
verbose = strtol(isc_commandline_argument, &endp, 0);
if (*endp != '\0')
@@ -515,6 +523,22 @@ main(int argc, char **argv) {
else if (unsetdel)
dst_key_unsettime(key, DST_TIME_DELETE);
+ if (setttl)
+ dst_key_setttl(key, ttl);
+
+ /*
+ * No metadata changes were made but we're forcing an upgrade
+ * to the new format anyway: use "-P now -A now" as the default
+ */
+ if (force && !changed) {
+ dst_key_settime(key, DST_TIME_PUBLISH, now);
+ dst_key_settime(key, DST_TIME_ACTIVATE, now);
+ changed = ISC_TRUE;
+ }
+
+ if (!changed && setttl)
+ changed = ISC_TRUE;
+
/*
* Print out time values, if -p was used.
*/
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.8 b/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.8
index 7bfaa46bd45..50074388a27 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.8
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.8
@@ -1,6 +1,6 @@
-.\" $NetBSD: dnssec-signzone.8,v 1.2 2011/02/16 03:46:45 christos Exp $
+.\" $NetBSD: dnssec-signzone.8,v 1.3 2011/09/11 18:55:26 christos Exp $
.\"
-.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000-2003 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" Id: dnssec-signzone.8,v 1.59 2009-12-04 01:13:44 tbox Exp
+.\" Id: dnssec-signzone.8,v 1.63 2011-03-22 01:14:25 tbox Exp
.\"
.hy 0
.ad l
@@ -35,7 +35,7 @@
dnssec\-signzone \- DNSSEC zone signing tool
.SH "SYNOPSIS"
.HP 16
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-p\fR] [\fB\-P\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
.SH "DESCRIPTION"
.PP
\fBdnssec\-signzone\fR
@@ -74,6 +74,15 @@ files in
\fBdirectory\fR.
.RE
.PP
+\-D
+.RS 4
+Output only those record types automatically managed by
+\fBdnssec\-signzone\fR, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records. If smart signing (\fB\-S\fR) is used, DNSKEY records are also included. The resulting file can be included in the original zone file with
+\fB$INCLUDE\fR. This option cannot be combined with
+\fB\-O raw\fR
+or serial number updating.
+.RE
+.PP
\-E \fIengine\fR
.RS 4
Uses a crypto hardware (OpenSSL engine) for the crypto operations it supports, for instance signing with private keys from a secure key store. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine.
@@ -121,6 +130,21 @@ must be later than
\fBstart\-time\fR.
.RE
.PP
+\-X \fIextended end\-time\fR
+.RS 4
+Specify the date and time when the generated RRSIG records for the DNSKEY RRset will expire. This is to be used in cases when the DNSKEY signatures need to persist longer than signatures on other records; e.g., when the private component of the KSK is kept offline and the KSK signature is to be refreshed manually.
+.sp
+As with
+\fBstart\-time\fR, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is indicated with now+N. If no
+\fBextended end\-time\fR
+is specified, the value of
+\fBend\-time\fR
+is used as the default. (\fBend\-time\fR, in turn, defaults to 30 days from the start time.)
+\fBextended end\-time\fR
+must be later than
+\fBstart\-time\fR.
+.RE
+.PP
\-f \fIoutput\-file\fR
.RS 4
The name of the output file containing the signed zone. The default is to append
@@ -223,6 +247,17 @@ Disable post sign verification tests.
The post sign verification test ensures that for each algorithm in use there is at least one non revoked self signed KSK key, that all revoked KSK keys are self signed, and that all records in the zone are signed by the algorithm. This option skips these tests.
.RE
.PP
+\-R
+.RS 4
+Remove signatures from keys that no longer exist.
+.sp
+Normally, when a previously\-signed zone is passed as input to the signer, and a DNSKEY record has been removed and replaced with a new one, signatures from the old key that are still within their validity period are retained. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset. The
+\fB\-R\fR
+forces
+\fBdnssec\-signzone\fR
+to remove all orphaned signatures.
+.RE
+.PP
\-r \fIrandomdev\fR
.RS 4
Specifies the source of randomness. If the operating system does not provide a
@@ -267,8 +302,8 @@ If either of the key's unpublication or deletion dates are set and in the past,
.PP
\-T \fIttl\fR
.RS 4
-Specifies the TTL to be used for new DNSKEY records imported into the zone from the key repository. If not specified, the default is the minimum TTL value from the zone's SOA record. This option is ignored when signing without
-\fB\-S\fR, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre\-existing DNSKEY records at the zone apex, in which case new records' TTL values will be set to match them.
+Specifies a TTL to be used for new DNSKEY records imported into the zone from the key repository. If not specified, the default is the TTL value from the zone's SOA record. This option is ignored when signing without
+\fB\-S\fR, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre\-existing DNSKEY records at the zone apex, in which case new records' TTL values will be set to match them, or if any of the imported DNSKEY records had a default TTL value. In the event of a a conflict between TTL values in imported keys, the shortest one is used.
.RE
.PP
\-t
@@ -380,7 +415,7 @@ RFC 4033.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2004\-2009 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
.br
Copyright \(co 2000\-2003 Internet Software Consortium.
.br
diff --git a/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c b/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c
index e01c389533f..3cac84b4e05 100644
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dnssec-signzone.c,v 1.4 2011/02/16 03:46:45 christos Exp $ */
+/* $NetBSD: dnssec-signzone.c,v 1.5 2011/09/11 18:55:26 christos Exp $ */
/*
- * Portions Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -31,7 +31,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dnssec-signzone.c,v 1.262 2010-06-03 23:51:04 tbox Exp */
+/* Id: dnssec-signzone.c,v 1.279 2011-07-19 23:47:48 tbox Exp */
/*! \file */
@@ -126,7 +126,7 @@ struct signer_event {
static dns_dnsseckeylist_t keylist;
static unsigned int keycount = 0;
isc_rwlock_t keylist_lock;
-static isc_stdtime_t starttime = 0, endtime = 0, now;
+static isc_stdtime_t starttime = 0, endtime = 0, dnskey_endtime = 0, now;
static int cycle = -1;
static int jitter = 0;
static isc_boolean_t tryverify = ISC_FALSE;
@@ -173,6 +173,9 @@ static isc_boolean_t disable_zone_check = ISC_FALSE;
static isc_boolean_t update_chain = ISC_FALSE;
static isc_boolean_t set_keyttl = ISC_FALSE;
static dns_ttl_t keyttl;
+static isc_boolean_t smartsign = ISC_FALSE;
+static isc_boolean_t remove_orphans = ISC_FALSE;
+static isc_boolean_t output_dnssec_only = ISC_FALSE;
#define INCSTAT(counter) \
if (printstats) { \
@@ -190,13 +193,69 @@ sign(isc_task_t *task, isc_event_t *event);
static void
dumpnode(dns_name_t *name, dns_dbnode_t *node) {
+ dns_rdataset_t rds;
+ dns_rdatasetiter_t *iter = NULL;
+ isc_buffer_t *buffer = NULL;
+ isc_region_t r;
isc_result_t result;
+ unsigned bufsize = 4096;
if (outputformat != dns_masterformat_text)
return;
- result = dns_master_dumpnodetostream(mctx, gdb, gversion, node, name,
- masterstyle, fp);
- check_result(result, "dns_master_dumpnodetostream");
+
+ if (!output_dnssec_only) {
+ result = dns_master_dumpnodetostream(mctx, gdb, gversion, node,
+ name, masterstyle, fp);
+ check_result(result, "dns_master_dumpnodetostream");
+ return;
+ }
+
+ result = dns_db_allrdatasets(gdb, node, gversion, 0, &iter);
+ check_result(result, "dns_db_allrdatasets");
+
+ dns_rdataset_init(&rds);
+
+ result = isc_buffer_allocate(mctx, &buffer, bufsize);
+ check_result(result, "isc_buffer_allocate");
+
+ for (result = dns_rdatasetiter_first(iter);
+ result == ISC_R_SUCCESS;
+ result = dns_rdatasetiter_next(iter)) {
+
+ dns_rdatasetiter_current(iter, &rds);
+
+ if (rds.type != dns_rdatatype_rrsig &&
+ rds.type != dns_rdatatype_nsec &&
+ rds.type != dns_rdatatype_nsec3 &&
+ rds.type != dns_rdatatype_nsec3param &&
+ (!smartsign || rds.type != dns_rdatatype_dnskey)) {
+ dns_rdataset_disassociate(&rds);
+ continue;
+ }
+
+ for (;;) {
+ result = dns_master_rdatasettotext(name, &rds,
+ masterstyle, buffer);
+ if (result != ISC_R_NOSPACE)
+ break;
+
+ bufsize <<= 1;
+ isc_buffer_free(&buffer);
+ result = isc_buffer_allocate(mctx, &buffer, bufsize);
+ check_result(result, "isc_buffer_allocate");
+ }
+ check_result(result, "dns_master_rdatasettotext");
+
+ isc_buffer_usedregion(buffer, &r);
+ result = isc_stdio_write(r.base, 1, r.length, fp, NULL);
+ check_result(result, "isc_stdio_write");
+ isc_buffer_clear(buffer);
+
+ dns_rdataset_disassociate(&rds);
+ }
+
+ isc_buffer_free(&buffer);
+ dns_rdatasetiter_destroy(&iter);
}
/*%
@@ -208,7 +267,7 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
dns_ttl_t ttl, dns_diff_t *add, const char *logmsg)
{
isc_result_t result;
- isc_stdtime_t jendtime;
+ isc_stdtime_t jendtime, expiry;
char keystr[DST_KEY_FORMATSIZE];
dns_rdata_t trdata = DNS_RDATA_INIT;
unsigned char array[BUFSIZE];
@@ -218,7 +277,12 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
dst_key_format(key, keystr, sizeof(keystr));
vbprintf(1, "\t%s %s\n", logmsg, keystr);
- jendtime = (jitter != 0) ? isc_random_jitter(endtime, jitter) : endtime;
+ if (rdataset->type == dns_rdatatype_dnskey)
+ expiry = dnskey_endtime;
+ else
+ expiry = endtime;
+
+ jendtime = (jitter != 0) ? isc_random_jitter(expiry, jitter) : expiry;
isc_buffer_init(&b, array, sizeof(array));
result = dns_dnssec_sign(name, rdataset, key, &starttime, &jendtime,
mctx, &b, &trdata);
@@ -256,6 +320,12 @@ issigningkey(dns_dnsseckey_t *key) {
}
static inline isc_boolean_t
+ispublishedkey(dns_dnsseckey_t *key) {
+ return ((key->force_publish || key->hint_publish) &&
+ !key->hint_remove);
+}
+
+static inline isc_boolean_t
iszonekey(dns_dnsseckey_t *key) {
return (ISC_TF(dns_name_equal(dst_key_name(key->key), gorigin) &&
dst_key_iszonekey(key->key)));
@@ -336,13 +406,15 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
directory, mctx, &privkey);
if (result == ISC_R_SUCCESS) {
dst_key_free(&pubkey);
- dns_dnsseckey_create(mctx, &privkey, &key);
- } else {
- dns_dnsseckey_create(mctx, &pubkey, &key);
+ result = dns_dnsseckey_create(mctx, &privkey, &key);
+ } else
+ result = dns_dnsseckey_create(mctx, &pubkey, &key);
+
+ if (result == ISC_R_SUCCESS) {
+ key->force_publish = ISC_FALSE;
+ key->force_sign = ISC_FALSE;
+ ISC_LIST_APPEND(keylist, key, link);
}
- key->force_publish = ISC_TRUE;
- key->force_sign = ISC_FALSE;
- ISC_LIST_APPEND(keylist, key, link);
isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
return (key);
@@ -483,37 +555,39 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
"private dnskey not found\n",
sigstr);
} else if (key == NULL || future) {
+ keep = (!expired && !remove_orphans);
vbprintf(2, "\trrsig by %s %s - dnskey not found\n",
- expired ? "retained" : "dropped", sigstr);
- if (!expired)
- keep = ISC_TRUE;
+ keep ? "retained" : "dropped", sigstr);
} else if (issigningkey(key)) {
- if (!expired && setverifies(name, set, key->key,
- &sigrdata)) {
+ if (!expired && rrsig.originalttl == set->ttl &&
+ setverifies(name, set, key->key, &sigrdata)) {
vbprintf(2, "\trrsig by %s retained\n", sigstr);
keep = ISC_TRUE;
wassignedby[key->index] = ISC_TRUE;
nowsignedby[key->index] = ISC_TRUE;
} else {
vbprintf(2, "\trrsig by %s dropped - %s\n",
- sigstr,
- expired ? "expired" :
- "failed to verify");
+ sigstr, expired ? "expired" :
+ rrsig.originalttl != set->ttl ?
+ "ttl change" : "failed to verify");
wassignedby[key->index] = ISC_TRUE;
resign = ISC_TRUE;
}
+ } else if (!ispublishedkey(key) && remove_orphans) {
+ vbprintf(2, "\trrsig by %s dropped - dnskey removed\n",
+ sigstr);
} else if (iszonekey(key)) {
- if (!expired && setverifies(name, set, key->key,
- &sigrdata)) {
+ if (!expired && rrsig.originalttl == set->ttl &&
+ setverifies(name, set, key->key, &sigrdata)) {
vbprintf(2, "\trrsig by %s retained\n", sigstr);
keep = ISC_TRUE;
wassignedby[key->index] = ISC_TRUE;
nowsignedby[key->index] = ISC_TRUE;
} else {
vbprintf(2, "\trrsig by %s dropped - %s\n",
- sigstr,
- expired ? "expired" :
- "failed to verify");
+ sigstr, expired ? "expired" :
+ rrsig.originalttl != set->ttl ?
+ "ttl change" : "failed to verify");
wassignedby[key->index] = ISC_TRUE;
}
} else if (!expired) {
@@ -524,7 +598,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
}
if (keep) {
- nowsignedby[key->index] = ISC_TRUE;
+ if (key != NULL)
+ nowsignedby[key->index] = ISC_TRUE;
INCSTAT(nretained);
if (sigset.ttl != ttl) {
vbprintf(2, "\tfixing ttl %s\n", sigstr);
@@ -577,7 +652,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
key != NULL;
key = ISC_LIST_NEXT(key, link))
{
- if (nowsignedby[key->index])
+ if (nowsignedby[key->index] && !ispublishedkey(key))
continue;
if (!issigningkey(key))
@@ -1389,6 +1464,13 @@ verifyset(dns_rdataset_t *rdataset, dns_name_t *name, dns_dbnode_t *node,
dns_rdataset_current(&sigrdataset, &rdata);
dns_rdata_tostruct(&rdata, &sig, NULL);
+ if (rdataset->ttl != sig.originalttl) {
+ dns_name_format(name, namebuf, sizeof(namebuf));
+ type_format(rdataset->type, typebuf, sizeof(typebuf));
+ fprintf(stderr, "TTL mismatch for %s %s keytag %u\n",
+ namebuf, typebuf, sig.keyid);
+ continue;
+ }
if ((set_algorithms[sig.algorithm] != 0) ||
(ksk_algorithms[sig.algorithm] == 0))
continue;
@@ -1445,14 +1527,14 @@ verifynode(dns_name_t *name, dns_dbnode_t *node, isc_boolean_t delegation,
/*%
* Verify that certain things are sane:
*
- * The apex has a DNSKEY record with at least one KSK, and at least
+ * The apex has a DNSKEY RRset with at least one KSK, and at least
* one ZSK if the -x flag was not used.
*
- * The DNSKEY record was signed with at least one of the KSKs in this
- * set.
+ * The DNSKEY record was signed with at least one of the KSKs in
+ * the DNSKEY RRset.
*
* The rest of the zone was signed with at least one of the ZSKs
- * present in the DNSKEY RRSET.
+ * present in the DNSKEY RRset.
*/
static void
verifyzone(void) {
@@ -1463,13 +1545,12 @@ verifyzone(void) {
dns_name_t *name, *nextname, *zonecut;
dns_rdata_dnskey_t dnskey;
dns_rdata_t rdata = DNS_RDATA_INIT;
- dns_rdataset_t rdataset;
- dns_rdataset_t sigrdataset;
+ dns_rdataset_t keyset, soaset;
+ dns_rdataset_t keysigs, soasigs;
int i;
isc_boolean_t done = ISC_FALSE;
isc_boolean_t first = ISC_TRUE;
isc_boolean_t goodksk = ISC_FALSE;
- isc_boolean_t goodzsk = ISC_FALSE;
isc_result_t result;
unsigned char revoked_ksk[256];
unsigned char revoked_zsk[256];
@@ -1478,10 +1559,6 @@ verifyzone(void) {
unsigned char ksk_algorithms[256];
unsigned char zsk_algorithms[256];
unsigned char bad_algorithms[256];
-#ifdef ALLOW_KSKLESS_ZONES
- isc_boolean_t allzsksigned = ISC_TRUE;
- unsigned char self_algorithms[256];
-#endif
if (disable_zone_check)
return;
@@ -1491,17 +1568,29 @@ verifyzone(void) {
fatal("failed to find the zone's origin: %s",
isc_result_totext(result));
- dns_rdataset_init(&rdataset);
- dns_rdataset_init(&sigrdataset);
+ dns_rdataset_init(&keyset);
+ dns_rdataset_init(&keysigs);
+ dns_rdataset_init(&soaset);
+ dns_rdataset_init(&soasigs);
+
result = dns_db_findrdataset(gdb, node, gversion,
dns_rdatatype_dnskey,
- 0, 0, &rdataset, &sigrdataset);
+ 0, 0, &keyset, &keysigs);
+ if (result != ISC_R_SUCCESS)
+ fatal("Zone contains no DNSSEC keys\n");
+
+ result = dns_db_findrdataset(gdb, node, gversion,
+ dns_rdatatype_soa,
+ 0, 0, &soaset, &soasigs);
dns_db_detachnode(gdb, &node);
if (result != ISC_R_SUCCESS)
- fatal("cannot find DNSKEY rrset\n");
+ fatal("Zone contains no SOA record\n");
+
+ if (!dns_rdataset_isassociated(&keysigs))
+ fatal("DNSKEY is not signed (keys offline or inactive?)\n");
- if (!dns_rdataset_isassociated(&sigrdataset))
- fatal("cannot find DNSKEY RRSIGs\n");
+ if (!dns_rdataset_isassociated(&soasigs))
+ fatal("SOA is not signed (keys offline or inactive?)\n");
memset(revoked_ksk, 0, sizeof(revoked_ksk));
memset(revoked_zsk, 0, sizeof(revoked_zsk));
@@ -1510,19 +1599,16 @@ verifyzone(void) {
memset(ksk_algorithms, 0, sizeof(ksk_algorithms));
memset(zsk_algorithms, 0, sizeof(zsk_algorithms));
memset(bad_algorithms, 0, sizeof(bad_algorithms));
-#ifdef ALLOW_KSKLESS_ZONES
- memset(self_algorithms, 0, sizeof(self_algorithms));
-#endif
/*
* Check that the DNSKEY RR has at least one self signing KSK
* and one ZSK per algorithm in it (or, if -x was used, one
* self-signing KSK).
*/
- for (result = dns_rdataset_first(&rdataset);
+ for (result = dns_rdataset_first(&keyset);
result == ISC_R_SUCCESS;
- result = dns_rdataset_next(&rdataset)) {
- dns_rdataset_current(&rdataset, &rdata);
+ result = dns_rdataset_next(&keyset)) {
+ dns_rdataset_current(&keyset, &rdata);
result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
check_result(result, "dns_rdata_tostruct");
@@ -1530,8 +1616,8 @@ verifyzone(void) {
;
else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&
- !dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
- &sigrdataset, ISC_FALSE,
+ !dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+ &keysigs, ISC_FALSE,
mctx)) {
char namebuf[DNS_NAME_FORMATSIZE];
char buffer[1024];
@@ -1553,8 +1639,8 @@ verifyzone(void) {
revoked_zsk[dnskey.algorithm] != 255)
revoked_zsk[dnskey.algorithm]++;
} else if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0) {
- if (dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
- &sigrdataset, ISC_FALSE, mctx)) {
+ if (dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+ &keysigs, ISC_FALSE, mctx)) {
if (ksk_algorithms[dnskey.algorithm] != 255)
ksk_algorithms[dnskey.algorithm]++;
goodksk = ISC_TRUE;
@@ -1562,53 +1648,33 @@ verifyzone(void) {
if (standby_ksk[dnskey.algorithm] != 255)
standby_ksk[dnskey.algorithm]++;
}
- } else if (dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
- &sigrdataset, ISC_FALSE,
+ } else if (dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+ &keysigs, ISC_FALSE,
mctx)) {
-#ifdef ALLOW_KSKLESS_ZONES
- if (self_algorithms[dnskey.algorithm] != 255)
- self_algorithms[dnskey.algorithm]++;
-#endif
if (zsk_algorithms[dnskey.algorithm] != 255)
zsk_algorithms[dnskey.algorithm]++;
- goodzsk = ISC_TRUE;
+ } else if (dns_dnssec_signs(&rdata, gorigin, &soaset,
+ &soasigs, ISC_FALSE, mctx)) {
+ if (zsk_algorithms[dnskey.algorithm] != 255)
+ zsk_algorithms[dnskey.algorithm]++;
} else {
if (standby_zsk[dnskey.algorithm] != 255)
standby_zsk[dnskey.algorithm]++;
-#ifdef ALLOW_KSKLESS_ZONES
- allzsksigned = ISC_FALSE;
-#endif
}
dns_rdata_freestruct(&dnskey);
dns_rdata_reset(&rdata);
}
- dns_rdataset_disassociate(&sigrdataset);
+ dns_rdataset_disassociate(&keysigs);
+ dns_rdataset_disassociate(&soaset);
+ dns_rdataset_disassociate(&soasigs);
-#ifdef ALLOW_KSKLESS_ZONES
- if (!goodksk) {
- if (!ignore_kskflag)
- fprintf(stderr, "No self signing KSK found. Using "
- "self signed ZSK's for active "
- "algorithm list.\n");
- memcpy(ksk_algorithms, self_algorithms, sizeof(ksk_algorithms));
- if (!allzsksigned)
- fprintf(stderr, "warning: not all ZSK's are self "
- "signed.\n");
- }
-#else
- if (!goodksk) {
- fatal("no self signed KSK's found");
- }
-#endif
+ if (!goodksk)
+ fatal("No self-signed KSK DNSKEY found. Supply an active\n"
+ "key with the KSK flag set, or use '-P'.");
fprintf(stderr, "Verifying the zone using the following algorithms:");
for (i = 0; i < 256; i++) {
-#ifdef ALLOW_KSKLESS_ZONES
- if (ksk_algorithms[i] != 0 || zsk_algorithms[i] != 0)
-#else
- if (ksk_algorithms[i] != 0)
-#endif
- {
+ if (ksk_algorithms[i] != 0) {
dns_secalg_format(i, algbuf, sizeof(algbuf));
fprintf(stderr, " %s", algbuf);
}
@@ -1671,7 +1737,7 @@ verifyzone(void) {
dns_name_copy(name, zonecut, NULL);
isdelegation = ISC_TRUE;
}
- verifynode(name, node, isdelegation, &rdataset,
+ verifynode(name, node, isdelegation, &keyset,
ksk_algorithms, bad_algorithms);
result = dns_dbiterator_next(dbiter);
nextnode = NULL;
@@ -1708,13 +1774,13 @@ verifyzone(void) {
result = dns_dbiterator_next(dbiter) ) {
result = dns_dbiterator_current(dbiter, &node, name);
check_dns_dbiterator_current(result);
- verifynode(name, node, ISC_FALSE, &rdataset,
+ verifynode(name, node, ISC_FALSE, &keyset,
ksk_algorithms, bad_algorithms);
dns_db_detachnode(gdb, &node);
}
dns_dbiterator_destroy(&dbiter);
- dns_rdataset_disassociate(&rdataset);
+ dns_rdataset_disassociate(&keyset);
/*
* If we made it this far, we have what we consider a properly signed
@@ -2194,6 +2260,7 @@ addnsec3param(const unsigned char *salt, size_t salt_length,
result = dns_rdata_fromstruct(&rdata, gclass,
dns_rdatatype_nsec3param,
&nsec3param, &b);
+ check_result(result, "dns_rdata_fromstruct()");
rdatalist.rdclass = rdata.rdclass;
rdatalist.type = rdata.type;
rdatalist.covers = 0;
@@ -2803,7 +2870,7 @@ loadzonekeys(isc_boolean_t preserve_keys, isc_boolean_t load_public) {
}
keyttl = rdataset.ttl;
- /* Load keys corresponding to the existing DNSKEY RRset */
+ /* Load keys corresponding to the existing DNSKEY RRset. */
result = dns_dnssec_keylistfromrdataset(gorigin, directory, mctx,
&rdataset, &keysigs, &soasigs,
preserve_keys, load_public,
@@ -3254,10 +3321,16 @@ usage(void) {
fprintf(stderr, "update DS records based on child zones' "
"dsset-* files\n");
fprintf(stderr, "\t-s [YYYYMMDDHHMMSS|+offset]:\n");
- fprintf(stderr, "\t\tRRSIG start time - absolute|offset (now - 1 hour)\n");
+ fprintf(stderr, "\t\tRRSIG start time "
+ "- absolute|offset (now - 1 hour)\n");
fprintf(stderr, "\t-e [YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n");
- fprintf(stderr, "\t\tRRSIG end time - absolute|from start|from now "
+ fprintf(stderr, "\t\tRRSIG end time "
+ "- absolute|from start|from now "
"(now + 30 days)\n");
+ fprintf(stderr, "\t-X [YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n");
+ fprintf(stderr, "\t\tDNSKEY RRSIG end "
+ "- absolute|from start|from now "
+ "(matches -e)\n");
fprintf(stderr, "\t-i interval:\n");
fprintf(stderr, "\t\tcycle interval - resign "
"if < interval from end ( (end-start)/4 )\n");
@@ -3275,6 +3348,8 @@ usage(void) {
fprintf(stderr, "\t\tfile format of signed zone file (text)\n");
fprintf(stderr, "\t-N format:\n");
fprintf(stderr, "\t\tsoa serial format of signed zone file (keep)\n");
+ fprintf(stderr, "\t-D:\n");
+ fprintf(stderr, "\t\toutput only DNSSEC-related records\n");
fprintf(stderr, "\t-r randomdev:\n");
fprintf(stderr, "\t\ta file containing random data\n");
fprintf(stderr, "\t-a:\t");
@@ -3322,34 +3397,43 @@ removetempfile(void) {
}
static void
-print_stats(isc_time_t *timer_start, isc_time_t *timer_finish) {
- isc_uint64_t runtime_us; /* Runtime in microseconds */
- isc_uint64_t runtime_ms; /* Runtime in milliseconds */
+print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
+ isc_time_t *sign_start, isc_time_t *sign_finish)
+{
+ isc_uint64_t time_us; /* Time in microseconds */
+ isc_uint64_t time_ms; /* Time in milliseconds */
isc_uint64_t sig_ms; /* Signatures per millisecond */
- runtime_us = isc_time_microdiff(timer_finish, timer_start);
-
printf("Signatures generated: %10d\n", nsigned);
printf("Signatures retained: %10d\n", nretained);
printf("Signatures dropped: %10d\n", ndropped);
printf("Signatures successfully verified: %10d\n", nverified);
printf("Signatures unsuccessfully verified: %10d\n", nverifyfailed);
- runtime_ms = runtime_us / 1000;
- printf("Runtime in seconds: %7u.%03u\n",
- (unsigned int) (runtime_ms / 1000),
- (unsigned int) (runtime_ms % 1000));
- if (runtime_us > 0) {
- sig_ms = ((isc_uint64_t)nsigned * 1000000000) / runtime_us;
+
+ time_us = isc_time_microdiff(sign_finish, sign_start);
+ time_ms = time_us / 1000;
+ printf("Signing time in seconds: %7u.%03u\n",
+ (unsigned int) (time_ms / 1000),
+ (unsigned int) (time_ms % 1000));
+ if (time_us > 0) {
+ sig_ms = ((isc_uint64_t)nsigned * 1000000000) / time_us;
printf("Signatures per second: %7u.%03u\n",
(unsigned int) sig_ms / 1000,
(unsigned int) sig_ms % 1000);
}
+
+ time_us = isc_time_microdiff(timer_finish, timer_start);
+ time_ms = time_us / 1000;
+ printf("Runtime in seconds: %7u.%03u\n",
+ (unsigned int) (time_ms / 1000),
+ (unsigned int) (time_ms % 1000));
}
int
main(int argc, char *argv[]) {
int i, ch;
char *startstr = NULL, *endstr = NULL, *classname = NULL;
+ char *dnskey_endstr = NULL;
char *origin = NULL, *file = NULL, *output = NULL;
char *inputformatstr = NULL, *outputformatstr = NULL;
char *serialformatstr = NULL;
@@ -3357,6 +3441,7 @@ main(int argc, char *argv[]) {
int ndskeys = 0;
char *endp;
isc_time_t timer_start, timer_finish;
+ isc_time_t sign_start, sign_finish;
dns_dnsseckey_t *key;
isc_result_t result;
isc_log_t *log = NULL;
@@ -3374,14 +3459,13 @@ main(int argc, char *argv[]) {
isc_buffer_t b;
int len;
hashlist_t hashlist;
- isc_boolean_t smartsign = ISC_FALSE;
isc_boolean_t make_keyset = ISC_FALSE;
isc_boolean_t set_salt = ISC_FALSE;
isc_boolean_t set_optout = ISC_FALSE;
isc_boolean_t set_iter = ISC_FALSE;
#define CMDLINE_FLAGS \
- "3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:l:m:n:N:o:O:pPr:s:ST:tuUv:xz"
+ "3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:l:m:n:N:o:O:PpRr:s:ST:tuUv:X:xz"
/*
* Process memory debugging argument first.
@@ -3467,6 +3551,10 @@ main(int argc, char *argv[]) {
dsdir, isc_result_totext(result));
break;
+ case 'D':
+ output_dnssec_only = ISC_TRUE;
+ break;
+
case 'E':
engine = isc_commandline_argument;
break;
@@ -3567,6 +3655,10 @@ main(int argc, char *argv[]) {
pseudorandom = ISC_TRUE;
break;
+ case 'R':
+ remove_orphans = ISC_TRUE;
+ break;
+
case 'r':
setup_entropy(mctx, isc_commandline_argument, &ectx);
break;
@@ -3604,6 +3696,10 @@ main(int argc, char *argv[]) {
fatal("verbose level must be numeric");
break;
+ case 'X':
+ dnskey_endstr = isc_commandline_argument;
+ break;
+
case 'x':
keyset_kskonly = ISC_TRUE;
break;
@@ -3651,11 +3747,19 @@ main(int argc, char *argv[]) {
} else
starttime = now - 3600; /* Allow for some clock skew. */
- if (endstr != NULL) {
+ if (endstr != NULL)
endtime = strtotime(endstr, now, starttime);
- } else
+ else
endtime = starttime + (30 * 24 * 60 * 60);
+ if (dnskey_endstr != NULL) {
+ dnskey_endtime = strtotime(dnskey_endstr, now, starttime);
+ if (endstr != NULL && dnskey_endtime == endtime)
+ fprintf(stderr, "WARNING: -e and -X were both set, "
+ "but have identical values.\n");
+ } else
+ dnskey_endtime = endtime;
+
if (cycle == -1)
cycle = (endtime - starttime) / 4;
@@ -3724,6 +3828,12 @@ main(int argc, char *argv[]) {
serialformatstr);
}
+ if (output_dnssec_only && outputformat != dns_masterformat_text)
+ fatal("option -D can only be used with \"-O text\"\n");
+
+ if (output_dnssec_only && serialformat != SOA_SERIAL_KEEP)
+ fatal("option -D can only be used with \"-N keep\"\n");
+
result = dns_master_stylecreate(&dsstyle, DNS_STYLEFLAG_NO_TTL,
0, 24, 0, 0, 0, 8, mctx);
check_result(result, "dns_master_stylecreate");
@@ -3753,10 +3863,15 @@ main(int argc, char *argv[]) {
hashlist_init(&hashlist, dns_db_nodecount(gdb) * 2,
hash_length);
result = dns_nsec_nseconly(gdb, gversion, &answer);
- check_result(result, "dns_nsec_nseconly");
- if (answer)
+ if (result == ISC_R_NOTFOUND)
+ fprintf(stderr, "%s: warning: NSEC3 generation "
+ "requested with no DNSKEY; ignoring\n",
+ program);
+ else if (result != ISC_R_SUCCESS)
+ check_result(result, "dns_nsec_nseconly");
+ else if (answer)
fatal("NSEC3 generation requested with "
- "NSEC only DNSKEY");
+ "NSEC-only DNSKEY");
}
/*
@@ -3807,6 +3922,8 @@ main(int argc, char *argv[]) {
nokeys = ISC_TRUE;
}
+ warnifallksk(gdb);
+
if (IS_NSEC3) {
unsigned int max;
result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
@@ -3816,8 +3933,6 @@ main(int argc, char *argv[]) {
"strength. Maximum iterations allowed %u.", max);
}
- warnifallksk(gdb);
-
gversion = NULL;
result = dns_db_newversion(gdb, &gversion);
check_result(result, "dns_db_newversion()");
@@ -3897,6 +4012,7 @@ main(int argc, char *argv[]) {
RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);
presign();
+ TIME_NOW(&sign_start);
signapex();
if (!finished) {
/*
@@ -3921,6 +4037,7 @@ main(int argc, char *argv[]) {
isc_taskmgr_destroy(&taskmgr);
isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
postsign();
+ TIME_NOW(&sign_finish);
verifyzone();
if (outputformat != dns_masterformat_text) {
@@ -3974,7 +4091,8 @@ main(int argc, char *argv[]) {
if (printstats) {
TIME_NOW(&timer_finish);
- print_stats(&timer_start, &timer_finish);
+ print_stats(&timer_start, &timer_finish,
+ &sign_start, &sign_finish);
}
return (0);
diff --git a/external/bsd/bind/dist/bin/named/builtin.c b/external/bsd/bind/dist/bin/named/builtin.c
index c4778a45081..8d573c4755b 100644
--- a/external/bsd/bind/dist/bin/named/builtin.c
+++ b/external/bsd/bind/dist/bin/named/builtin.c
@@ -1,4 +1,4 @@
-/* $NetBSD: builtin.c,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: builtin.c,v 1.3 2011/09/11 18:55:27 christos Exp $ */
/*
* Copyright (C) 2004, 2005, 2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: builtin.c,v 1.20 2011-01-07 23:47:07 tbox Exp */
+/* Id: builtin.c,v 1.21 2011-03-07 15:29:32 fdupont Exp */
/*! \file
* \brief
@@ -304,6 +304,7 @@ do_authors_lookup(dns_sdblookup_t *lookup) {
"Mark Andrews",
"James Brister",
"Ben Cottrell",
+ "Francis Dupont",
"Michael Graff",
"Andreas Gustafsson",
"Bob Halley",
diff --git a/external/bsd/bind/dist/bin/named/client.c b/external/bsd/bind/dist/bin/named/client.c
index e90ac0d8742..a301613bff6 100644
--- a/external/bsd/bind/dist/bin/named/client.c
+++ b/external/bsd/bind/dist/bin/named/client.c
@@ -1,4 +1,4 @@
-/* $NetBSD: client.c,v 1.3 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: client.c,v 1.4 2011/09/11 18:55:27 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: client.c,v 1.271 2011-01-11 23:47:12 tbox Exp */
+/* Id: client.c,v 1.276 2011-07-28 23:47:58 tbox Exp */
#include <config.h>
@@ -635,6 +635,7 @@ ns_client_endrequest(ns_client_t *client) {
dns_message_puttemprdataset(client->message, &client->opt);
}
+ client->signer = NULL;
client->udpsize = 512;
client->extflags = 0;
client->ednsversion = -1;
@@ -1314,6 +1315,12 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
UNUSED(arg);
+ /*
+ * ns_g_server->interfacemgr is task exclusive locked.
+ */
+ if (ns_g_server->interfacemgr == NULL)
+ return (ISC_TRUE);
+
if (!ns_interfacemgr_listeningon(ns_g_server->interfacemgr, dstaddr))
return (ISC_FALSE);
@@ -2097,6 +2104,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
client->next = NULL;
client->shutdown = NULL;
client->shutdown_arg = NULL;
+ client->signer = NULL;
dns_name_init(&client->signername, NULL);
client->mortal = ISC_FALSE;
client->tcpquota = NULL;
@@ -2530,8 +2538,10 @@ ns_clientmgr_createclients(ns_clientmgr_t *manager, unsigned int n,
ns_interface_t *ifp, isc_boolean_t tcp)
{
isc_result_t result = ISC_R_SUCCESS;
+ isc_boolean_t success = ISC_FALSE;
unsigned int i;
ns_client_t *client;
+ unsigned int disp;
REQUIRE(VALID_MANAGER(manager));
REQUIRE(n > 0);
@@ -2546,61 +2556,68 @@ ns_clientmgr_createclients(ns_clientmgr_t *manager, unsigned int n,
LOCK(&manager->lock);
- for (i = 0; i < n; i++) {
- isc_event_t *ev;
- /*
- * Allocate a client. First try to get a recycled one;
- * if that fails, make a new one.
- */
- client = NULL;
- if (!ns_g_clienttest)
- client = ISC_LIST_HEAD(manager->inactive);
- if (client != NULL) {
- MTRACE("recycle");
- ISC_LIST_UNLINK(manager->inactive, client, link);
- client->list = NULL;
- } else {
- MTRACE("create new");
- result = client_create(manager, &client);
- if (result != ISC_R_SUCCESS)
- break;
- }
+ for (disp = 0; disp < n; disp++) {
+ for (i = 0; i < n; i++) {
+ isc_event_t *ev;
- ns_interface_attach(ifp, &client->interface);
- client->state = NS_CLIENTSTATE_READY;
- INSIST(client->recursionquota == NULL);
+ /*
+ * Allocate a client. First try to get a recycled one;
+ * if that fails, make a new one.
+ */
+ client = NULL;
+ if (!ns_g_clienttest)
+ client = ISC_LIST_HEAD(manager->inactive);
+ if (client != NULL) {
+ MTRACE("recycle");
+ ISC_LIST_UNLINK(manager->inactive, client,
+ link);
+ client->list = NULL;
+ } else {
+ MTRACE("create new");
+ result = client_create(manager, &client);
+ if (result != ISC_R_SUCCESS)
+ break;
+ }
- if (tcp) {
- client->attributes |= NS_CLIENTATTR_TCP;
- isc_socket_attach(ifp->tcpsocket,
- &client->tcplistener);
- } else {
- isc_socket_t *sock;
+ ns_interface_attach(ifp, &client->interface);
+ client->state = NS_CLIENTSTATE_READY;
+ INSIST(client->recursionquota == NULL);
- dns_dispatch_attach(ifp->udpdispatch,
- &client->dispatch);
- sock = dns_dispatch_getsocket(client->dispatch);
- isc_socket_attach(sock, &client->udpsocket);
- }
- client->manager = manager;
- ISC_LIST_APPEND(manager->active, client, link);
- client->list = &manager->active;
+ if (tcp) {
+ client->attributes |= NS_CLIENTATTR_TCP;
+ isc_socket_attach(ifp->tcpsocket,
+ &client->tcplistener);
+ } else {
+ isc_socket_t *sock;
- INSIST(client->nctls == 0);
- client->nctls++;
- ev = &client->ctlevent;
- isc_task_send(client->task, &ev);
- }
- if (i != 0) {
- /*
- * We managed to create at least one client, so we
- * declare victory.
- */
- result = ISC_R_SUCCESS;
+ dns_dispatch_attach(ifp->udpdispatch[disp],
+ &client->dispatch);
+ sock = dns_dispatch_getsocket(client->dispatch);
+ isc_socket_attach(sock, &client->udpsocket);
+ }
+
+ client->manager = manager;
+ ISC_LIST_APPEND(manager->active, client, link);
+ client->list = &manager->active;
+
+ INSIST(client->nctls == 0);
+ client->nctls++;
+ ev = &client->ctlevent;
+ isc_task_send(client->task, &ev);
+
+ success = ISC_TRUE;
+ }
}
UNLOCK(&manager->lock);
+ /*
+ * If managed to create at least one client for
+ * one dispatch, we declare victory.
+ */
+ if (success)
+ return (ISC_R_SUCCESS);
+
return (result);
}
@@ -2684,19 +2701,30 @@ ns_client_logv(ns_client_t *client, isc_logcategory_t *category,
{
char msgbuf[2048];
char peerbuf[ISC_SOCKADDR_FORMATSIZE];
- const char *name = "";
- const char *sep = "";
+ char signerbuf[DNS_NAME_FORMATSIZE];
+ const char *viewname = "";
+ const char *sep1 = "", *sep2 = "";
+ const char *signer = "";
vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
+
ns_client_name(client, peerbuf, sizeof(peerbuf));
+
+ if (client->signer != NULL) {
+ dns_name_format(client->signer, signerbuf, sizeof(signerbuf));
+ sep1 = "/key ";
+ signer = signerbuf;
+ }
+
if (client->view != NULL && strcmp(client->view->name, "_bind") != 0 &&
strcmp(client->view->name, "_default") != 0) {
- name = client->view->name;
- sep = ": view ";
+ sep2 = ": view ";
+ viewname = client->view->name;
}
isc_log_write(ns_g_lctx, category, module, level,
- "client %s%s%s: %s", peerbuf, sep, name, msgbuf);
+ "client %s%s%s%s%s: %s",
+ peerbuf, sep1, signer, sep2, viewname, msgbuf);
}
void
diff --git a/external/bsd/bind/dist/bin/named/config.c b/external/bsd/bind/dist/bin/named/config.c
index 0ecbe03f63c..e1d82eb5d3f 100644
--- a/external/bsd/bind/dist/bin/named/config.c
+++ b/external/bsd/bind/dist/bin/named/config.c
@@ -1,4 +1,4 @@
-/* $NetBSD: config.c,v 1.3 2011/07/05 21:59:18 spz Exp $ */
+/* $NetBSD: config.c,v 1.4 2011/09/11 18:55:27 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: config.c,v 1.113.16.1.2.1 2011-06-02 23:47:28 tbox Exp */
+/* Id: config.c,v 1.119 2011-07-01 02:25:47 marka Exp */
/*! \file */
@@ -211,7 +211,10 @@ options {\n\
check-srv-cname warn;\n\
zero-no-soa-ttl yes;\n\
update-check-ksk yes;\n\
+ serial-update-method increment;\n\
+ dnssec-update-mode maintain;\n\
dnssec-dnskey-kskonly no;\n\
+ dnssec-loadkeys-interval 60;\n\
try-tcp-refresh yes; /* BIND 8 compat */\n\
};\n\
"
@@ -379,6 +382,8 @@ ns_config_getzonetype(const cfg_obj_t *zonetypeobj) {
ztype = dns_zone_stub;
else if (strcasecmp(str, "static-stub") == 0)
ztype = dns_zone_staticstub;
+ else if (strcasecmp(str, "redirect") == 0)
+ ztype = dns_zone_redirect;
else
INSIST(0);
return (ztype);
diff --git a/external/bsd/bind/dist/bin/named/control.c b/external/bsd/bind/dist/bin/named/control.c
index f4281f0e400..4864330c649 100644
--- a/external/bsd/bind/dist/bin/named/control.c
+++ b/external/bsd/bind/dist/bin/named/control.c
@@ -1,7 +1,7 @@
-/* $NetBSD: control.c,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: control.c,v 1.3 2011/09/11 18:55:27 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: control.c,v 1.41 2010-12-03 22:05:19 each Exp */
+/* Id: control.c,v 1.44 2011-08-02 20:36:11 each Exp */
/*! \file */
@@ -171,7 +171,9 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
} else if (command_compare(command, NS_COMMAND_FLUSH)) {
result = ns_server_flushcache(ns_g_server, command);
} else if (command_compare(command, NS_COMMAND_FLUSHNAME)) {
- result = ns_server_flushname(ns_g_server, command);
+ result = ns_server_flushnode(ns_g_server, command, ISC_FALSE);
+ } else if (command_compare(command, NS_COMMAND_FLUSHTREE)) {
+ result = ns_server_flushnode(ns_g_server, command, ISC_TRUE);
} else if (command_compare(command, NS_COMMAND_STATUS)) {
result = ns_server_status(ns_g_server, text);
} else if (command_compare(command, NS_COMMAND_TSIGLIST)) {
@@ -185,6 +187,8 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
command_compare(command, NS_COMMAND_THAW)) {
result = ns_server_freeze(ns_g_server, ISC_FALSE, command,
text);
+ } else if (command_compare(command, NS_COMMAND_SYNC)) {
+ result = ns_server_sync(ns_g_server, command, text);
} else if (command_compare(command, NS_COMMAND_RECURSING)) {
result = ns_server_dumprecursing(ns_g_server);
} else if (command_compare(command, NS_COMMAND_TIMERPOKE)) {
diff --git a/external/bsd/bind/dist/bin/named/controlconf.c b/external/bsd/bind/dist/bin/named/controlconf.c
index 7642a52c5de..651e3f6b987 100644
--- a/external/bsd/bind/dist/bin/named/controlconf.c
+++ b/external/bsd/bind/dist/bin/named/controlconf.c
@@ -1,7 +1,7 @@
-/* $NetBSD: controlconf.c,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: controlconf.c,v 1.3 2011/09/11 18:55:27 christos Exp $ */
/*
- * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: controlconf.c,v 1.60 2008-07-23 23:27:54 marka Exp */
+/* Id: controlconf.c,v 1.62 2011-03-12 04:59:46 tbox Exp */
/*! \file */
@@ -861,7 +861,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
cfg_obj_log(key, ns_g_lctx, ISC_LOG_WARNING,
"secret for key '%s' on command channel: %s",
keyid->keyname, isc_result_totext(result));
- CHECK(result);
+ goto cleanup;
}
keyid->secret.length = isc_buffer_usedlength(&b);
diff --git a/external/bsd/bind/dist/bin/named/include/named/control.h b/external/bsd/bind/dist/bin/named/include/named/control.h
index ab7a362a04c..df3a674ab17 100644
--- a/external/bsd/bind/dist/bin/named/include/named/control.h
+++ b/external/bsd/bind/dist/bin/named/include/named/control.h
@@ -1,7 +1,7 @@
-/* $NetBSD: control.h,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: control.h,v 1.3 2011/09/11 18:55:28 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: control.h,v 1.31 2010-08-16 22:21:06 marka Exp */
+/* Id: control.h,v 1.34 2011-08-02 20:36:12 each Exp */
#ifndef NAMED_CONTROL_H
#define NAMED_CONTROL_H 1
@@ -49,6 +49,7 @@
#define NS_COMMAND_NOTRACE "notrace"
#define NS_COMMAND_FLUSH "flush"
#define NS_COMMAND_FLUSHNAME "flushname"
+#define NS_COMMAND_FLUSHTREE "flushtree"
#define NS_COMMAND_STATUS "status"
#define NS_COMMAND_TSIGLIST "tsig-list"
#define NS_COMMAND_TSIGDELETE "tsig-delete"
@@ -64,6 +65,7 @@
#define NS_COMMAND_LOADKEYS "loadkeys"
#define NS_COMMAND_ADDZONE "addzone"
#define NS_COMMAND_DELZONE "delzone"
+#define NS_COMMAND_SYNC "sync"
isc_result_t
ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
diff --git a/external/bsd/bind/dist/bin/named/include/named/globals.h b/external/bsd/bind/dist/bin/named/include/named/globals.h
index 0cf9bab0c13..6ee8248a72b 100644
--- a/external/bsd/bind/dist/bin/named/include/named/globals.h
+++ b/external/bsd/bind/dist/bin/named/include/named/globals.h
@@ -1,7 +1,7 @@
-/* $NetBSD: globals.h,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: globals.h,v 1.3 2011/09/11 18:55:29 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: globals.h,v 1.89 2010-09-15 12:07:55 marka Exp */
+/* Id: globals.h,v 1.91 2011-06-17 23:47:49 tbox Exp */
#ifndef NAMED_GLOBALS_H
#define NAMED_GLOBALS_H 1
@@ -28,6 +28,7 @@
#include <isc/log.h>
#include <isc/net.h>
+#include <isccfg/aclconf.h>
#include <isccfg/cfg.h>
#include <dns/zone.h>
@@ -104,6 +105,7 @@ EXTERN const char * lwresd_g_resolvconffile INIT("/etc"
EXTERN isc_boolean_t ns_g_conffileset INIT(ISC_FALSE);
EXTERN isc_boolean_t lwresd_g_useresolvconf INIT(ISC_FALSE);
EXTERN isc_uint16_t ns_g_udpsize INIT(4096);
+EXTERN cfg_aclconfctx_t * ns_g_aclconfctx INIT(NULL);
/*
* Initial resource limits.
diff --git a/external/bsd/bind/dist/bin/named/include/named/interfacemgr.h b/external/bsd/bind/dist/bin/named/include/named/interfacemgr.h
index cebb2cae378..44b7923d30c 100644
--- a/external/bsd/bind/dist/bin/named/include/named/interfacemgr.h
+++ b/external/bsd/bind/dist/bin/named/include/named/interfacemgr.h
@@ -1,7 +1,7 @@
-/* $NetBSD: interfacemgr.h,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: interfacemgr.h,v 1.3 2011/09/11 18:55:29 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: interfacemgr.h,v 1.33 2007-06-19 23:46:59 tbox Exp */
+/* Id: interfacemgr.h,v 1.35 2011-07-28 23:47:58 tbox Exp */
#ifndef NAMED_INTERFACEMGR_H
#define NAMED_INTERFACEMGR_H 1
@@ -67,7 +67,8 @@
#define NS_INTERFACE_VALID(t) ISC_MAGIC_VALID(t, IFACE_MAGIC)
#define NS_INTERFACEFLAG_ANYADDR 0x01U /*%< bound to "any" address */
-
+#define MAX_UDP_DISPATCH 128 /*%< Maximum number of UDP dispatchers
+ to start per interface */
/*% The nameserver interface structure */
struct ns_interface {
unsigned int magic; /*%< Magic number. */
@@ -78,11 +79,13 @@ struct ns_interface {
isc_sockaddr_t addr; /*%< Address and port. */
unsigned int flags; /*%< Interface characteristics */
char name[32]; /*%< Null terminated. */
- dns_dispatch_t * udpdispatch; /*%< UDP dispatcher. */
+ dns_dispatch_t * udpdispatch[MAX_UDP_DISPATCH];
+ /*%< UDP dispatchers. */
isc_socket_t * tcpsocket; /*%< TCP socket. */
int ntcptarget; /*%< Desired number of concurrent
TCP accepts */
int ntcpcurrent; /*%< Current ditto, locked */
+ int nudpdispatch; /*%< Number of UDP dispatches */
ns_clientmgr_t * clientmgr; /*%< Client manager. */
ISC_LINK(ns_interface_t) link;
};
diff --git a/external/bsd/bind/dist/bin/named/include/named/server.h b/external/bsd/bind/dist/bin/named/include/named/server.h
index e10dc620d52..a488ca22a84 100644
--- a/external/bsd/bind/dist/bin/named/include/named/server.h
+++ b/external/bsd/bind/dist/bin/named/include/named/server.h
@@ -1,7 +1,7 @@
-/* $NetBSD: server.h,v 1.2 2011/02/16 03:46:47 christos Exp $ */
+/* $NetBSD: server.h,v 1.3 2011/09/11 18:55:29 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: server.h,v 1.110 2010-08-16 23:46:52 tbox Exp */
+/* Id: server.h,v 1.113 2011-08-02 20:36:12 each Exp */
#ifndef NAMED_SERVER_H
#define NAMED_SERVER_H 1
@@ -266,10 +266,12 @@ isc_result_t
ns_server_flushcache(ns_server_t *server, char *args);
/*%
- * Flush a particular name from the server's cache(s)
+ * Flush a particular name from the server's cache. If 'tree' is false,
+ * also flush the name from the ADB and badcache. If 'tree' is true, also
+ * flush all the names under the specified name.
*/
isc_result_t
-ns_server_flushname(ns_server_t *server, char *args);
+ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree);
/*%
* Report the server's status.
@@ -297,6 +299,12 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
isc_buffer_t *text);
/*%
+ * Dump zone updates to disk, optionally removing the journal file
+ */
+isc_result_t
+ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text);
+
+/*%
* Update a zone's DNSKEY set from the key repository. If
* the command that triggered the call to this function was "sign",
* then force a full signing of the zone. If it was "loadkeys",
diff --git a/external/bsd/bind/dist/bin/named/interfacemgr.c b/external/bsd/bind/dist/bin/named/interfacemgr.c
index 163c641d603..98ffbaa0c31 100644
--- a/external/bsd/bind/dist/bin/named/interfacemgr.c
+++ b/external/bsd/bind/dist/bin/named/interfacemgr.c
@@ -1,7 +1,7 @@
-/* $NetBSD: interfacemgr.c,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: interfacemgr.c,v 1.3 2011/09/11 18:55:27 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,13 +17,14 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: interfacemgr.c,v 1.95 2009-01-17 23:47:42 tbox Exp */
+/* Id: interfacemgr.c,v 1.99 2011-07-28 11:16:04 marka Exp */
/*! \file */
#include <config.h>
#include <isc/interfaceiter.h>
+#include <isc/os.h>
#include <isc/string.h>
#include <isc/task.h>
#include <isc/util.h>
@@ -185,11 +186,14 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
{
ns_interface_t *ifp;
isc_result_t result;
+ int disp;
REQUIRE(NS_INTERFACEMGR_VALID(mgr));
+
ifp = isc_mem_get(mgr->mctx, sizeof(*ifp));
if (ifp == NULL)
return (ISC_R_NOMEMORY);
+
ifp->mgr = NULL;
ifp->generation = mgr->generation;
ifp->addr = *addr;
@@ -212,9 +216,11 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
goto clientmgr_create_failure;
}
- ifp->udpdispatch = NULL;
+ for (disp = 0; disp < MAX_UDP_DISPATCH; disp++)
+ ifp->udpdispatch[disp] = NULL;
ifp->tcpsocket = NULL;
+
/*
* Create a single TCP client object. It will replace itself
* with a new one as soon as it gets a connection, so the actual
@@ -223,6 +229,7 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
*/
ifp->ntcptarget = 1;
ifp->ntcpcurrent = 0;
+ ifp->nudpdispatch = 0;
ISC_LINK_INIT(ifp, link);
@@ -237,6 +244,7 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
clientmgr_create_failure:
DESTROYLOCK(&ifp->lock);
+
lock_create_failure:
ifp->magic = 0;
isc_mem_put(mgr->mctx, ifp, sizeof(*ifp));
@@ -249,6 +257,7 @@ ns_interface_listenudp(ns_interface_t *ifp) {
isc_result_t result;
unsigned int attrs;
unsigned int attrmask;
+ int disp, i;
attrs = 0;
attrs |= DNS_DISPATCHATTR_UDP;
@@ -260,15 +269,25 @@ ns_interface_listenudp(ns_interface_t *ifp) {
attrmask = 0;
attrmask |= DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
- result = dns_dispatch_getudp(ifp->mgr->dispatchmgr, ns_g_socketmgr,
- ns_g_taskmgr, &ifp->addr,
- 4096, 1000, 32768, 8219, 8237,
- attrs, attrmask, &ifp->udpdispatch);
- if (result != ISC_R_SUCCESS) {
- isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,
- "could not listen on UDP socket: %s",
- isc_result_totext(result));
- goto udp_dispatch_failure;
+
+ ifp->nudpdispatch = ISC_MIN(isc_os_ncpus(), MAX_UDP_DISPATCH);
+ for (disp = 0; disp < ifp->nudpdispatch; disp++) {
+ result = dns_dispatch_getudp_dup(ifp->mgr->dispatchmgr,
+ ns_g_socketmgr,
+ ns_g_taskmgr, &ifp->addr,
+ 4096, 1000, 32768, 8219, 8237,
+ attrs, attrmask,
+ &ifp->udpdispatch[disp],
+ disp == 0
+ ? NULL
+ : ifp->udpdispatch[0]);
+ if (result != ISC_R_SUCCESS) {
+ isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,
+ "could not listen on UDP socket: %s",
+ isc_result_totext(result));
+ goto udp_dispatch_failure;
+ }
+
}
result = ns_clientmgr_createclients(ifp->clientmgr, ns_g_cpus,
@@ -279,12 +298,17 @@ ns_interface_listenudp(ns_interface_t *ifp) {
isc_result_totext(result));
goto addtodispatch_failure;
}
+
return (ISC_R_SUCCESS);
addtodispatch_failure:
- dns_dispatch_changeattributes(ifp->udpdispatch, 0,
- DNS_DISPATCHATTR_NOLISTEN);
- dns_dispatch_detach(&ifp->udpdispatch);
+ for (i = disp - 1; i <= 0; i--) {
+ dns_dispatch_changeattributes(ifp->udpdispatch[i], 0,
+ DNS_DISPATCHATTR_NOLISTEN);
+ dns_dispatch_detach(&(ifp->udpdispatch[i]));
+ }
+ ifp->nudpdispatch = 0;
+
udp_dispatch_failure:
return (result);
}
@@ -381,7 +405,7 @@ ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
}
}
*ifpret = ifp;
- return (ISC_R_SUCCESS);
+ return (result);
cleanup_interface:
ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link);
@@ -398,15 +422,19 @@ ns_interface_shutdown(ns_interface_t *ifp) {
static void
ns_interface_destroy(ns_interface_t *ifp) {
isc_mem_t *mctx = ifp->mgr->mctx;
+ int disp;
+
REQUIRE(NS_INTERFACE_VALID(ifp));
ns_interface_shutdown(ifp);
- if (ifp->udpdispatch != NULL) {
- dns_dispatch_changeattributes(ifp->udpdispatch, 0,
- DNS_DISPATCHATTR_NOLISTEN);
- dns_dispatch_detach(&ifp->udpdispatch);
- }
+ for (disp = ifp->nudpdispatch; disp >= 0; disp--)
+ if (ifp->udpdispatch[disp] != NULL) {
+ dns_dispatch_changeattributes(ifp->udpdispatch[disp], 0,
+ DNS_DISPATCHATTR_NOLISTEN);
+ dns_dispatch_detach(&(ifp->udpdispatch[disp]));
+ }
+
if (ifp->tcpsocket != NULL)
isc_socket_detach(&ifp->tcpsocket);
@@ -966,7 +994,6 @@ isc_boolean_t
ns_interfacemgr_listeningon(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr) {
isc_sockaddr_t *old;
- old = ISC_LIST_HEAD(mgr->listenon);
for (old = ISC_LIST_HEAD(mgr->listenon);
old != NULL;
old = ISC_LIST_NEXT(old, link))
diff --git a/external/bsd/bind/dist/bin/named/logconf.c b/external/bsd/bind/dist/bin/named/logconf.c
index 138fe062a67..89e2c0245c8 100644
--- a/external/bsd/bind/dist/bin/named/logconf.c
+++ b/external/bsd/bind/dist/bin/named/logconf.c
@@ -1,7 +1,7 @@
-/* $NetBSD: logconf.c,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: logconf.c,v 1.3 2011/09/11 18:55:27 christos Exp $ */
/*
- * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,12 +17,13 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: logconf.c,v 1.42 2007-06-19 23:46:59 tbox Exp */
+/* Id: logconf.c,v 1.45 2011-03-05 23:52:29 tbox Exp */
/*! \file */
#include <config.h>
+#include <isc/file.h>
#include <isc/offset.h>
#include <isc/result.h>
#include <isc/stdio.h>
@@ -132,7 +133,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
}
type = ISC_LOG_TONULL;
-
+
if (fileobj != NULL) {
const cfg_obj_t *pathobj = cfg_tuple_get(fileobj, "file");
const cfg_obj_t *sizeobj = cfg_tuple_get(fileobj, "size");
@@ -142,7 +143,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
isc_offset_t size = 0;
type = ISC_LOG_TOFILE;
-
+
if (versionsobj != NULL && cfg_obj_isuint32(versionsobj))
versions = cfg_obj_asuint32(versionsobj);
if (versionsobj != NULL && cfg_obj_isstring(versionsobj) &&
@@ -221,26 +222,38 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
if (result == ISC_R_SUCCESS && type == ISC_LOG_TOFILE) {
FILE *fp;
-
- /*
- * Test that the file can be opened, since isc_log_open()
- * can't effectively report failures when called in
- * isc_log_doit().
- */
- result = isc_stdio_open(dest.file.name, "a", &fp);
- if (result != ISC_R_SUCCESS)
- isc_log_write(ns_g_lctx, CFG_LOGCATEGORY_CONFIG,
- NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
- "logging channel '%s' file '%s': %s",
- channelname, dest.file.name,
- isc_result_totext(result));
- else
- (void)isc_stdio_close(fp);
/*
- * Allow named to continue by returning success.
- */
- result = ISC_R_SUCCESS;
+ * Test to make sure that file is a plain file.
+ * Fix defect #22771
+ */
+ result = isc_file_isplainfile(dest.file.name);
+ if (result == ISC_R_SUCCESS ||
+ result == ISC_R_FILENOTFOUND) {
+ /*
+ * Test that the file can be opened, since
+ * isc_log_open() can't effectively report
+ * failures when called in
+ * isc_log_doit().
+ */
+ result = isc_stdio_open(dest.file.name, "a", &fp);
+ if (result != ISC_R_SUCCESS) {
+ syslog(LOG_ERR,
+ "isc_stdio_open '%s' failed: %s",
+ dest.file.name,
+ isc_result_totext(result));
+ fprintf(stderr,
+ "isc_stdio_open '%s' failed: %s",
+ dest.file.name,
+ isc_result_totext(result));
+ } else
+ (void)isc_stdio_close(fp);
+ } else {
+ syslog(LOG_ERR, "isc_file_isplainfile '%s' failed: %s",
+ dest.file.name, isc_result_totext(result));
+ fprintf(stderr, "isc_file_isplainfile '%s' failed: %s",
+ dest.file.name, isc_result_totext(result));
+ }
}
return (result);
diff --git a/external/bsd/bind/dist/bin/named/main.c b/external/bsd/bind/dist/bin/named/main.c
index effafcd5c04..dcaa3314d9c 100644
--- a/external/bsd/bind/dist/bin/named/main.c
+++ b/external/bsd/bind/dist/bin/named/main.c
@@ -1,7 +1,7 @@
-/* $NetBSD: main.c,v 1.7 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: main.c,v 1.8 2011/09/11 18:55:27 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: main.c,v 1.180 2010-12-22 03:59:02 marka Exp */
+/* Id: main.c,v 1.183 2011-03-11 06:11:21 marka Exp */
/*! \file */
@@ -53,6 +53,8 @@
#include <dst/result.h>
+#include <dlz/dlz_dlopen_driver.h>
+
/*
* Defining NS_MAIN provides storage declarations (rather than extern)
* for variables in named/globals.h.
@@ -83,10 +85,10 @@
*/
/* #include "xxdb.h" */
+#ifdef CONTRIB_DLZ
/*
- * Include DLZ drivers if appropriate.
+ * Include contributed DLZ drivers if appropriate.
*/
-#ifdef DLZ
#include <dlz/dlz_drivers.h>
#endif
@@ -562,6 +564,7 @@ parse_command_line(int argc, char *argv[]) {
argc -= isc_commandline_index;
argv += isc_commandline_index;
+ POST(argv);
if (argc > 0) {
usage();
@@ -858,9 +861,19 @@ setup(void) {
*/
/* xxdb_init(); */
-#ifdef DLZ
+#ifdef ISC_DLZ_DLOPEN
+ /*
+ * Register the DLZ "dlopen" driver.
+ */
+ result = dlz_dlopen_init(ns_g_mctx);
+ if (result != ISC_R_SUCCESS)
+ ns_main_earlyfatal("dlz_dlopen_init() failed: %s",
+ isc_result_totext(result));
+#endif
+
+#if CONTRIB_DLZ
/*
- * Register any DLZ drivers.
+ * Register any other contributed DLZ drivers.
*/
result = dlz_drivers_init();
if (result != ISC_R_SUCCESS)
@@ -884,12 +897,18 @@ cleanup(void) {
*/
/* xxdb_clear(); */
-#ifdef DLZ
+#ifdef CONTRIB_DLZ
/*
- * Unregister any DLZ drivers.
+ * Unregister contributed DLZ drivers.
*/
dlz_drivers_clear();
#endif
+#ifdef ISC_DLZ_DLOPEN
+ /*
+ * Unregister "dlopen" DLZ driver.
+ */
+ dlz_dlopen_clear();
+#endif
dns_name_destroy();
diff --git a/external/bsd/bind/dist/bin/named/named.conf.5 b/external/bsd/bind/dist/bin/named/named.conf.5
index 6e3c3ac7c86..d02e62c5d4d 100644
--- a/external/bsd/bind/dist/bin/named/named.conf.5
+++ b/external/bsd/bind/dist/bin/named/named.conf.5
@@ -1,4 +1,4 @@
-.\" $NetBSD: named.conf.5,v 1.6 2011/02/16 03:46:46 christos Exp $
+.\" $NetBSD: named.conf.5,v 1.7 2011/09/11 18:55:27 christos Exp $
.\"
.\" Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
.\"
@@ -14,7 +14,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" Id: named.conf.5,v 1.44.12.1 2011-02-03 12:29:12 tbox Exp
+.\" Id: named.conf.5,v 1.47 2011-05-09 01:14:45 tbox Exp
.\"
.hy 0
.ad l
@@ -292,7 +292,8 @@ options {
notify\-delay \fIseconds\fR;
notify\-to\-soa \fIboolean\fR;
also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )
- [ port \fIinteger\fR ]; ... };
+ [ port \fIinteger\fR ]; ...
+ [ key \fIkeyname\fR ] ... };
allow\-notify { \fIaddress_match_element\fR; ... };
forward ( first | only );
forwarders [ port \fIinteger\fR ] {
@@ -461,7 +462,8 @@ view \fIstring\fR \fIoptional_class\fR {
notify\-delay \fIseconds\fR;
notify\-to\-soa \fIboolean\fR;
also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )
- [ port \fIinteger\fR ]; ... };
+ [ port \fIinteger\fR ]; ...
+ [ key \fIkeyname\fR ] ... };
allow\-notify { \fIaddress_match_element\fR; ... };
forward ( first | only );
forwarders [ port \fIinteger\fR ] {
@@ -505,7 +507,7 @@ view \fIstring\fR \fIoptional_class\fR {
.RS 4
.nf
zone \fIstring\fR \fIoptional_class\fR {
- type ( master | slave | stub | hint |
+ type ( master | slave | stub | hint | redirect |
forward | delegation\-only );
file \fIquoted_string\fR;
masters [ port \fIinteger\fR ] {
@@ -547,7 +549,8 @@ zone \fIstring\fR \fIoptional_class\fR {
notify\-delay \fIseconds\fR;
notify\-to\-soa \fIboolean\fR;
also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )
- [ port \fIinteger\fR ]; ... };
+ [ port \fIinteger\fR ]; ...
+ [ key \fIkeyname\fR ] ... };
allow\-notify { \fIaddress_match_element\fR; ... };
forward ( first | only );
forwarders [ port \fIinteger\fR ] {
diff --git a/external/bsd/bind/dist/bin/named/named.conf.docbook b/external/bsd/bind/dist/bin/named/named.conf.docbook
index faf80ca1cb5..39a637eaddd 100644
--- a/external/bsd/bind/dist/bin/named/named.conf.docbook
+++ b/external/bsd/bind/dist/bin/named/named.conf.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-<!-- Id: named.conf.docbook,v 1.49.14.1 2011-02-03 05:50:05 marka Exp -->
+<!-- Id: named.conf.docbook,v 1.52 2011-05-06 21:23:50 each Exp -->
<refentry>
<refentryinfo>
<date>Aug 13, 2004</date>
@@ -326,7 +326,8 @@ options {
notify-delay <replaceable>seconds</replaceable>;
notify-to-soa <replaceable>boolean</replaceable>;
also-notify <optional> port <replaceable>integer</replaceable> </optional> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> )
- <optional> port <replaceable>integer</replaceable> </optional>; ... };
+ <optional> port <replaceable>integer</replaceable> </optional>; ...
+ <optional> key <replaceable>keyname</replaceable> </optional> ... };
allow-notify { <replaceable>address_match_element</replaceable>; ... };
forward ( first | only );
@@ -513,7 +514,8 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
notify-delay <replaceable>seconds</replaceable>;
notify-to-soa <replaceable>boolean</replaceable>;
also-notify <optional> port <replaceable>integer</replaceable> </optional> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> )
- <optional> port <replaceable>integer</replaceable> </optional>; ... };
+ <optional> port <replaceable>integer</replaceable> </optional>; ...
+ <optional> key <replaceable>keyname</replaceable> </optional> ... };
allow-notify { <replaceable>address_match_element</replaceable>; ... };
forward ( first | only );
@@ -563,7 +565,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
<title>ZONE</title>
<literallayout>
zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable> {
- type ( master | slave | stub | hint |
+ type ( master | slave | stub | hint | redirect |
forward | delegation-only );
file <replaceable>quoted_string</replaceable>;
@@ -609,7 +611,8 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
notify-delay <replaceable>seconds</replaceable>;
notify-to-soa <replaceable>boolean</replaceable>;
also-notify <optional> port <replaceable>integer</replaceable> </optional> { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> )
- <optional> port <replaceable>integer</replaceable> </optional>; ... };
+ <optional> port <replaceable>integer</replaceable> </optional>; ...
+ <optional> key <replaceable>keyname</replaceable> </optional> ... };
allow-notify { <replaceable>address_match_element</replaceable>; ... };
forward ( first | only );
diff --git a/external/bsd/bind/dist/bin/named/named.conf.html b/external/bsd/bind/dist/bin/named/named.conf.html
index d6159be1153..5da98e59680 100644
--- a/external/bsd/bind/dist/bin/named/named.conf.html
+++ b/external/bsd/bind/dist/bin/named/named.conf.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-<!-- Id: named.conf.html,v 1.53.12.1 2011-02-03 12:29:12 tbox Exp -->
+<!-- Id: named.conf.html,v 1.56 2011-05-09 01:14:45 tbox Exp -->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -292,7 +292,8 @@ options {<br>
notify-delay <em class="replaceable"><code>seconds</code></em>;<br>
notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
also-notify [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> )<br>
- [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ... };<br>
+ [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ...<br>
+ [<span class="optional"> key <em class="replaceable"><code>keyname</code></em> </span>] ... };<br>
allow-notify { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
<br>
forward ( first | only );<br>
@@ -361,7 +362,7 @@ options {<br>
</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2544577"></a><h2>VIEW</h2>
+<a name="id2544583"></a><h2>VIEW</h2>
<div class="literallayout"><p><br>
view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -478,7 +479,8 @@ view <em class="replaceable"><code>string</code></em> <em class="replaceable"><c
notify-delay <em class="replaceable"><code>seconds</code></em>;<br>
notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
also-notify [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> )<br>
- [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ... };<br>
+ [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ...<br>
+ [<span class="optional"> key <em class="replaceable"><code>keyname</code></em> </span>] ... };<br>
allow-notify { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
<br>
forward ( first | only );<br>
@@ -524,10 +526,10 @@ view <em class="replaceable"><code>string</code></em> <em class="replaceable"><c
</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2545280"></a><h2>ZONE</h2>
+<a name="id2545292"></a><h2>ZONE</h2>
<div class="literallayout"><p><br>
zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
- type ( master | slave | stub | hint |<br>
+ type ( master | slave | stub | hint | redirect |<br>
forward | delegation-only );<br>
file <em class="replaceable"><code>quoted_string</code></em>;<br>
<br>
@@ -573,7 +575,8 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c
notify-delay <em class="replaceable"><code>seconds</code></em>;<br>
notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
also-notify [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> )<br>
- [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ... };<br>
+ [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ...<br>
+ [<span class="optional"> key <em class="replaceable"><code>keyname</code></em> </span>] ... };<br>
allow-notify { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
<br>
forward ( first | only );<br>
@@ -619,12 +622,12 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c
</p></div>
</div>
<div class="refsect1" lang="en">
-<a name="id2545659"></a><h2>FILES</h2>
+<a name="id2545678"></a><h2>FILES</h2>
<p><code class="filename">/etc/named.conf</code>
</p>
</div>
<div class="refsect1" lang="en">
-<a name="id2545671"></a><h2>SEE ALSO</h2>
+<a name="id2545690"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
<span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
diff --git a/external/bsd/bind/dist/bin/named/query.c b/external/bsd/bind/dist/bin/named/query.c
index 3f0d247c939..408e05d8dbc 100644
--- a/external/bsd/bind/dist/bin/named/query.c
+++ b/external/bsd/bind/dist/bin/named/query.c
@@ -1,4 +1,4 @@
-/* $NetBSD: query.c,v 1.5 2011/07/05 21:59:18 spz Exp $ */
+/* $NetBSD: query.c,v 1.6 2011/09/11 18:55:27 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: query.c,v 1.353.8.2.2.5 2011-06-09 03:17:10 marka Exp */
+/* Id: query.c,v 1.367 2011-06-09 03:10:17 marka Exp */
/*! \file */
@@ -33,9 +33,7 @@
#include <dns/adb.h>
#include <dns/byaddr.h>
#include <dns/db.h>
-#ifdef DLZ
#include <dns/dlz.h>
-#endif
#include <dns/dns64.h>
#include <dns/dnssec.h>
#include <dns/events.h>
@@ -1029,7 +1027,6 @@ query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
{
isc_result_t result;
-#ifdef DLZ
isc_result_t tresult;
unsigned int namelabels;
unsigned int zonelabels;
@@ -1095,16 +1092,10 @@ query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
result = tresult;
}
}
-#else
- result = query_getzonedb(client, name, qtype, options,
- zonep, dbp, versionp);
-#endif
/* If successful, Transfer ownership of zone. */
if (result == ISC_R_SUCCESS) {
-#ifdef DLZ
*zonep = zone;
-#endif
/*
* If neither attempt above succeeded, return the cache instead
*/
@@ -1635,6 +1626,7 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
need_addname = ISC_FALSE;
zone = NULL;
needadditionalcache = ISC_FALSE;
+ POST(needadditionalcache);
additionaltype = dns_rdatasetadditional_fromauth;
dns_name_init(&cfname, NULL);
@@ -4307,11 +4299,12 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype,
* Check rules for the name if this it the first time,
* i.e. we've not been recursing.
*/
- result = DNS_R_SERVFAIL;
st->state &= ~(DNS_RPZ_HAVE_IP | DNS_RPZ_HAVE_NSIPv4 |
DNS_RPZ_HAVE_NSIPv6 | DNS_RPZ_HAD_NSDNAME);
result = rpz_rewrite_name(client, qtype, client->query.qname,
DNS_RPZ_TYPE_QNAME, &rdataset);
+ if (result != ISC_R_SUCCESS)
+ goto cleanup;
if (st->m.policy != DNS_RPZ_POLICY_MISS)
goto cleanup;
if ((st->state & (DNS_RPZ_HAVE_NSIPv4 | DNS_RPZ_HAVE_NSIPv6 |
@@ -4417,9 +4410,10 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype,
(st->state & DNS_RPZ_HAVE_NSIPv6) != 0 &&
st->m.type != DNS_RPZ_TYPE_NSDNAME) {
result = rpz_rewrite_nsip(client,
- dns_rdatatype_aaaa,
- &ns.name, &ipdb, version,
- &rdataset, resuming);
+ dns_rdatatype_aaaa,
+ &ns.name, &ipdb,
+ version, &rdataset,
+ resuming);
}
dns_rdata_freestruct(&ns);
if (ipdb != NULL)
@@ -4934,16 +4928,118 @@ dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset,
break;
}
}
- if (i == count)
+ if (i == count && aaaaok != NULL)
isc_mem_put(client->mctx, aaaaok,
sizeof(isc_boolean_t) * count);
return (ISC_TRUE);
}
- isc_mem_put(client->mctx, aaaaok, sizeof(isc_boolean_t) * count);
+ if (aaaaok != NULL)
+ isc_mem_put(client->mctx, aaaaok,
+ sizeof(isc_boolean_t) * count);
return (ISC_FALSE);
}
/*
+ * Look for the name and type in the redirection zone. If found update
+ * the arguments as appropriate. Return ISC_TRUE if a update was
+ * performed.
+ *
+ * Only perform the update if the client is in the allow query acl and
+ * returning the update would not cause a DNSSEC validation failure.
+ */
+static isc_boolean_t
+redirect(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
+ dns_dbnode_t **nodep, dns_db_t **dbp, dns_rdatatype_t qtype)
+{
+ dns_db_t *db = NULL;
+ dns_dbnode_t *node = NULL;
+ dns_fixedname_t fixed;
+ dns_name_t *found;
+ dns_rdataset_t trdataset;
+ isc_result_t result;
+ dns_rdatatype_t type;
+
+ CTRACE("redirect");
+
+ if (client->view->redirect == NULL)
+ return (ISC_FALSE);
+
+ dns_fixedname_init(&fixed);
+ found = dns_fixedname_name(&fixed);
+ dns_rdataset_init(&trdataset);
+
+ if (WANTDNSSEC(client) && dns_db_iszone(*dbp) && dns_db_issecure(*dbp))
+ return (ISC_FALSE);
+
+ if (WANTDNSSEC(client) && dns_rdataset_isassociated(rdataset)) {
+ if (rdataset->trust == dns_trust_secure)
+ return (ISC_FALSE);
+ if (rdataset->trust == dns_trust_ultimate &&
+ (rdataset->type == dns_rdatatype_nsec ||
+ rdataset->type == dns_rdatatype_nsec3))
+ return (ISC_FALSE);
+ if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+ for (result = dns_rdataset_first(rdataset);
+ result == ISC_R_SUCCESS;
+ result = dns_rdataset_next(rdataset)) {
+ dns_ncache_current(rdataset, found, &trdataset);
+ type = trdataset.type;
+ dns_rdataset_disassociate(&trdataset);
+ if (type == dns_rdatatype_nsec ||
+ type == dns_rdatatype_nsec3 ||
+ type == dns_rdatatype_rrsig)
+ return (ISC_FALSE);
+ }
+ }
+ }
+
+ result = ns_client_checkaclsilent(client, NULL,
+ dns_zone_getqueryacl(client->view->redirect),
+ ISC_TRUE);
+ if (result != ISC_R_SUCCESS)
+ return (ISC_FALSE);
+
+ result = dns_zone_getdb(client->view->redirect, &db);
+ if (result != ISC_R_SUCCESS)
+ return (ISC_FALSE);
+
+ /*
+ * Lookup the requested data in the redirect zone.
+ */
+ result = dns_db_find(db, client->query.qname, NULL, qtype, 0,
+ client->now, &node, found, &trdataset, NULL);
+ if (result != ISC_R_SUCCESS) {
+ if (dns_rdataset_isassociated(&trdataset))
+ dns_rdataset_disassociate(&trdataset);
+ if (node != NULL)
+ dns_db_detachnode(db, &node);
+ dns_db_detach(&db);
+ return (ISC_FALSE);
+ }
+ CTRACE("redirect: found data: done");
+
+ dns_name_copy(found, name, NULL);
+ if (dns_rdataset_isassociated(rdataset))
+ dns_rdataset_disassociate(rdataset);
+ if (dns_rdataset_isassociated(&trdataset)) {
+ dns_rdataset_clone(&trdataset, rdataset);
+ dns_rdataset_disassociate(&trdataset);
+ }
+ if (*nodep != NULL)
+ dns_db_detachnode(*dbp, nodep);
+ dns_db_detach(dbp);
+ dns_db_attachnode(db, node, nodep);
+ dns_db_attach(db, dbp);
+ dns_db_detachnode(db, &node);
+ dns_db_detach(&db);
+
+ client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
+ NS_QUERYATTR_NOADDITIONAL);
+
+ return (ISC_TRUE);
+}
+
+/*
* Do the bulk of query processing for the current query of 'client'.
* If 'event' is non-NULL, we are returning from recursion and 'qtype'
* is ignored. Otherwise, 'qtype' is the query type.
@@ -5200,25 +5296,22 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
}
is_staticstub_zone = ISC_FALSE;
- if (is_zone && zone != NULL) {
+ if (is_zone) {
authoritative = ISC_TRUE;
- if (dns_zone_gettype(zone) == dns_zone_staticstub)
+ if (zone != NULL &&
+ dns_zone_gettype(zone) == dns_zone_staticstub)
is_staticstub_zone = ISC_TRUE;
}
if (event == NULL && client->query.restarts == 0) {
if (is_zone) {
-#ifdef DLZ
if (zone != NULL) {
/*
* if is_zone = true, zone = NULL then this is
* a DLZ zone. Don't attempt to attach zone.
*/
-#endif
dns_zone_attach(zone, &client->query.authzone);
-#ifdef DLZ
}
-#endif
dns_db_attach(db, &client->query.authdb);
}
client->query.authdbset = ISC_TRUE;
@@ -5292,7 +5385,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
dns_name_copy(fname, rpz_st->fname, NULL);
rpz_st->q.result = result;
client->query.attributes |= NS_QUERYATTR_RECURSING;
- result = ISC_R_SUCCESS;
goto cleanup;
default:
RECURSE_ERROR(rresult);
@@ -5745,8 +5837,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
goto db_find;
}
- result = DNS_R_NXRRSET;
-
/*
* Look for a NSEC3 record if we don't have a NSEC record.
*/
@@ -5860,6 +5950,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
case DNS_R_NXDOMAIN:
INSIST(is_zone);
+ if (!empty_wild &&
+ redirect(client, fname, rdataset, &node, &db, type))
+ break;
if (dns_rdataset_isassociated(rdataset)) {
/*
* If we've got a NSEC record, we need to save the
@@ -5882,9 +5975,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
* resolver and not have it cached.
*/
if (qtype == dns_rdatatype_soa &&
-#ifdef DLZ
zone != NULL &&
-#endif
dns_zone_getzeronosoattl(zone))
result = query_addsoa(client, db, version, 0,
dns_rdataset_isassociated(rdataset));
@@ -5920,6 +6011,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
goto cleanup;
case DNS_R_NCACHENXDOMAIN:
+ if (redirect(client, fname, rdataset, &node, &db, type))
+ break;
case DNS_R_NCACHENXRRSET:
ncache_nxrrset:
INSIST(!is_zone);
@@ -6163,17 +6256,17 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
}
result = dns_name_concatenate(prefix, tname, fname, NULL);
dns_message_puttempname(client->message, &tname);
- if (result != ISC_R_SUCCESS) {
- if (result == ISC_R_NOSPACE) {
- /*
- * RFC2672, section 4.1, subsection 3c says
- * we should return YXDOMAIN if the constructed
- * name would be too long.
- */
- client->message->rcode = dns_rcode_yxdomain;
- }
+
+ /*
+ * RFC2672, section 4.1, subsection 3c says
+ * we should return YXDOMAIN if the constructed
+ * name would be too long.
+ */
+ if (result == DNS_R_NAMETOOLONG)
+ client->message->rcode = dns_rcode_yxdomain;
+ if (result != ISC_R_SUCCESS)
goto cleanup;
- }
+
query_keepname(client, fname, dbuf);
/*
* Synthesize a CNAME consisting of
@@ -6644,9 +6737,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
/*
* Add a fake SOA record.
*/
- result = query_addsoa(client, db,
- version, 600,
- ISC_FALSE);
+ (void)query_addsoa(client, db, version,
+ 600, ISC_FALSE);
goto cleanup;
}
#endif
diff --git a/external/bsd/bind/dist/bin/named/server.c b/external/bsd/bind/dist/bin/named/server.c
index c7cbf21c52a..9cb8245b372 100644
--- a/external/bsd/bind/dist/bin/named/server.c
+++ b/external/bsd/bind/dist/bin/named/server.c
@@ -1,4 +1,4 @@
-/* $NetBSD: server.c,v 1.9 2011/05/29 15:17:09 spz Exp $ */
+/* $NetBSD: server.c,v 1.10 2011/09/11 18:55:28 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: server.c,v 1.599.8.4 2011-02-16 19:46:12 each Exp */
+/* Id: server.c,v 1.616 2011-08-02 20:36:11 each Exp */
/*! \file */
@@ -62,9 +62,7 @@
#include <dns/cache.h>
#include <dns/db.h>
#include <dns/dispatch.h>
-#ifdef DLZ
#include <dns/dlz.h>
-#endif
#include <dns/dns64.h>
#include <dns/forward.h>
#include <dns/journal.h>
@@ -208,13 +206,15 @@ struct zonelistentry {
/*%
* Configuration context to retain for each view that allows
- * new zones to be added at runtime
+ * new zones to be added at runtime.
*/
struct cfg_context {
isc_mem_t * mctx;
- cfg_obj_t * config;
cfg_parser_t * parser;
- cfg_aclconfctx_t actx;
+ cfg_obj_t * config;
+ cfg_parser_t * nzparser;
+ cfg_obj_t * nzconfig;
+ cfg_aclconfctx_t * actx;
};
/*
@@ -224,7 +224,6 @@ static const struct {
const char *zone;
isc_boolean_t rfc1918;
} empty_zones[] = {
-#ifdef notyet
/* RFC 1918 */
{ "10.IN-ADDR.ARPA", ISC_TRUE },
{ "16.172.IN-ADDR.ARPA", ISC_TRUE },
@@ -244,7 +243,6 @@ static const struct {
{ "30.172.IN-ADDR.ARPA", ISC_TRUE },
{ "31.172.IN-ADDR.ARPA", ISC_TRUE },
{ "168.192.IN-ADDR.ARPA", ISC_TRUE },
-#endif
/* RFC 5735 and RFC 5737 */
{ "0.IN-ADDR.ARPA", ISC_FALSE }, /* THIS NETWORK */
@@ -306,7 +304,7 @@ static void
end_reserved_dispatches(ns_server_t *server, isc_boolean_t all);
static void
-cfgctx_destroy(void **cfgp);
+newzone_cfgctx_destroy(void **cfgp);
/*%
* Configure a single view ACL at '*aclp'. Get its configuration from
@@ -849,18 +847,13 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
int af, dns_dispatch_t **dispatchp,
isc_boolean_t is_firstview)
{
- isc_result_t result;
+ isc_result_t result = ISC_R_FAILURE;
dns_dispatch_t *disp;
isc_sockaddr_t sa;
unsigned int attrs, attrmask;
const cfg_obj_t *obj = NULL;
unsigned int maxdispatchbuffers;
- /*
- * Make compiler happy.
- */
- result = ISC_R_FAILURE;
-
switch (af) {
case AF_INET:
result = ns_config_get(maps, "query-source", &obj);
@@ -1342,7 +1335,6 @@ cache_sharable(dns_view_t *originview, dns_view_t *view,
return (ISC_TRUE);
}
-#ifdef DLZ
/*
* Callback from DLZ configure when the driver sets up a writeable zone
*/
@@ -1360,7 +1352,6 @@ dlzconfigure_callback(dns_view_t *view, dns_zone_t *zone) {
return ns_zone_configure_writeable_dlz(view->dlzdatabase,
zone, zclass, origin);
}
-#endif
static isc_result_t
dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
@@ -1556,8 +1547,7 @@ configure_rpz(dns_view_t *view, const cfg_listelt_t *element) {
* global defaults in 'config' used exclusively.
*/
static isc_result_t
-configure_view(dns_view_t *view, cfg_parser_t* parser,
- cfg_obj_t *config, cfg_obj_t *vconfig,
+configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
ns_cachelist_t *cachelist, const cfg_obj_t *bindkeys,
isc_mem_t *mctx, cfg_aclconfctx_t *actx,
isc_boolean_t need_hints)
@@ -1571,11 +1561,9 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
const cfg_obj_t *forwarders;
const cfg_obj_t *alternates;
const cfg_obj_t *zonelist;
-#ifdef DLZ
const cfg_obj_t *dlz;
unsigned int dlzargc;
char **dlzargv;
-#endif
const cfg_obj_t *disabled;
const cfg_obj_t *obj;
const cfg_listelt_t *element;
@@ -1589,7 +1577,7 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
isc_uint32_t lame_ttl;
dns_tsig_keyring_t *ring = NULL;
dns_view_t *pview = NULL; /* Production view */
- isc_mem_t *cmctx;
+ isc_mem_t *cmctx = NULL, *hmctx = NULL;
dns_dispatch_t *dispatch4 = NULL;
dns_dispatch_t *dispatch6 = NULL;
isc_boolean_t reused_cache = ISC_FALSE;
@@ -1614,15 +1602,12 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
isc_boolean_t auto_root = ISC_FALSE;
ns_cache_t *nsc;
isc_boolean_t zero_no_soattl;
- cfg_parser_t *newzones_parser = NULL;
- cfg_obj_t *nzfconf = NULL;
dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
unsigned int query_timeout;
+ struct cfg_context *nzctx;
REQUIRE(DNS_VIEW_VALID(view));
- cmctx = NULL;
-
if (config != NULL)
(void)cfg_map_get(config, "options", &options);
@@ -1653,6 +1638,7 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
sep = "";
viewname = "";
forview = "";
+ POST(forview);
}
/*
@@ -1724,6 +1710,10 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
(void)cfg_map_get(voptions, "zone", &zonelist);
else
(void)cfg_map_get(config, "zone", &zonelist);
+
+ /*
+ * Load zone configuration
+ */
for (element = cfg_list_first(zonelist);
element != NULL;
element = cfg_list_next(element))
@@ -1734,61 +1724,31 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
}
/*
- * Are we allowing zones to be added and deleted dynamically?
- */
- obj = NULL;
- result = ns_config_get(maps, "allow-new-zones", &obj);
- if (result == ISC_R_SUCCESS) {
- isc_boolean_t allow = cfg_obj_asboolean(obj);
- struct cfg_context *cfg = NULL;
- if (allow) {
- cfg = isc_mem_get(view->mctx, sizeof(*cfg));
- if (cfg == NULL) {
- result = ISC_R_NOMEMORY;
- goto cleanup;
- }
- memset(cfg, 0, sizeof(*cfg));
- isc_mem_attach(view->mctx, &cfg->mctx);
- if (config != NULL)
- cfg_obj_attach(config, &cfg->config);
- cfg_parser_attach(parser, &cfg->parser);
- cfg_aclconfctx_clone(actx, &cfg->actx);
- }
- dns_view_setnewzones(view, allow, cfg, cfgctx_destroy);
- }
-
- /*
* If we're allowing added zones, then load zone configuration
* from the newzone file for zones that were added during previous
* runs.
*/
- if (view->new_zone_file != NULL) {
+ nzctx = view->new_zone_config;
+ if (nzctx != NULL && nzctx->nzconfig != NULL) {
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
NS_LOGMODULE_SERVER, ISC_LOG_INFO,
"loading additional zones for view '%s'",
view->name);
- CHECK(cfg_parser_create(view->mctx, ns_g_lctx,
- &newzones_parser));
- result = cfg_parse_file(newzones_parser, view->new_zone_file,
- &cfg_type_newzones, &nzfconf);
- if (result == ISC_R_SUCCESS) {
- zonelist = NULL;
- cfg_map_get(nzfconf, "zone", &zonelist);
- for (element = cfg_list_first(zonelist);
- element != NULL;
- element = cfg_list_next(element))
- {
- const cfg_obj_t *zconfig =
- cfg_listelt_value(element);
- CHECK(configure_zone(config, zconfig, vconfig,
- mctx, view, actx,
- ISC_TRUE));
- }
+ zonelist = NULL;
+ cfg_map_get(nzctx->nzconfig, "zone", &zonelist);
+
+ for (element = cfg_list_first(zonelist);
+ element != NULL;
+ element = cfg_list_next(element))
+ {
+ const cfg_obj_t *zconfig = cfg_listelt_value(element);
+ CHECK(configure_zone(config, zconfig, vconfig,
+ mctx, view, actx,
+ ISC_TRUE));
}
}
-#ifdef DLZ
/*
* Create Dynamically Loadable Zone driver.
*/
@@ -1833,7 +1793,6 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
goto cleanup;
}
}
-#endif
/*
* Obtain configuration parameters that affect the decision of whether
@@ -2105,13 +2064,21 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
* view but is not yet configured. If it is not the
* view name but not a forward reference either, then it
* is simply a named cache that is not shared.
+ *
+ * We use two separate memory contexts for the
+ * cache, for the main cache memory and the heap
+ * memory.
*/
CHECK(isc_mem_create(0, 0, &cmctx));
isc_mem_setname(cmctx, "cache", NULL);
- CHECK(dns_cache_create2(cmctx, ns_g_taskmgr,
+ CHECK(isc_mem_create(0, 0, &hmctx));
+ isc_mem_setname(hmctx, "cache_heap", NULL);
+ CHECK(dns_cache_create3(cmctx, hmctx, ns_g_taskmgr,
ns_g_timermgr, view->rdclass,
cachename, "rbt", 0, NULL,
&cache));
+ isc_mem_detach(&cmctx);
+ isc_mem_detach(&hmctx);
}
nsc = isc_mem_get(mctx, sizeof(*nsc));
if (nsc == NULL) {
@@ -2912,8 +2879,8 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
if (result == ISC_R_SUCCESS)
cfg_map_get(obj, "zone", &zonelist);
}
- if (zonelist != NULL) {
+ if (zonelist != NULL) {
for (element = cfg_list_first(zonelist);
element != NULL;
element = cfg_list_next(element)) {
@@ -2949,16 +2916,12 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
dns_order_detach(&order);
if (cmctx != NULL)
isc_mem_detach(&cmctx);
+ if (hmctx != NULL)
+ isc_mem_detach(&hmctx);
if (cache != NULL)
dns_cache_detach(&cache);
- if (newzones_parser != NULL) {
- if (nzfconf != NULL)
- cfg_obj_destroy(newzones_parser, &nzfconf);
- cfg_parser_destroy(&newzones_parser);
- }
-
return (result);
}
@@ -3163,21 +3126,16 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
return (result);
}
-/*
- * Create a new view and add it to the list.
- *
- * If 'vconfig' is NULL, create the default view.
- *
- * The view created is attached to '*viewp'.
- */
static isc_result_t
-create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
- dns_view_t **viewp)
+get_viewinfo(const cfg_obj_t *vconfig, const char **namep,
+ dns_rdataclass_t *classp)
{
- isc_result_t result;
+ isc_result_t result = ISC_R_SUCCESS;
const char *viewname;
dns_rdataclass_t viewclass;
- dns_view_t *view = NULL;
+
+ REQUIRE(namep != NULL && *namep == NULL);
+ REQUIRE(classp != NULL);
if (vconfig != NULL) {
const cfg_obj_t *classobj = NULL;
@@ -3190,6 +3148,59 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
viewname = "_default";
viewclass = dns_rdataclass_in;
}
+
+ *namep = viewname;
+ *classp = viewclass;
+
+ return (result);
+}
+
+/*
+ * Find a view based on its configuration info and attach to it.
+ *
+ * If 'vconfig' is NULL, attach to the default view.
+ */
+static isc_result_t
+find_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
+ dns_view_t **viewp)
+{
+ isc_result_t result;
+ const char *viewname = NULL;
+ dns_rdataclass_t viewclass;
+ dns_view_t *view = NULL;
+
+ result = get_viewinfo(vconfig, &viewname, &viewclass);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
+ result = dns_viewlist_find(viewlist, viewname, viewclass, &view);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
+ *viewp = view;
+ return (ISC_R_SUCCESS);
+}
+
+/*
+ * Create a new view and add it to the list.
+ *
+ * If 'vconfig' is NULL, create the default view.
+ *
+ * The view created is attached to '*viewp'.
+ */
+static isc_result_t
+create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
+ dns_view_t **viewp)
+{
+ isc_result_t result;
+ const char *viewname = NULL;
+ dns_rdataclass_t viewclass;
+ dns_view_t *view = NULL;
+
+ result = get_viewinfo(vconfig, &viewname, &viewclass);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
result = dns_viewlist_find(viewlist, viewname, viewclass, &view);
if (result == ISC_R_SUCCESS)
return (ISC_R_EXISTS);
@@ -3344,6 +3355,37 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
}
/*
+ * Redirect zones only require minimal configuration.
+ */
+ if (strcasecmp(ztypestr, "redirect") == 0) {
+ if (view->redirect != NULL) {
+ cfg_obj_log(zconfig, ns_g_lctx, ISC_LOG_ERROR,
+ "redirect zone already exists");
+ result = ISC_R_EXISTS;
+ goto cleanup;
+ }
+ result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
+ view->rdclass, &pview);
+ if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS)
+ goto cleanup;
+ if (pview != NULL && pview->redirect != NULL) {
+ dns_zone_attach(pview->redirect, &zone);
+ dns_zone_setview(zone, view);
+ } else {
+ CHECK(dns_zone_create(&zone, mctx));
+ CHECK(dns_zone_setorigin(zone, origin));
+ dns_zone_setview(zone, view);
+ CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr,
+ zone));
+ dns_zone_setstats(zone, ns_g_server->zonestats);
+ }
+ CHECK(ns_zone_configure(config, vconfig, zconfig, aclconf,
+ zone));
+ dns_zone_attach(zone, &view->redirect);
+ goto cleanup;
+ }
+
+ /*
* Check for duplicates in the new zone table.
*/
result = dns_view_findzone(view, origin, &dupzone);
@@ -3368,9 +3410,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
* options (e.g., an existing master zone cannot
* be reused if the options specify a slave zone)
*/
- result = dns_viewlist_find(&ns_g_server->viewlist,
- view->name, view->rdclass,
- &pview);
+ result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
+ view->rdclass, &pview);
if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS)
goto cleanup;
if (pview != NULL)
@@ -3926,6 +3967,9 @@ removed(dns_zone_t *zone, void *uap) {
case dns_zone_stub:
type = "stub";
break;
+ case dns_zone_redirect:
+ type = "redirect";
+ break;
default:
type = "other";
break;
@@ -4148,10 +4192,98 @@ configure_session_key(const cfg_obj_t **maps, ns_server_t *server,
}
static isc_result_t
+setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
+ cfg_parser_t *parser, cfg_aclconfctx_t *actx)
+{
+ isc_result_t result = ISC_R_SUCCESS;
+ isc_boolean_t allow = ISC_FALSE;
+ struct cfg_context *nzcfg = NULL;
+ cfg_parser_t *nzparser = NULL;
+ cfg_obj_t *nzconfig = NULL;
+ const cfg_obj_t *maps[4];
+ const cfg_obj_t *options = NULL, *voptions = NULL;
+ const cfg_obj_t *nz = NULL;
+ int i = 0;
+
+ REQUIRE (config != NULL);
+
+ if (vconfig != NULL)
+ voptions = cfg_tuple_get(vconfig, "options");
+ if (voptions != NULL)
+ maps[i++] = voptions;
+ result = cfg_map_get(config, "options", &options);
+ if (result == ISC_R_SUCCESS)
+ maps[i++] = options;
+ maps[i++] = ns_g_defaults;
+ maps[i] = NULL;
+
+ result = ns_config_get(maps, "allow-new-zones", &nz);
+ if (result == ISC_R_SUCCESS)
+ allow = cfg_obj_asboolean(nz);
+
+ if (!allow) {
+ dns_view_setnewzones(view, ISC_FALSE, NULL, NULL);
+ return (ISC_R_SUCCESS);
+ }
+
+ nzcfg = isc_mem_get(view->mctx, sizeof(*nzcfg));
+ if (nzcfg == NULL) {
+ dns_view_setnewzones(view, ISC_FALSE, NULL, NULL);
+ return (ISC_R_NOMEMORY);
+ }
+
+ dns_view_setnewzones(view, allow, nzcfg, newzone_cfgctx_destroy);
+
+ memset(nzcfg, 0, sizeof(*nzcfg));
+ isc_mem_attach(view->mctx, &nzcfg->mctx);
+ cfg_obj_attach(config, &nzcfg->config);
+ cfg_parser_attach(parser, &nzcfg->parser);
+ cfg_aclconfctx_attach(actx, &nzcfg->actx);
+
+ /*
+ * Attempt to create a parser and parse the newzones
+ * file. If successful, preserve both; otherwise leave
+ * them NULL.
+ */
+ result = cfg_parser_create(view->mctx, ns_g_lctx, &nzparser);
+ if (result == ISC_R_SUCCESS)
+ result = cfg_parse_file(nzparser, view->new_zone_file,
+ &cfg_type_newzones, &nzconfig);
+ if (result == ISC_R_SUCCESS) {
+ cfg_parser_attach(nzparser, &nzcfg->nzparser);
+ cfg_obj_attach(nzconfig, &nzcfg->nzconfig);
+ }
+
+ if (nzparser != NULL) {
+ if (nzconfig != NULL)
+ cfg_obj_destroy(nzparser, &nzconfig);
+ cfg_parser_destroy(&nzparser);
+ }
+
+ return (ISC_R_SUCCESS);
+}
+
+static int
+count_zones(const cfg_obj_t *conf) {
+ const cfg_obj_t *zonelist = NULL;
+ const cfg_listelt_t *element;
+ int n = 0;
+
+ REQUIRE(conf != NULL);
+
+ cfg_map_get(conf, "zone", &zonelist);
+ for (element = cfg_list_first(zonelist);
+ element != NULL;
+ element = cfg_list_next(element))
+ n++;
+
+ return (n);
+}
+
+static isc_result_t
load_configuration(const char *filename, ns_server_t *server,
isc_boolean_t first_time)
{
- cfg_aclconfctx_t aclconfctx;
cfg_obj_t *config = NULL, *bindkeys = NULL;
cfg_parser_t *conf_parser = NULL, *bindkeys_parser = NULL;
const cfg_listelt_t *element;
@@ -4179,8 +4311,9 @@ load_configuration(const char *filename, ns_server_t *server,
ns_cachelist_t cachelist, tmpcachelist;
unsigned int maxsocks;
ns_cache_t *nsc;
+ struct cfg_context *nzctx;
+ int num_zones = 0;
- cfg_aclconfctx_init(&aclconfctx);
ISC_LIST_INIT(viewlist);
ISC_LIST_INIT(builtin_viewlist);
ISC_LIST_INIT(cachelist);
@@ -4189,6 +4322,11 @@ load_configuration(const char *filename, ns_server_t *server,
result = isc_task_beginexclusive(server->task);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
+ /* Create the ACL configuration context */
+ if (ns_g_aclconfctx != NULL)
+ cfg_aclconfctx_detach(&ns_g_aclconfctx);
+ CHECK(cfg_aclconfctx_create(ns_g_mctx, &ns_g_aclconfctx));
+
/*
* Parse the global default pseudo-config file.
*/
@@ -4252,7 +4390,7 @@ load_configuration(const char *filename, ns_server_t *server,
if (result == ISC_R_SUCCESS)
maps[i++] = options;
maps[i++] = ns_g_defaults;
- maps[i++] = NULL;
+ maps[i] = NULL;
/*
* If bind.keys exists, load it. If "dnssec-lookaside auto"
@@ -4339,8 +4477,9 @@ load_configuration(const char *filename, ns_server_t *server,
else
isc_quota_soft(&server->recursionquota, 0);
- CHECK(configure_view_acl(NULL, config, "blackhole", NULL, &aclconfctx,
- ns_g_mctx, &server->blackholeacl));
+ CHECK(configure_view_acl(NULL, config, "blackhole", NULL,
+ ns_g_aclconfctx, ns_g_mctx,
+ &server->blackholeacl));
if (server->blackholeacl != NULL)
dns_dispatchmgr_setblackhole(ns_g_dispatchmgr,
server->blackholeacl);
@@ -4350,7 +4489,7 @@ load_configuration(const char *filename, ns_server_t *server,
INSIST(result == ISC_R_SUCCESS);
server->aclenv.match_mapped = cfg_obj_asboolean(obj);
- CHECKM(ns_statschannels_configure(ns_g_server, config, &aclconfctx),
+ CHECKM(ns_statschannels_configure(ns_g_server, config, ns_g_aclconfctx),
"configuring statistics server(s)");
/*
@@ -4478,11 +4617,10 @@ load_configuration(const char *filename, ns_server_t *server,
if (options != NULL)
(void)cfg_map_get(options, "listen-on", &clistenon);
if (clistenon != NULL) {
- result = ns_listenlist_fromconfig(clistenon,
- config,
- &aclconfctx,
- ns_g_mctx,
- &listenon);
+ /* check return code? */
+ (void)ns_listenlist_fromconfig(clistenon, config,
+ ns_g_aclconfctx,
+ ns_g_mctx, &listenon);
} else if (!ns_g_lwresdonly) {
/*
* Not specified, use default.
@@ -4506,11 +4644,10 @@ load_configuration(const char *filename, ns_server_t *server,
if (options != NULL)
(void)cfg_map_get(options, "listen-on-v6", &clistenon);
if (clistenon != NULL) {
- result = ns_listenlist_fromconfig(clistenon,
- config,
- &aclconfctx,
- ns_g_mctx,
- &listenon);
+ /* check return code? */
+ (void)ns_listenlist_fromconfig(clistenon, config,
+ ns_g_aclconfctx,
+ ns_g_mctx, &listenon);
} else if (!ns_g_lwresdonly) {
isc_boolean_t enable;
/*
@@ -4603,25 +4740,87 @@ load_configuration(const char *filename, ns_server_t *server,
*/
(void)configure_session_key(maps, server, ns_g_mctx);
- /*
- * Configure and freeze all explicit views. Explicit
- * views that have zones were already created at parsing
- * time, but views with no zones must be created here.
- */
views = NULL;
(void)cfg_map_get(config, "view", &views);
+
+ /*
+ * Create the views and count all the configured zones in
+ * order to correctly size the zone manager's task table.
+ * (We only count zones for configured views; the built-in
+ * "bind" view can be ignored as it only adds a negligible
+ * number of zones.)
+ *
+ * If we're allowing new zones, we need to be able to find the
+ * new zone file and count those as well. So we setup the new
+ * zone configuration context, but otherwise view configuration
+ * waits until after the zone manager's task list has been sized.
+ */
for (element = cfg_list_first(views);
element != NULL;
element = cfg_list_next(element))
{
cfg_obj_t *vconfig = cfg_listelt_value(element);
+ const cfg_obj_t *voptions = cfg_tuple_get(vconfig, "options");
view = NULL;
CHECK(create_view(vconfig, &viewlist, &view));
INSIST(view != NULL);
- CHECK(configure_view(view, conf_parser, config, vconfig,
- &cachelist, bindkeys,
- ns_g_mctx, &aclconfctx, ISC_TRUE));
+
+ num_zones += count_zones(voptions);
+ CHECK(setup_newzones(view, config, vconfig, conf_parser,
+ ns_g_aclconfctx));
+
+ nzctx = view->new_zone_config;
+ if (nzctx != NULL && nzctx->nzconfig != NULL)
+ num_zones += count_zones(nzctx->nzconfig);
+
+ dns_view_detach(&view);
+ }
+
+ /*
+ * If there were no explicit views then we do the default
+ * view here.
+ */
+ if (views == NULL) {
+ CHECK(create_view(NULL, &viewlist, &view));
+ INSIST(view != NULL);
+
+ num_zones = count_zones(config);
+
+ CHECK(setup_newzones(view, config, NULL, conf_parser,
+ ns_g_aclconfctx));
+
+ nzctx = view->new_zone_config;
+ if (nzctx != NULL && nzctx->nzconfig != NULL)
+ num_zones += count_zones(nzctx->nzconfig);
+
+ dns_view_detach(&view);
+ }
+
+ /*
+ * Zones have been counted; set the zone manager task pool size.
+ */
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+ NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+ "sizing zone task pool based on %d zones", num_zones);
+ CHECK(dns_zonemgr_setsize(ns_g_server->zonemgr, num_zones));
+
+ /*
+ * Configure and freeze all explicit views. Explicit
+ * views that have zones were already created at parsing
+ * time, but views with no zones must be created here.
+ */
+ for (element = cfg_list_first(views);
+ element != NULL;
+ element = cfg_list_next(element))
+ {
+ cfg_obj_t *vconfig = cfg_listelt_value(element);
+
+ view = NULL;
+ CHECK(find_view(vconfig, &viewlist, &view));
+ CHECK(configure_view(view, config, vconfig,
+ &cachelist, bindkeys, ns_g_mctx,
+ ns_g_aclconfctx, ISC_TRUE));
dns_view_freeze(view);
dns_view_detach(&view);
}
@@ -4631,16 +4830,11 @@ load_configuration(const char *filename, ns_server_t *server,
* were no explicit views.
*/
if (views == NULL) {
- /*
- * No explicit views; there ought to be a default view.
- * There may already be one created as a side effect
- * of zone statements, or we may have to create one.
- * In either case, we need to configure and freeze it.
- */
- CHECK(create_view(NULL, &viewlist, &view));
- CHECK(configure_view(view, conf_parser, config, NULL,
+ view = NULL;
+ CHECK(find_view(NULL, &viewlist, &view));
+ CHECK(configure_view(view, config, NULL,
&cachelist, bindkeys,
- ns_g_mctx, &aclconfctx, ISC_TRUE));
+ ns_g_mctx, ns_g_aclconfctx, ISC_TRUE));
dns_view_freeze(view);
dns_view_detach(&view);
}
@@ -4658,9 +4852,9 @@ load_configuration(const char *filename, ns_server_t *server,
cfg_obj_t *vconfig = cfg_listelt_value(element);
CHECK(create_view(vconfig, &builtin_viewlist, &view));
- CHECK(configure_view(view, conf_parser, config, vconfig,
+ CHECK(configure_view(view, config, vconfig,
&cachelist, bindkeys,
- ns_g_mctx, &aclconfctx, ISC_FALSE));
+ ns_g_mctx, ns_g_aclconfctx, ISC_FALSE));
dns_view_freeze(view);
dns_view_detach(&view);
view = NULL;
@@ -4701,7 +4895,7 @@ load_configuration(const char *filename, ns_server_t *server,
* Bind the control port(s).
*/
CHECKM(ns_controls_configure(ns_g_server->controls, config,
- &aclconfctx),
+ ns_g_aclconfctx),
"binding control channel(s)");
/*
@@ -4945,8 +5139,6 @@ load_configuration(const char *filename, ns_server_t *server,
if (v6portset != NULL)
isc_portset_destroy(ns_g_mctx, &v6portset);
- cfg_aclconfctx_clear(&aclconfctx);
-
if (conf_parser != NULL) {
if (config != NULL)
cfg_obj_destroy(conf_parser, &config);
@@ -5021,6 +5213,8 @@ load_zones(ns_server_t *server, isc_boolean_t stop) {
CHECK(dns_view_load(view, stop));
if (view->managed_keys != NULL)
CHECK(dns_zone_load(view->managed_keys));
+ if (view->redirect != NULL)
+ CHECK(dns_zone_load(view->redirect));
}
/*
@@ -5054,6 +5248,8 @@ load_new_zones(ns_server_t *server, isc_boolean_t stop) {
/* Load managed-keys data */
if (view->managed_keys != NULL)
CHECK(dns_zone_loadnew(view->managed_keys));
+ if (view->redirect != NULL)
+ CHECK(dns_zone_loadnew(view->redirect));
}
/*
@@ -5153,6 +5349,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
end_reserved_dispatches(server, ISC_TRUE);
cleanup_session_key(server, server->mctx);
+ if (ns_g_aclconfctx != NULL)
+ cfg_aclconfctx_detach(&ns_g_aclconfctx);
+
cfg_obj_destroy(ns_g_parser, &ns_g_config);
cfg_parser_destroy(&ns_g_parser);
@@ -5204,8 +5403,8 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
void
ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
isc_result_t result;
-
ns_server_t *server = isc_mem_get(mctx, sizeof(*server));
+
if (server == NULL)
fatal("allocating server object", ISC_R_NOMEMORY);
@@ -5278,6 +5477,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
CHECKFATAL(dns_zonemgr_create(ns_g_mctx, ns_g_taskmgr, ns_g_timermgr,
ns_g_socketmgr, &server->zonemgr),
"dns_zonemgr_create");
+ CHECKFATAL(dns_zonemgr_setsize(server->zonemgr, 1000),
+ "dns_zonemgr_setsize");
server->statsfile = isc_mem_strdup(server->mctx, "named.stats");
CHECKFATAL(server->statsfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
@@ -5387,7 +5588,8 @@ ns_server_destroy(ns_server_t **serverp) {
if (server->server_id != NULL)
isc_mem_free(server->mctx, server->server_id);
- dns_zonemgr_detach(&server->zonemgr);
+ if (server->zonemgr != NULL)
+ dns_zonemgr_detach(&server->zonemgr);
if (server->tkeyctx != NULL)
dns_tkeyctx_destroy(&server->tkeyctx);
@@ -5951,7 +6153,6 @@ ns_server_dumpstats(ns_server_t *server) {
"could not open statistics dump file", server->statsfile);
result = ns_stats_dump(server, fp);
- CHECK(result);
cleanup:
if (fp != NULL)
@@ -6139,6 +6340,7 @@ dumpdone(void *arg, isc_result_t result) {
fprintf(dctx->fp, "; %s\n",
dns_result_totext(result));
result = ISC_R_SUCCESS;
+ POST(result);
goto nextzone;
}
if (result != ISC_R_SUCCESS)
@@ -6264,28 +6466,29 @@ ns_server_dumpsecroots(ns_server_t *server, char *args) {
isc_time_formattimestamp(&now, tbuf, sizeof(tbuf));
fprintf(fp, "%s\n", tbuf);
- nextview:
- for (view = ISC_LIST_HEAD(server->viewlist);
- view != NULL;
- view = ISC_LIST_NEXT(view, link))
- {
- if (ptr != NULL && strcmp(view->name, ptr) != 0)
- continue;
- if (secroots != NULL)
- dns_keytable_detach(&secroots);
- result = dns_view_getsecroots(view, &secroots);
- if (result == ISC_R_NOTFOUND) {
- result = ISC_R_SUCCESS;
- continue;
+ do {
+ for (view = ISC_LIST_HEAD(server->viewlist);
+ view != NULL;
+ view = ISC_LIST_NEXT(view, link))
+ {
+ if (ptr != NULL && strcmp(view->name, ptr) != 0)
+ continue;
+ if (secroots != NULL)
+ dns_keytable_detach(&secroots);
+ result = dns_view_getsecroots(view, &secroots);
+ if (result == ISC_R_NOTFOUND) {
+ result = ISC_R_SUCCESS;
+ continue;
+ }
+ fprintf(fp, "\n Start view %s\n\n", view->name);
+ result = dns_keytable_dump(secroots, fp);
+ if (result != ISC_R_SUCCESS)
+ fprintf(fp, " dumpsecroots failed: %s\n",
+ isc_result_totext(result));
}
- fprintf(fp, "\n Start view %s\n\n", view->name);
- CHECK(dns_keytable_dump(secroots, fp));
- }
- if (ptr != NULL) {
- ptr = next_token(&args, " \t");
if (ptr != NULL)
- goto nextview;
- }
+ ptr = next_token(&args, " \t");
+ } while (ptr != NULL);
cleanup:
if (secroots != NULL)
@@ -6552,7 +6755,7 @@ ns_server_flushcache(ns_server_t *server, char *args) {
}
isc_result_t
-ns_server_flushname(ns_server_t *server, char *args) {
+ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree) {
char *ptr, *target, *viewname;
dns_view_t *view;
isc_boolean_t flushed;
@@ -6599,13 +6802,15 @@ ns_server_flushname(ns_server_t *server, char *args) {
* if some of the views share a single cache. But since the
* operation is lightweight we prefer simplicity here.
*/
- result = dns_view_flushname(view, name);
+ result = dns_view_flushnode(view, name, tree);
if (result != ISC_R_SUCCESS) {
flushed = ISC_FALSE;
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
- "flushing name '%s' in cache view '%s' "
- "failed: %s", target, view->name,
+ "flushing %s '%s' in cache view '%s' "
+ "failed: %s",
+ tree ? "tree" : "name",
+ target, view->name,
isc_result_totext(result));
}
}
@@ -6613,21 +6818,26 @@ ns_server_flushname(ns_server_t *server, char *args) {
if (viewname != NULL)
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
NS_LOGMODULE_SERVER, ISC_LOG_INFO,
- "flushing name '%s' in cache view '%s' "
- "succeeded", target, viewname);
+ "flushing %s '%s' in cache view '%s' "
+ "succeeded",
+ tree ? "tree" : "name",
+ target, viewname);
else
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
NS_LOGMODULE_SERVER, ISC_LOG_INFO,
- "flushing name '%s' in all cache views "
- "succeeded", target);
+ "flushing %s '%s' in all cache views "
+ "succeeded",
+ tree ? "tree" : "name",
+ target);
result = ISC_R_SUCCESS;
} else {
if (!found)
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
- "flushing name '%s' in cache view '%s' "
- "failed: view not found", target,
- viewname);
+ "flushing %s '%s' in cache view '%s' "
+ "failed: view not found",
+ tree ? "tree" : "name",
+ target, viewname);
result = ISC_R_FAILURE;
}
isc_task_endexclusive(server->task);
@@ -6953,6 +7163,106 @@ ns_server_rekey(ns_server_t *server, char *args) {
}
/*
+ * Act on a "sync" command from the command channel.
+*/
+static isc_result_t
+synczone(dns_zone_t *zone, void *uap) {
+ isc_boolean_t cleanup = *(isc_boolean_t *)uap;
+ isc_result_t result;
+ char *journal;
+
+ result = dns_zone_flush(zone);
+ if (result != ISC_R_SUCCESS)
+ cleanup = ISC_FALSE;
+ if (cleanup) {
+ journal = dns_zone_getjournal(zone);
+ if (journal != NULL)
+ (void)isc_file_remove(journal);
+ }
+ return (result);
+}
+
+isc_result_t
+ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) {
+ isc_result_t result, tresult;
+ dns_view_t *view;
+ dns_zone_t *zone = NULL;
+ char classstr[DNS_RDATACLASS_FORMATSIZE];
+ char zonename[DNS_NAME_FORMATSIZE];
+ const char *vname, *sep, *msg = NULL;
+ isc_boolean_t cleanup = ISC_FALSE;
+ char arg[8];
+ int n;
+
+ /* Did the user specify -clean? */
+ n = sscanf(args, "%*s %7s", arg);
+ if (n > 0 && strcmp(arg, "-clean") == 0) {
+ cleanup = ISC_TRUE;
+
+ /* shift so that zone_from_args() won't be confused */
+ (void) next_token(&args, " \t");
+ }
+
+ result = zone_from_args(server, args, &zone, NULL);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
+ if (zone == NULL) {
+ result = isc_task_beginexclusive(server->task);
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
+ tresult = ISC_R_SUCCESS;
+ for (view = ISC_LIST_HEAD(server->viewlist);
+ view != NULL;
+ view = ISC_LIST_NEXT(view, link)) {
+ result = dns_zt_apply(view->zonetable, ISC_FALSE,
+ synczone, &cleanup);
+ if (result != ISC_R_SUCCESS &&
+ tresult == ISC_R_SUCCESS)
+ tresult = result;
+ }
+ isc_task_endexclusive(server->task);
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+ NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+ "dumping all zones%s: %s",
+ cleanup ? ", removing journal files" : "",
+ isc_result_totext(result));
+ return (tresult);
+ }
+
+ result = isc_task_beginexclusive(server->task);
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
+ result = synczone(zone, &cleanup);
+ isc_task_endexclusive(server->task);
+
+ if (msg != NULL && strlen(msg) < isc_buffer_availablelength(text))
+ isc_buffer_putmem(text, (const unsigned char *)msg,
+ strlen(msg) + 1);
+
+ view = dns_zone_getview(zone);
+ if (strcmp(view->name, "_default") == 0 ||
+ strcmp(view->name, "_bind") == 0)
+ {
+ vname = "";
+ sep = "";
+ } else {
+ vname = view->name;
+ sep = " ";
+ }
+ dns_rdataclass_format(dns_zone_getclass(zone), classstr,
+ sizeof(classstr));
+ dns_name_format(dns_zone_getorigin(zone),
+ zonename, sizeof(zonename));
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+ NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+ "sync: dumping zone '%s/%s'%s%s%s: %s",
+ zonename, classstr, sep, vname,
+ cleanup ? ", removing journal file" : "",
+ isc_result_totext(result));
+ dns_zone_detach(&zone);
+ return (result);
+}
+
+/*
* Act on a "freeze" or "thaw" command from the command channel.
*/
isc_result_t
@@ -6965,7 +7275,6 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
char classstr[DNS_RDATACLASS_FORMATSIZE];
char zonename[DNS_NAME_FORMATSIZE];
dns_view_t *view;
- char *journal;
const char *vname, *sep;
isc_boolean_t frozen;
const char *msg = NULL;
@@ -6999,6 +7308,11 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
return (DNS_R_NOTMASTER);
}
+ if (freeze && !dns_zone_isdynamic(zone, ISC_TRUE)) {
+ dns_zone_detach(&zone);
+ return (DNS_R_NOTDYNAMIC);
+ }
+
result = isc_task_beginexclusive(server->task);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
frozen = dns_zone_getupdatedisabled(zone);
@@ -7015,11 +7329,6 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
msg = "Flushing the zone updates to "
"disk failed.";
}
- if (result == ISC_R_SUCCESS) {
- journal = dns_zone_getjournal(zone);
- if (journal != NULL)
- (void)isc_file_remove(journal);
- }
if (result == ISC_R_SUCCESS)
dns_zone_setupdatedisabled(zone, freeze);
} else {
@@ -7192,7 +7501,7 @@ ns_server_add_zone(ns_server_t *server, char *args) {
/* Mark view unfrozen so that zone can be added */
dns_view_thaw(view);
result = configure_zone(cfg->config, parms, vconfig,
- server->mctx, view, &cfg->actx, ISC_FALSE);
+ server->mctx, view, cfg->actx, ISC_FALSE);
dns_view_freeze(view);
if (result != ISC_R_SUCCESS) {
goto cleanup;
@@ -7441,23 +7750,27 @@ ns_server_del_zone(ns_server_t *server, char *args) {
}
static void
-cfgctx_destroy(void **cfgp) {
+newzone_cfgctx_destroy(void **cfgp) {
struct cfg_context *cfg;
- isc_mem_t *mctx;
REQUIRE(cfgp != NULL && *cfgp != NULL);
+
cfg = *cfgp;
- mctx = cfg->mctx;
- cfg->mctx = NULL;
+
+ if (cfg->actx != NULL)
+ cfg_aclconfctx_detach(&cfg->actx);
if (cfg->parser != NULL) {
if (cfg->config != NULL)
cfg_obj_destroy(cfg->parser, &cfg->config);
cfg_parser_destroy(&cfg->parser);
}
- cfg_aclconfctx_clear(&cfg->actx);
+ if (cfg->nzparser != NULL) {
+ if (cfg->nzconfig != NULL)
+ cfg_obj_destroy(cfg->nzparser, &cfg->nzconfig);
+ cfg_parser_destroy(&cfg->nzparser);
+ }
- isc_mem_put(mctx, cfg, sizeof(*cfg));
- isc_mem_detach(&mctx);
+ isc_mem_putanddetach(&cfg->mctx, cfg, sizeof(*cfg));
*cfgp = NULL;
}
diff --git a/external/bsd/bind/dist/bin/named/statschannel.c b/external/bsd/bind/dist/bin/named/statschannel.c
index 29f0260b2da..a287551dcfd 100644
--- a/external/bsd/bind/dist/bin/named/statschannel.c
+++ b/external/bsd/bind/dist/bin/named/statschannel.c
@@ -1,7 +1,7 @@
-/* $NetBSD: statschannel.c,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: statschannel.c,v 1.3 2011/09/11 18:55:28 christos Exp $ */
/*
- * Copyright (C) 2008-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: statschannel.c,v 1.26 2010-02-04 23:49:13 tbox Exp */
+/* Id: statschannel.c,v 1.28 2011-03-12 04:59:46 tbox Exp */
/*! \file */
@@ -640,7 +640,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
static void
opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
- FILE *fp = arg;
+ FILE *fp;
isc_buffer_t b;
char codebuf[64];
stats_dumparg_t *dumparg = arg;
diff --git a/external/bsd/bind/dist/bin/named/unix/os.c b/external/bsd/bind/dist/bin/named/unix/os.c
index dcf3067781b..7548547f592 100644
--- a/external/bsd/bind/dist/bin/named/unix/os.c
+++ b/external/bsd/bind/dist/bin/named/unix/os.c
@@ -1,7 +1,7 @@
-/* $NetBSD: os.c,v 1.2 2011/02/16 03:46:47 christos Exp $ */
+/* $NetBSD: os.c,v 1.3 2011/09/11 18:55:29 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: os.c,v 1.104 2010-11-17 23:47:08 tbox Exp */
+/* Id: os.c,v 1.107 2011-03-02 00:02:54 marka Exp */
/*! \file */
@@ -792,6 +792,9 @@ ns_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user) {
free(f);
if (switch_user && runas_pw != NULL) {
+#ifndef HAVE_LINUXTHREADS
+ gid_t oldgid = getgid();
+#endif
/* Set UID/GID to the one we'll be running with eventually */
setperms(runas_pw->pw_uid, runas_pw->pw_gid);
@@ -799,7 +802,7 @@ ns_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user) {
#ifndef HAVE_LINUXTHREADS
/* Restore UID/GID to root */
- setperms(0, 0);
+ setperms(0, oldgid);
#endif /* HAVE_LINUXTHREADS */
if (fd == -1) {
@@ -952,7 +955,7 @@ ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
isc_buffer_availablelength(text),
"pid: %ld", (long)pid);
/* Only send a message if it is complete. */
- if (n < isc_buffer_availablelength(text))
+ if (n > 0 && n < isc_buffer_availablelength(text))
isc_buffer_add(text, n);
}
diff --git a/external/bsd/bind/dist/bin/named/update.c b/external/bsd/bind/dist/bin/named/update.c
index cf6cb401628..d4148b7e666 100644
--- a/external/bsd/bind/dist/bin/named/update.c
+++ b/external/bsd/bind/dist/bin/named/update.c
@@ -1,4 +1,4 @@
-/* $NetBSD: update.c,v 1.3 2011/07/05 21:59:18 spz Exp $ */
+/* $NetBSD: update.c,v 1.4 2011/09/11 18:55:28 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: update.c,v 1.186.16.1.2.1 2011-06-02 23:47:28 tbox Exp */
+/* Id: update.c,v 1.195 2011-07-01 02:25:47 marka Exp */
#include <config.h>
@@ -49,6 +49,7 @@
#include <dns/soa.h>
#include <dns/ssu.h>
#include <dns/tsig.h>
+#include <dns/update.h>
#include <dns/view.h>
#include <dns/zone.h>
#include <dns/zt.h>
@@ -1427,8 +1428,8 @@ get_current_rr(dns_message_t *msg, dns_section_t section,
*/
static isc_result_t
-increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver,
- dns_diff_t *diff, isc_mem_t *mctx)
+update_soa_serial(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,
+ isc_mem_t *mctx, dns_updatemethod_t method)
{
dns_difftuple_t *deltuple = NULL;
dns_difftuple_t *addtuple = NULL;
@@ -1440,12 +1441,7 @@ increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver,
addtuple->op = DNS_DIFFOP_ADD;
serial = dns_soa_getserial(&addtuple->rdata);
-
- /* RFC1982 */
- serial = (serial + 1) & 0xFFFFFFFF;
- if (serial == 0)
- serial = 1;
-
+ serial = dns_update_soaserial(serial, method);
dns_soa_setserial(serial, &addtuple->rdata);
CHECK(do_one_tuple(&deltuple, db, ver, diff));
CHECK(do_one_tuple(&addtuple, db, ver, diff));
@@ -1694,7 +1690,7 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
{
isc_result_t result;
dns_dbiterator_t *dbit = NULL;
- isc_boolean_t has_nsec;
+ isc_boolean_t has_nsec = ISC_FALSE;
unsigned int wraps = 0;
isc_boolean_t secure = dns_db_issecure(db);
@@ -2397,7 +2393,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
name, diff));
}
CHECK(add_exposed_sigs(client, zone, db, newver, name,
- cut, diff, zone_keys, nkeys,
+ cut, &sig_diff, zone_keys, nkeys,
inception, expire, check_ksk,
keyset_kskonly));
}
@@ -2556,7 +2552,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
privatetype, &nsec_diff));
} else {
CHECK(add_exposed_sigs(client, zone, db, newver, name,
- cut, diff, zone_keys, nkeys,
+ cut, &sig_diff, zone_keys, nkeys,
inception, expire, check_ksk,
keyset_kskonly));
CHECK(dns_nsec3_addnsec3sx(db, newver, name, nsecttl,
@@ -3070,8 +3066,19 @@ check_dnssec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
}
/* Check existing DB for NSEC-only DNSKEY */
- if (!nseconly)
- CHECK(dns_nsec_nseconly(db, ver, &nseconly));
+ if (!nseconly) {
+ result = dns_nsec_nseconly(db, ver, &nseconly);
+
+ /*
+ * An NSEC3PARAM update can proceed without a DNSKEY (it
+ * will trigger a delayed change), so we can ignore
+ * ISC_R_NOTFOUND here.
+ */
+ if (result == ISC_R_NOTFOUND)
+ result = ISC_R_SUCCESS;
+
+ CHECK(result);
+ }
/* Check existing DB for NSEC3 */
if (!nsec3)
@@ -3242,9 +3249,11 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
ttl_good = ISC_TRUE;
}
if (tuple->op == DNS_DIFFOP_ADD) {
+ isc_boolean_t nseconly = ISC_FALSE;
+
/*
* Look for any deletes which match this ADD ignoring
- * OPTOUT. We don't need to explictly remove them as
+ * flags. We don't need to explictly remove them as
* they will be removed a side effect of processing
* the add.
*/
@@ -3266,12 +3275,28 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
ISC_LIST_APPEND(diff->tuples, next, link);
next = ISC_LIST_HEAD(temp_diff.tuples);
}
+
/*
- * See if we already have a CREATE request in progress.
+ * Create a private-type record to signal that
+ * we want a delayed NSEC3 chain add/delete
*/
dns_nsec3param_toprivate(&tuple->rdata, &rdata,
privatetype, buf, sizeof(buf));
buf[2] |= DNS_NSEC3FLAG_CREATE;
+
+ /*
+ * If the zone is not currently capable of
+ * supporting an NSEC3 chain, then we set the
+ * INITIAL flag to indicate that these parameters
+ * are to be used later.
+ */
+ result = dns_nsec_nseconly(db, ver, &nseconly);
+ if (result == ISC_R_NOTFOUND || nseconly)
+ buf[2] |= DNS_NSEC3FLAG_INITIAL;
+
+ /*
+ * See if this CREATE request already exists.
+ */
CHECK(rr_exists(db, ver, name, &rdata, &flag));
if (!flag) {
@@ -3383,7 +3408,7 @@ rollback_private(dns_db_t *db, dns_rdatatype_t privatetype,
/*
* Allow records which indicate that a zone has been
- * signed with a DNSKEY to be be removed.
+ * signed with a DNSKEY to be removed.
*/
if (tuple->op == DNS_DIFFOP_DEL &&
tuple->rdata.length == 5 &&
@@ -3736,7 +3761,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
* Check Requestor's Permissions. It seems a bit silly to do this
* only after prerequisite testing, but that is what RFC2136 says.
*/
- result = ISC_R_SUCCESS;
if (ssutable == NULL)
CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
"update", zonename, ISC_FALSE, ISC_FALSE));
@@ -4161,7 +4185,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
* changed as a result of an update operation.
*/
if (! soa_serial_changed) {
- CHECK(increment_soa_serial(db, ver, &diff, mctx));
+ CHECK(update_soa_serial(db, ver, &diff, mctx,
+ dns_zone_getserialupdatemethod(zone)));
}
CHECK(check_mx(client, zone, db, ver, &diff));
@@ -4195,7 +4220,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
CHECK(add_nsec3param_records(client, zone, db, ver, &diff));
- if (!has_dnskey) {
+ if (had_dnskey && !has_dnskey) {
/*
* We are transitioning from secure to insecure.
* Cause all NSEC3 chains to be deleted. When the
diff --git a/external/bsd/bind/dist/bin/named/xfrout.c b/external/bsd/bind/dist/bin/named/xfrout.c
index 2376bc44753..dc0113f550b 100644
--- a/external/bsd/bind/dist/bin/named/xfrout.c
+++ b/external/bsd/bind/dist/bin/named/xfrout.c
@@ -1,7 +1,7 @@
-/* $NetBSD: xfrout.c,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: xfrout.c,v 1.3 2011/09/11 18:55:28 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: xfrout.c,v 1.139 2010-12-18 01:56:19 each Exp */
+/* Id: xfrout.c,v 1.142 2011-07-28 04:27:26 marka Exp */
#include <config.h>
@@ -30,9 +30,7 @@
#include <dns/db.h>
#include <dns/dbiterator.h>
-#ifdef DLZ
#include <dns/dlz.h>
-#endif
#include <dns/fixedname.h>
#include <dns/journal.h>
#include <dns/message.h>
@@ -754,9 +752,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
char msg[NS_CLIENT_ACLMSGSIZE("zone transfer")];
char keyname[DNS_NAME_FORMATSIZE];
isc_boolean_t is_poll = ISC_FALSE;
-#ifdef DLZ
isc_boolean_t is_dlz = ISC_FALSE;
-#endif
switch (reqtype) {
case dns_rdatatype_axfr:
@@ -808,9 +804,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
result = dns_zt_find(client->view->zonetable, question_name, 0, NULL,
&zone);
- if (result != ISC_R_SUCCESS)
-#ifdef DLZ
- {
+ if (result != ISC_R_SUCCESS) {
/*
* Normal zone table does not have a match.
* Try the DLZ database
@@ -838,10 +832,8 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
goto failure;
}
if (result != ISC_R_SUCCESS)
-#endif
- FAILQ(DNS_R_NOTAUTH, "non-authoritative zone",
- question_name, question_class);
-#ifdef DLZ
+ FAILQ(DNS_R_NOTAUTH, "non-authoritative zone",
+ question_name, question_class);
is_dlz = ISC_TRUE;
/*
* DLZ only support full zone transfer, not incremental
@@ -861,7 +853,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
}
} else {
/* zone table has a match */
-#endif
switch(dns_zone_gettype(zone)) {
case dns_zone_master:
case dns_zone_slave:
@@ -872,9 +863,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
}
CHECK(dns_zone_getdb(zone, &db));
dns_db_currentversion(db, &ver);
-#ifdef DLZ
}
-#endif
xfrout_log1(client, question_name, question_class, ISC_LOG_DEBUG(6),
"%s question section OK", mnemonic);
@@ -928,22 +917,15 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
"%s authority section OK", mnemonic);
/*
- * Decide whether to allow this transfer.
- */
-#ifdef DLZ
- /*
- * if not a DLZ zone decide whether to allow this transfer.
+ * If not a DLZ zone, decide whether to allow this transfer.
*/
if (!is_dlz) {
-#endif
ns_client_aclmsg("zone transfer", question_name, reqtype,
client->view->rdclass, msg, sizeof(msg));
CHECK(ns_client_checkacl(client, NULL, msg,
dns_zone_getxfracl(zone),
ISC_TRUE, ISC_LOG_ERROR));
-#ifdef DLZ
}
-#endif
/*
* AXFR over UDP is not possible.
@@ -967,10 +949,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
/*
* Get a dynamically allocated copy of the current SOA.
*/
-#ifdef DLZ
if (is_dlz)
dns_db_currentversion(db, &ver);
-#endif
+
CHECK(dns_db_createsoatuple(db, ver, mctx, DNS_DIFFOP_EXISTS,
&current_soa_tuple));
@@ -1056,7 +1037,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
-#ifdef DLZ
if (is_dlz)
CHECK(xfrout_ctx_create(mctx, client, request->id,
question_name, reqtype, question_class,
@@ -1069,7 +1049,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
ISC_TRUE : ISC_FALSE,
&xfr));
else
-#endif
CHECK(xfrout_ctx_create(mctx, client, request->id,
question_name, reqtype, question_class,
zone, db, ver, quota, stream,
@@ -1087,9 +1066,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
CHECK(xfr->stream->methods->first(xfr->stream));
- if (xfr->tsigkey != NULL) {
+ if (xfr->tsigkey != NULL)
dns_name_format(&xfr->tsigkey->name, keyname, sizeof(keyname));
- } else
+ else
keyname[0] = '\0';
if (is_poll)
xfrout_log1(client, question_name, question_class,
@@ -1159,7 +1138,8 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
xfr = isc_mem_get(mctx, sizeof(*xfr));
if (xfr == NULL)
return (ISC_R_NOMEMORY);
- xfr->mctx = mctx;
+ xfr->mctx = NULL;
+ isc_mem_attach(mctx, &xfr->mctx);
xfr->client = NULL;
ns_client_attach(client, &xfr->client);
xfr->id = id;
@@ -1533,6 +1513,7 @@ sendstream(xfrout_ctx_t *xfr) {
static void
xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
xfrout_ctx_t *xfr = *xfrp;
+ ns_client_t *client = NULL;
INSIST(xfr->sends == 0);
@@ -1556,9 +1537,14 @@ xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
if (xfr->db != NULL)
dns_db_detach(&xfr->db);
+ /*
+ * We want to detch the client after we have released the memory
+ * context as ns_client_detach checks the memory reference count.
+ */
+ ns_client_attach(xfr->client, &client);
ns_client_detach(&xfr->client);
-
- isc_mem_put(xfr->mctx, xfr, sizeof(*xfr));
+ isc_mem_putanddetach(&xfr->mctx, xfr, sizeof(*xfr));
+ ns_client_detach(&client);
*xfrp = NULL;
}
diff --git a/external/bsd/bind/dist/bin/named/zoneconf.c b/external/bsd/bind/dist/bin/named/zoneconf.c
index 98cc9da08bc..d050728d6d6 100644
--- a/external/bsd/bind/dist/bin/named/zoneconf.c
+++ b/external/bsd/bind/dist/bin/named/zoneconf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: zoneconf.c,v 1.2 2011/02/16 03:46:46 christos Exp $ */
+/* $NetBSD: zoneconf.c,v 1.3 2011/09/11 18:55:28 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: zoneconf.c,v 1.170 2011-01-06 23:47:00 tbox Exp */
+/* Id: zoneconf.c,v 1.178 2011-07-01 02:25:47 marka Exp */
/*% */
@@ -129,7 +129,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
/* First check to see if ACL is defined within the zone */
if (zconfig != NULL) {
maps[0] = cfg_tuple_get(zconfig, "options");
- ns_config_get(maps, aclname, &aclobj);
+ (void)ns_config_get(maps, aclname, &aclobj);
if (aclobj != NULL) {
aclp = NULL;
goto parse_acl;
@@ -157,7 +157,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
maps[i++] = ns_g_defaults;
maps[i] = NULL;
- result = ns_config_get(maps, aclname, &aclobj);
+ (void)ns_config_get(maps, aclname, &aclobj);
if (aclobj == NULL) {
(*clearzacl)(zone);
return (ISC_R_SUCCESS);
@@ -607,7 +607,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
/* Prepare zone RRs from the configuration */
obj = NULL;
result = cfg_map_get(zconfig, "server-addresses", &obj);
- if (obj != NULL) {
+ if (result == ISC_R_SUCCESS) {
+ INSIST(obj != NULL);
result = configure_staticstub_serveraddrs(obj, zone,
&rdatalist_ns,
&rdatalist_a,
@@ -618,7 +619,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
obj = NULL;
result = cfg_map_get(zconfig, "server-names", &obj);
- if (obj != NULL) {
+ if (result == ISC_R_SUCCESS) {
+ INSIST(obj != NULL);
result = configure_staticstub_servernames(obj, zone,
&rdatalist_ns,
zname);
@@ -716,7 +718,7 @@ zonetype_fromconfig(const cfg_obj_t *map) {
isc_result_t result;
result = cfg_map_get(map, "type", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
return (ns_config_getzonetype(obj));
}
@@ -780,7 +782,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
INSIST(0);
}
result = ns_checknames_get(maps, zone, objp);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
}
isc_result_t
@@ -834,7 +836,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
maps[i++] = options;
}
maps[i++] = ns_g_defaults;
- maps[i++] = NULL;
+ maps[i] = NULL;
if (vconfig != NULL)
RETERR(ns_config_getclass(cfg_tuple_get(vconfig, "class"),
@@ -936,7 +938,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "dialup", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (cfg_obj_isboolean(obj)) {
if (cfg_obj_asboolean(obj))
dialup = dns_dialuptype_yes;
@@ -959,7 +961,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "zone-statistics", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
zonestats_on = cfg_obj_asboolean(obj);
zoneqrystats = NULL;
if (zonestats_on) {
@@ -975,10 +977,11 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
* to primary masters (type "master") and slaves
* acting as masters (type "slave"), but not to stubs.
*/
- if (ztype != dns_zone_stub && ztype != dns_zone_staticstub) {
+ if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
+ ztype != dns_zone_redirect) {
obj = NULL;
result = ns_config_get(maps, "notify", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (cfg_obj_isboolean(obj)) {
if (cfg_obj_asboolean(obj))
notifytype = dns_notifytype_yes;
@@ -998,35 +1001,36 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "also-notify", &obj);
if (result == ISC_R_SUCCESS) {
- isc_sockaddr_t *addrs = NULL;
isc_uint32_t addrcount;
- result = ns_config_getiplist(config, obj, 0, mctx,
- &addrs, &addrcount);
- if (result != ISC_R_SUCCESS)
- return (result);
- result = dns_zone_setalsonotify(zone, addrs,
- addrcount);
- ns_config_putiplist(mctx, &addrs, addrcount);
- if (result != ISC_R_SUCCESS)
- return (result);
+ addrs = NULL;
+ keynames = NULL;
+ RETERR(ns_config_getipandkeylist(config, obj, mctx,
+ &addrs, &keynames,
+ &addrcount));
+ result = dns_zone_setalsonotifywithkeys(zone, addrs,
+ keynames,
+ addrcount);
+ ns_config_putipandkeylist(mctx, &addrs, &keynames,
+ addrcount);
+ RETERR(result);
} else
RETERR(dns_zone_setalsonotify(zone, NULL, 0));
obj = NULL;
result = ns_config_get(maps, "notify-source", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
obj = NULL;
result = ns_config_get(maps, "notify-source-v6", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
obj = NULL;
result = ns_config_get(maps, "notify-to-soa", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
cfg_obj_asboolean(obj));
@@ -1039,17 +1043,17 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "max-transfer-time-out", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);
obj = NULL;
result = ns_config_get(maps, "max-transfer-idle-out", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);
obj = NULL;
- result = ns_config_get(maps, "max-journal-size", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ result = ns_config_get(maps, "max-journal-size", &obj);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setjournalsize(zone, -1);
if (cfg_obj_isstring(obj)) {
const char *str = cfg_obj_asstring(obj);
@@ -1073,13 +1077,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "ixfr-from-differences", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (cfg_obj_isboolean(obj))
ixfrdiff = cfg_obj_asboolean(obj);
- else if (strcasecmp(cfg_obj_asstring(obj), "master") &&
+ else if (!strcasecmp(cfg_obj_asstring(obj), "master") &&
ztype == dns_zone_master)
ixfrdiff = ISC_TRUE;
- else if (strcasecmp(cfg_obj_asstring(obj), "slave") &&
+ else if (!strcasecmp(cfg_obj_asstring(obj), "slave") &&
ztype == dns_zone_slave)
ixfrdiff = ISC_TRUE;
else
@@ -1102,25 +1106,51 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "notify-delay", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setnotifydelay(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "check-sibling", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
cfg_obj_asboolean(obj));
obj = NULL;
result = ns_config_get(maps, "zero-no-soa-ttl", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj));
obj = NULL;
result = ns_config_get(maps, "nsec3-test-zone", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
cfg_obj_asboolean(obj));
+ } else if (ztype == dns_zone_redirect) {
+ dns_zone_setnotifytype(zone, dns_notifytype_no);
+
+ obj = NULL;
+ result = ns_config_get(maps, "max-journal-size", &obj);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
+ dns_zone_setjournalsize(zone, -1);
+ if (cfg_obj_isstring(obj)) {
+ const char *str = cfg_obj_asstring(obj);
+ INSIST(strcasecmp(str, "unlimited") == 0);
+ journal_size = ISC_UINT32_MAX / 2;
+ } else {
+ isc_resourcevalue_t value;
+ value = cfg_obj_asuint64(obj);
+ if (value > ISC_UINT32_MAX / 2) {
+ cfg_obj_log(obj, ns_g_lctx,
+ ISC_LOG_ERROR,
+ "'max-journal-size "
+ "%" ISC_PRINT_QUADFORMAT "d' "
+ "is too large",
+ value);
+ RETERR(ISC_R_RANGE);
+ }
+ journal_size = (isc_uint32_t)value;
+ }
+ dns_zone_setjournalsize(zone, journal_size);
}
/*
@@ -1147,7 +1177,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "sig-validity-interval", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
{
const cfg_obj_t *validity, *resign;
@@ -1178,30 +1208,36 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "sig-signing-signatures", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setsignatures(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "sig-signing-nodes", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setnodes(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "sig-signing-type", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "update-check-ksk", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
cfg_obj_asboolean(obj));
obj = NULL;
result = ns_config_get(maps, "dnssec-dnskey-kskonly", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
cfg_obj_asboolean(obj));
+
+ obj = NULL;
+ result = ns_config_get(maps, "dnssec-loadkeys-interval", &obj);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
+ RETERR(dns_zone_setrefreshkeyinterval(zone,
+ cfg_obj_asuint32(obj)));
} else if (ztype == dns_zone_slave) {
RETERR(configure_zone_acl(zconfig, vconfig, config,
allow_update_forwarding, ac, zone,
@@ -1214,7 +1250,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
*/
if (ztype == dns_zone_master) {
isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE;
- isc_boolean_t create = ISC_FALSE;
obj = NULL;
result = ns_config_get(maps, "check-wildcard", &obj);
@@ -1226,7 +1261,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-dup-records", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
fail = ISC_FALSE;
check = ISC_TRUE;
@@ -1241,7 +1276,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-mx", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
fail = ISC_FALSE;
check = ISC_TRUE;
@@ -1256,13 +1291,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-integrity", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
cfg_obj_asboolean(obj));
obj = NULL;
result = ns_config_get(maps, "check-mx-cname", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
warn = ISC_TRUE;
ignore = ISC_FALSE;
@@ -1277,7 +1312,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-srv-cname", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
warn = ISC_TRUE;
ignore = ISC_FALSE;
@@ -1292,7 +1327,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "dnssec-secure-to-insecure", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_SECURETOINSECURE,
cfg_obj_asboolean(obj));
@@ -1304,16 +1339,36 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
allow = ISC_TRUE;
else if (strcasecmp(arg, "maintain") == 0)
allow = maint = ISC_TRUE;
- else if (strcasecmp(arg, "create") == 0)
- allow = maint = create = ISC_TRUE;
else if (strcasecmp(arg, "off") == 0)
;
else
INSIST(0);
dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
- dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, create);
}
+
+ obj = NULL;
+ result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
+ if (result == ISC_R_SUCCESS) {
+ const char *arg = cfg_obj_asstring(obj);
+ if (strcasecmp(arg, "no-resign") == 0)
+ dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
+ ISC_TRUE);
+ else if (strcasecmp(arg, "maintain") == 0)
+ ;
+ else
+ INSIST(0);
+ }
+
+ obj = NULL;
+ result = ns_config_get(maps, "serial-update-method", &obj);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
+ if (strcasecmp(cfg_obj_asstring(obj), "unixtime") == 0)
+ dns_zone_setserialupdatemethod(zone,
+ dns_updatemethod_unixtime);
+ else
+ dns_zone_setserialupdatemethod(zone,
+ dns_updatemethod_increment);
}
/*
@@ -1322,9 +1377,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
switch (ztype) {
case dns_zone_slave:
case dns_zone_stub:
+ case dns_zone_redirect:
count = 0;
obj = NULL;
- result = cfg_map_get(zoptions, "masters", &obj);
+ (void)cfg_map_get(zoptions, "masters", &obj);
if (obj != NULL) {
addrs = NULL;
keynames = NULL;
@@ -1343,61 +1399,61 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
if (count > 1) {
obj = NULL;
result = ns_config_get(maps, "multi-master", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
multi = cfg_obj_asboolean(obj);
}
dns_zone_setoption(zone, DNS_ZONEOPT_MULTIMASTER, multi);
obj = NULL;
result = ns_config_get(maps, "max-transfer-time-in", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setmaxxfrin(zone, cfg_obj_asuint32(obj) * 60);
obj = NULL;
result = ns_config_get(maps, "max-transfer-idle-in", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setidlein(zone, cfg_obj_asuint32(obj) * 60);
obj = NULL;
result = ns_config_get(maps, "max-refresh-time", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setmaxrefreshtime(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "min-refresh-time", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setminrefreshtime(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "max-retry-time", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setmaxretrytime(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "min-retry-time", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setminretrytime(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "transfer-source", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setxfrsource4(zone, cfg_obj_assockaddr(obj)));
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
obj = NULL;
result = ns_config_get(maps, "transfer-source-v6", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setxfrsource6(zone, cfg_obj_assockaddr(obj)));
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
obj = NULL;
result = ns_config_get(maps, "alt-transfer-source", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setaltxfrsource4(zone, cfg_obj_assockaddr(obj)));
obj = NULL;
result = ns_config_get(maps, "alt-transfer-source-v6", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setaltxfrsource6(zone, cfg_obj_assockaddr(obj)));
obj = NULL;
@@ -1435,7 +1491,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
}
-#ifdef DLZ
/*
* Set up a DLZ zone as writeable
*/
@@ -1457,7 +1512,6 @@ ns_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
dns_db_detach(&db);
return result;
}
-#endif
isc_boolean_t
ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
diff --git a/external/bsd/bind/dist/bin/nsupdate/nsupdate.c b/external/bsd/bind/dist/bin/nsupdate/nsupdate.c
index 1e9535d7109..8561e4fcde8 100644
--- a/external/bsd/bind/dist/bin/nsupdate/nsupdate.c
+++ b/external/bsd/bind/dist/bin/nsupdate/nsupdate.c
@@ -1,4 +1,4 @@
-/* $NetBSD: nsupdate.c,v 1.2 2011/02/16 03:46:47 christos Exp $ */
+/* $NetBSD: nsupdate.c,v 1.3 2011/09/11 18:55:29 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: nsupdate.c,v 1.193 2011-01-10 05:32:03 marka Exp */
+/* Id: nsupdate.c,v 1.196 2011-05-23 22:25:32 each Exp */
/*! \file */
@@ -147,7 +147,7 @@ static dns_name_t tmpzonename;
static dns_name_t restart_master;
static dns_tsig_keyring_t *gssring = NULL;
static dns_tsigkey_t *tsigkey = NULL;
-static dst_key_t *sig0key;
+static dst_key_t *sig0key = NULL;
static lwres_context_t *lwctx = NULL;
static lwres_conf_t *lwconf;
static isc_sockaddr_t *servers;
@@ -697,8 +697,10 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
keyfile, isc_result_totext(result));
return;
}
- } else
+ } else {
dst_key_attach(dstkey, &sig0key);
+ dst_key_free(&dstkey);
+ }
}
static void
@@ -2262,6 +2264,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
}
check_result(result, "dns_request_getresponse");
section = DNS_SECTION_ANSWER;
+ POST(section);
if (debugging)
show_message(stderr, rcvmsg, "Reply from SOA query:");
@@ -2881,6 +2884,9 @@ cleanup(void) {
}
#endif
+ if (sig0key != NULL)
+ dst_key_free(&sig0key);
+
ddebug("Shutting down task manager");
isc_taskmgr_destroy(&taskmgr);
diff --git a/external/bsd/bind/dist/bin/rndc/rndc.c b/external/bsd/bind/dist/bin/rndc/rndc.c
index f59de3e3d82..040f910470e 100644
--- a/external/bsd/bind/dist/bin/rndc/rndc.c
+++ b/external/bsd/bind/dist/bin/rndc/rndc.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rndc.c,v 1.3 2011/07/05 21:59:18 spz Exp $ */
+/* $NetBSD: rndc.c,v 1.4 2011/09/11 18:55:29 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rndc.c,v 1.131.20.1.2.1 2011-06-02 23:47:28 tbox Exp */
+/* Id: rndc.c,v 1.134 2011-03-21 15:39:05 each Exp */
/*! \file */
@@ -116,6 +116,11 @@ command is one of the following:\n\
thaw Enable updates to all dynamic zones and reload them.\n\
thaw zone [class [view]]\n\
Enable updates to a frozen dynamic zone and reload it.\n\
+ sync [-clear] Dump changes to all dynamic zones to disk, and optionally\n\
+ remove their journal files.\n\
+ sync [-clear] zone [class [view]]\n\
+ Dump a single zone's changes to disk, and optionally\n\
+ remove its journal file.\n\
notify zone [class [view]]\n\
Resend NOTIFY messages for the zone.\n\
reconfig Reload configuration file and new zones only.\n\
diff --git a/external/bsd/bind/dist/bin/tests/db/t_db.c b/external/bsd/bind/dist/bin/tests/db/t_db.c
index 06308099347..8e3175f742c 100644
--- a/external/bsd/bind/dist/bin/tests/db/t_db.c
+++ b/external/bsd/bind/dist/bin/tests/db/t_db.c
@@ -1,7 +1,7 @@
-/* $NetBSD: t_db.c,v 1.2 2011/02/16 03:46:50 christos Exp $ */
+/* $NetBSD: t_db.c,v 1.3 2011/09/11 18:55:30 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: t_db.c,v 1.39 2009-09-01 00:22:25 jinmei Exp */
+/* Id: t_db.c,v 1.41 2011-03-12 04:59:46 tbox Exp */
#include <config.h>
@@ -120,7 +120,6 @@ t_dns_db_load(char **av) {
isc_result_t exp_load_result;
isc_result_t exp_find_result;
- result = T_UNRESOLVED;
db = NULL;
mctx = NULL;
ectx = NULL;
@@ -294,8 +293,6 @@ t_dns_db_zc_x(char *filename, char *db_type, char *origin, char *class,
isc_buffer_t origin_buffer;
dns_fixedname_t dns_origin;
- result = T_UNRESOLVED;
-
db = NULL;
mctx = NULL;
ectx = NULL;
@@ -771,8 +768,6 @@ t_dns_db_currentversion(char **av) {
dns_dbversion_t *cversionp;
dns_dbversion_t *nversionp;
- result = T_UNRESOLVED;
-
filename = T_ARG(0);
db_type = T_ARG(1);
origin = T_ARG(2);
@@ -1052,8 +1047,6 @@ t_dns_db_newversion(char **av) {
dns_dbversion_t *nversionp;
dns_rdatalist_t rdatalist;
- result = T_UNRESOLVED;
-
filename = T_ARG(0);
db_type = T_ARG(1);
origin = T_ARG(2);
@@ -1386,7 +1379,6 @@ t_dns_db_closeversion_1(char **av) {
existing_type = T_ARG(8);
nfails = 0;
- result = T_UNRESOLVED;
db = NULL;
mctx = NULL;
ectx = NULL;
@@ -1798,7 +1790,6 @@ t_dns_db_closeversion_2(char **av) {
existing_type = T_ARG(8);
nfails = 0;
- result = T_UNRESOLVED;
db = NULL;
mctx = NULL;
ectx = NULL;
@@ -2261,8 +2252,6 @@ t_dns_db_expirenode(char **av) {
mctx = NULL;
ectx = NULL;
- result = T_UNRESOLVED;
-
/*
* Find a node, mark it as stale, do a dns_db_find on the name and
* expect it to fail.
@@ -2466,7 +2455,6 @@ t_dns_db_findnode_1(char **av) {
db = NULL;
mctx = NULL;
ectx = NULL;
- result = T_UNRESOLVED;
t_info("testing using file %s and name %s\n", filename, find_name);
@@ -2528,6 +2516,13 @@ t_dns_db_findnode_1(char **av) {
isc_buffer_add(&name_buffer, len);
dns_result = dns_name_fromtext(dns_fixedname_name(&dns_name),
&name_buffer, NULL, 0, NULL);
+ if (dns_result != ISC_R_SUCCESS) {
+ t_info("dns_name_fromtext failed %s\n",
+ dns_result_totext(dns_result));
+ dns_db_detach(&db);
+ isc_mem_destroy(&mctx);
+ return(T_UNRESOLVED);
+ }
dns_result = dns_db_findnode(db, dns_fixedname_name(&dns_name),
ISC_FALSE, &nodep);
@@ -2625,7 +2620,6 @@ t_dns_db_findnode_2(char **av) {
model = T_ARG(4);
newname = T_ARG(5);
- result = T_UNRESOLVED;
db = NULL;
mctx = NULL;
ectx = NULL;
@@ -2684,6 +2678,15 @@ t_dns_db_findnode_2(char **av) {
isc_buffer_add(&name_buffer, len);
dns_result = dns_name_fromtext(dns_fixedname_name(&dns_name),
&name_buffer, NULL, 0, NULL);
+ if (dns_result != ISC_R_SUCCESS) {
+ t_info("dns_name_fromtext returned %s\n",
+ dns_result_totext(dns_result));
+ dns_db_detach(&db);
+ isc_hash_destroy();
+ isc_entropy_detach(&ectx);
+ isc_mem_destroy(&mctx);
+ return(T_UNRESOLVED);
+ }
dns_result = dns_db_findnode(db, dns_fixedname_name(&dns_name),
ISC_FALSE, &nodep);
@@ -2818,8 +2821,6 @@ t_dns_db_find_x(char **av) {
dns_rdatatype_t rdatatype;
dns_dbversion_t *cversionp;
- result = T_UNRESOLVED;
-
dbfile = T_ARG(0);
dbtype = T_ARG(1);
dborigin = T_ARG(2);
diff --git a/external/bsd/bind/dist/bin/tests/dst/gsstest.c b/external/bsd/bind/dist/bin/tests/dst/gsstest.c
index 245f0fb9300..5a1230d8703 100644
--- a/external/bsd/bind/dist/bin/tests/dst/gsstest.c
+++ b/external/bsd/bind/dist/bin/tests/dst/gsstest.c
@@ -1,4 +1,4 @@
-/* $NetBSD: gsstest.c,v 1.2 2011/02/16 03:46:50 christos Exp $ */
+/* $NetBSD: gsstest.c,v 1.3 2011/09/11 18:55:30 christos Exp $ */
/*
* Copyright (C) 2006, 2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: gsstest.c,v 1.14 2011-01-08 01:26:01 each Exp */
+/* Id: gsstest.c,v 1.16 2011-03-28 05:14:51 marka Exp */
#include <config.h>
@@ -105,23 +105,23 @@ console(isc_task_t *task, isc_event_t *event)
isc_event_free(&event);
- while(1) {
+ for (;;) {
printf("\nCommand => ");
c = scanf("%s", buf);
- if(c == EOF || strcmp(buf, "quit") == 0) {
+ if (c == EOF || strcmp(buf, "quit") == 0) {
isc_app_shutdown();
return;
}
- if(strcmp(buf, "initctx") == 0) {
+ if (strcmp(buf, "initctx") == 0) {
ev = isc_event_allocate(mctx, (void *)1, 1, initctx1,
NULL, sizeof(*event));
isc_task_send(task, &ev);
return;
}
- if(strcmp(buf, "query") == 0) {
+ if (strcmp(buf, "query") == 0) {
ev = isc_event_allocate(mctx, (void *)1, 1, sendquery,
NULL, sizeof(*event));
isc_task_send(task, &ev);
@@ -320,7 +320,7 @@ initctx2(isc_task_t *task, isc_event_t *event) {
rdataset = ISC_LIST_HEAD(question_name->list);
INSIST(rdataset != NULL);
qtype = rdataset->type;
- if(qtype == dns_rdatatype_tkey) {
+ if (qtype == dns_rdatatype_tkey) {
printf("Received TKEY response from server\n");
printf("Context completed\n");
} else {
@@ -330,14 +330,14 @@ initctx2(isc_task_t *task, isc_event_t *event) {
tsigkey = NULL;
}
- if(response)
+ if (response)
dns_message_destroy(&response);
end:
- if(query)
+ if (query)
dns_message_destroy(&query);
- if(reqev->request)
+ if (reqev->request)
dns_request_destroy(&reqev->request);
isc_event_free(&event);
@@ -420,11 +420,11 @@ setup(void)
struct in_addr inaddr;
int c;
- while (1) {
+ for (;;) {
printf("Server IP => ");
c = scanf("%s", serveraddress);
- if(c == EOF || strcmp(serveraddress, "quit") == 0) {
+ if (c == EOF || strcmp(serveraddress, "quit") == 0) {
isc_app_shutdown();
return;
}
@@ -434,7 +434,7 @@ setup(void)
return;
}
- };
+ }
}
int
diff --git a/external/bsd/bind/dist/bin/tests/dst/t_dst.c b/external/bsd/bind/dist/bin/tests/dst/t_dst.c
index 9b77f528bd3..be25a7f9516 100644
--- a/external/bsd/bind/dist/bin/tests/dst/t_dst.c
+++ b/external/bsd/bind/dist/bin/tests/dst/t_dst.c
@@ -1,7 +1,7 @@
-/* $NetBSD: t_dst.c,v 1.2 2011/02/16 03:46:50 christos Exp $ */
+/* $NetBSD: t_dst.c,v 1.3 2011/09/11 18:55:30 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: t_dst.c,v 1.58 2009-09-01 00:22:25 jinmei Exp */
+/* Id: t_dst.c,v 1.60 2011-03-17 23:47:29 tbox Exp */
#include <config.h>
@@ -266,8 +266,8 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
}
static void
-io(dns_name_t *name, int id, int alg, int type, isc_mem_t *mctx,
- isc_result_t exp_result, int *nfails, int *nprobs)
+io(dns_name_t *name, isc_uint16_t id, isc_uint16_t alg, int type,
+ isc_mem_t *mctx, isc_result_t exp_result, int *nfails, int *nprobs)
{
dst_key_t *key = NULL;
isc_result_t ret;
@@ -279,7 +279,7 @@ io(dns_name_t *name, int id, int alg, int type, isc_mem_t *mctx,
if (p == NULL) {
t_info("getcwd failed %d\n", errno);
++*nprobs;
- return;
+ goto failure;
}
ret = dst_key_fromfile(name, id, alg, type, current, mctx, &key);
@@ -287,7 +287,25 @@ io(dns_name_t *name, int id, int alg, int type, isc_mem_t *mctx,
t_info("dst_key_fromfile(%d) returned: %s\n",
alg, dst_result_totext(ret));
++*nfails;
- return;
+ goto failure;
+ }
+
+ if (dst_key_id(key) != id) {
+ t_info("key ID incorrect\n");
+ ++*nfails;
+ goto failure;
+ }
+
+ if (dst_key_alg(key) != alg) {
+ t_info("key algorithm incorrect\n");
+ ++*nfails;
+ goto failure;
+ }
+
+ if (dst_key_getttl(key) != 0) {
+ t_info("initial key TTL incorrect\n");
+ ++*nfails;
+ goto failure;
}
ret = isc_file_mktemplate("/tmp/", tmp, sizeof(tmp));
@@ -295,14 +313,14 @@ io(dns_name_t *name, int id, int alg, int type, isc_mem_t *mctx,
t_info("isc_file_mktemplate failed %s\n",
isc_result_totext(ret));
++*nprobs;
- return;
+ goto failure;
}
ret = isc_dir_createunique(tmp);
if (ret != ISC_R_SUCCESS) {
t_info("mkdir failed %d\n", errno);
++*nprobs;
- return;
+ goto failure;
}
ret = dst_key_tofile(key, type, tmp);
@@ -310,14 +328,48 @@ io(dns_name_t *name, int id, int alg, int type, isc_mem_t *mctx,
t_info("dst_key_tofile(%d) returned: %s\n",
alg, dst_result_totext(ret));
++*nfails;
- return;
+ goto failure;
}
if (dst_key_alg(key) != DST_ALG_DH)
use(key, mctx, exp_result, nfails);
+ /*
+ * Skip the rest of this test if we weren't expecting
+ * the read to be successful.
+ */
+ if (exp_result != ISC_R_SUCCESS)
+ goto cleanup;
+
+ dst_key_setttl(key, 3600);
+ ret = dst_key_tofile(key, type, tmp);
+ if (ret != 0) {
+ t_info("dst_key_tofile(%d) returned: %s\n",
+ alg, dst_result_totext(ret));
+ ++*nfails;
+ goto failure;
+ }
+
+ /* Reread key to confirm TTL was changed */
+ dst_key_free(&key);
+ ret = dst_key_fromfile(name, id, alg, type, tmp, mctx, &key);
+ if (ret != ISC_R_SUCCESS) {
+ t_info("dst_key_fromfile(%d) returned: %s\n",
+ alg, dst_result_totext(ret));
+ ++*nfails;
+ goto failure;
+ }
+
+ if (dst_key_getttl(key) != 3600) {
+ t_info("modified key TTL incorrect\n");
+ ++*nfails;
+ goto failure;
+ }
+
+ cleanup:
cleandir(tmp);
+ failure:
dst_key_free(&key);
}
diff --git a/external/bsd/bind/dist/bin/tests/master/t_master.c b/external/bsd/bind/dist/bin/tests/master/t_master.c
index f98773cacea..596858e2b27 100644
--- a/external/bsd/bind/dist/bin/tests/master/t_master.c
+++ b/external/bsd/bind/dist/bin/tests/master/t_master.c
@@ -1,7 +1,7 @@
-/* $NetBSD: t_master.c,v 1.2 2011/02/16 03:46:50 christos Exp $ */
+/* $NetBSD: t_master.c,v 1.3 2011/09/11 18:55:30 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: t_master.c,v 1.39 2009-09-01 00:22:25 jinmei Exp */
+/* Id: t_master.c,v 1.41 2011-03-12 04:59:46 tbox Exp */
#include <config.h>
@@ -79,7 +79,6 @@ test_master(char *testfile, char *origin, char *class, isc_result_t exp_result)
dns_rdataclass_t rdataclass;
isc_textregion_t textregion;
- result = T_UNRESOLVED;
if (T1_mctx == NULL)
isc_result = isc_mem_create(0, 0, &T1_mctx);
else
diff --git a/external/bsd/bind/dist/bin/tests/names/t_names.c b/external/bsd/bind/dist/bin/tests/names/t_names.c
index a73f69c03dc..8ceab6478a7 100644
--- a/external/bsd/bind/dist/bin/tests/names/t_names.c
+++ b/external/bsd/bind/dist/bin/tests/names/t_names.c
@@ -1,7 +1,7 @@
-/* $NetBSD: t_names.c,v 1.2 2011/02/16 03:46:51 christos Exp $ */
+/* $NetBSD: t_names.c,v 1.3 2011/09/11 18:55:30 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: t_names.c,v 1.50 2009-09-01 23:47:44 tbox Exp */
+/* Id: t_names.c,v 1.52 2011-03-12 04:59:46 tbox Exp */
#include <config.h>
@@ -181,7 +181,6 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
int c;
int len;
int cnt;
- unsigned int val;
unsigned char *p;
FILE *fp;
@@ -194,8 +193,8 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
p = buf;
cnt = 0;
len = 0;
- val = 0;
while ((c = getc(fp)) != EOF) {
+ unsigned int val;
if ( (c == ' ') || (c == '\t') ||
(c == '\r') || (c == '\n'))
continue;
@@ -1680,8 +1679,6 @@ test_dns_name_fromtext(char *test_name1, char *test_name2, char *test_origin,
isc_result_t dns_result;
dns_namereln_t dns_namereln;
- result = T_UNRESOLVED;
-
t_info("testing %s %s %s\n", test_name1, test_name2, test_origin);
isc_buffer_init(&binbuf1, junk1, BUFLEN);
@@ -1817,8 +1814,6 @@ test_dns_name_totext(char *test_name, isc_boolean_t omit_final) {
isc_result_t dns_result;
dns_namereln_t dns_namereln;
- result = T_UNRESOLVED;
-
t_info("testing %s\n", test_name);
len = strlen(test_name);
@@ -1985,8 +1980,6 @@ test_dns_name_fromwire(char *datafile_name, int testname_offset, int downcase,
dns_namereln_t dns_namereln;
dns_decompress_t dctx;
- result = T_UNRESOLVED;
-
t_info("testing using %s\n", datafile_name);
len = getmsg(datafile_name, buf1, BIGBUFLEN, &iscbuf1);
diff --git a/external/bsd/bind/dist/bin/tests/rbt/t_rbt.c b/external/bsd/bind/dist/bin/tests/rbt/t_rbt.c
index f4bc540ea32..9849eb1aa9f 100644
--- a/external/bsd/bind/dist/bin/tests/rbt/t_rbt.c
+++ b/external/bsd/bind/dist/bin/tests/rbt/t_rbt.c
@@ -1,7 +1,7 @@
-/* $NetBSD: t_rbt.c,v 1.2 2011/02/16 03:46:51 christos Exp $ */
+/* $NetBSD: t_rbt.c,v 1.3 2011/09/11 18:55:30 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: t_rbt.c,v 1.33 2009-09-01 00:22:25 jinmei Exp */
+/* Id: t_rbt.c,v 1.35 2011-03-12 04:59:46 tbox Exp */
#include <config.h>
@@ -400,8 +400,7 @@ test_rbt_gen(char *filename, char *command, char *testname,
result = T_FAIL;
}
} else {
- t_info("create_name failed %s\n",
- dns_result_totext(dns_result));
+ t_info("create_name failed\n");
result = T_UNRESOLVED;
}
} else if ((strcmp(command, "delete") == 0) ||
@@ -1114,8 +1113,8 @@ t_dns_rbtnodechain_first(char *dbfile, char *expected_firstname,
t_info("dns_rbtnodechain_first unexpectedly returned %s\n",
dns_result_totext(dns_result));
- nfails = t_namechk(dns_result, &dns_name, expected_firstname,
- &dns_origin, expected_firstorigin, DNS_R_NEWORIGIN);
+ nfails += t_namechk(dns_result, &dns_name, expected_firstname,
+ &dns_origin, expected_firstorigin, DNS_R_NEWORIGIN);
dns_fixedname_init(&dns_name);
dns_result = dns_rbtnodechain_next(&chain,
@@ -1305,8 +1304,8 @@ t_dns_rbtnodechain_last(char *dbfile, char *expected_lastname,
t_info("dns_rbtnodechain_last unexpectedly returned %s\n",
dns_result_totext(dns_result));
}
- nfails = t_namechk(dns_result, &dns_name, expected_lastname,
- &dns_origin, expected_lastorigin, DNS_R_NEWORIGIN);
+ nfails += t_namechk(dns_result, &dns_name, expected_lastname,
+ &dns_origin, expected_lastorigin, DNS_R_NEWORIGIN);
t_info("testing for previous name of %s, origin of %s\n",
expected_prevname, expected_prevorigin);
diff --git a/external/bsd/bind/dist/bin/tests/rdata_test.c b/external/bsd/bind/dist/bin/tests/rdata_test.c
index 992e5cf4940..242d4efdcad 100644
--- a/external/bsd/bind/dist/bin/tests/rdata_test.c
+++ b/external/bsd/bind/dist/bin/tests/rdata_test.c
@@ -1,7 +1,7 @@
-/* $NetBSD: rdata_test.c,v 1.2 2011/02/16 03:46:49 christos Exp $ */
+/* $NetBSD: rdata_test.c,v 1.3 2011/09/11 18:55:29 christos Exp $ */
/*
- * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rdata_test.c,v 1.48 2007-06-19 23:46:59 tbox Exp */
+/* Id: rdata_test.c,v 1.51 2011-08-16 03:00:02 marka Exp */
#include <config.h>
@@ -187,8 +187,8 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
break;
}
case dns_rdatatype_naptr: {
- dns_rdata_in_naptr_t in_naptr;
- result = dns_rdata_tostruct(rdata, sp = &in_naptr, NULL);
+ dns_rdata_naptr_t naptr;
+ result = dns_rdata_tostruct(rdata, sp = &naptr, NULL);
break;
}
case dns_rdatatype_ns: {
@@ -281,6 +281,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
result = dns_rdata_tostruct(rdata, sp = &unspec, NULL);
break;
}
+ case dns_rdatatype_uri: {
+ dns_rdata_uri_t uri;
+ result = dns_rdata_tostruct(rdata, sp = &uri, NULL);
+ break;
+ }
case dns_rdatatype_wks: {
dns_rdata_in_wks_t in_wks;
result = dns_rdata_tostruct(rdata, sp = &in_wks, NULL);
@@ -449,8 +454,8 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
break;
}
case dns_rdatatype_naptr: {
- dns_rdata_in_naptr_t in_naptr;
- result = dns_rdata_tostruct(rdata, sp = &in_naptr, mctx);
+ dns_rdata_naptr_t naptr;
+ result = dns_rdata_tostruct(rdata, sp = &naptr, mctx);
break;
}
case dns_rdatatype_ns: {
@@ -543,6 +548,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
result = dns_rdata_tostruct(rdata, sp = &unspec, mctx);
break;
}
+ case dns_rdatatype_uri: {
+ dns_rdata_uri_t uri;
+ result = dns_rdata_tostruct(rdata, sp = &uri, mctx);
+ break;
+ }
case dns_rdatatype_wks: {
dns_rdata_in_wks_t in_wks;
result = dns_rdata_tostruct(rdata, sp = &in_wks, mctx);
@@ -740,8 +750,8 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
break;
}
case dns_rdatatype_naptr: {
- dns_rdata_in_naptr_t in_naptr;
- result = dns_rdata_fromstruct(rdata2, rdc, rdt, &in_naptr, b);
+ dns_rdata_naptr_t naptr;
+ result = dns_rdata_fromstruct(rdata2, rdc, rdt, &naptr, b);
break;
}
case dns_rdatatype_ns: {
@@ -835,6 +845,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
result = dns_rdata_fromstruct(rdata2, rdc, rdt, &unspec, b);
break;
}
+ case dns_rdatatype_uri: {
+ dns_rdata_uri_t uri;
+ result = dns_rdata_fromstruct(rdata2, rdc, rdt, &uri, b);
+ break;
+ }
case dns_rdatatype_wks: {
dns_rdata_in_wks_t in_wks;
result = dns_rdata_fromstruct(rdata2, rdc, rdt, &in_wks, b);
diff --git a/external/bsd/bind/dist/bin/tests/resolver/t_resolver.c b/external/bsd/bind/dist/bin/tests/resolver/t_resolver.c
index 0709de71f36..888149ed30a 100644
--- a/external/bsd/bind/dist/bin/tests/resolver/t_resolver.c
+++ b/external/bsd/bind/dist/bin/tests/resolver/t_resolver.c
@@ -1,4 +1,4 @@
-/* $NetBSD: t_resolver.c,v 1.3 2011/07/05 21:59:18 spz Exp $ */
+/* $NetBSD: t_resolver.c,v 1.4 2011/09/11 18:55:30 christos Exp $ */
/*
* Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: t_resolver.c,v 1.2.2.2.2.1 2011-06-02 23:47:28 tbox Exp */
+/* Id: t_resolver.c,v 1.3 2011-02-03 12:18:11 tbox Exp */
#include <config.h>
diff --git a/external/bsd/bind/dist/bin/tests/system/dlv/ns1/root.db b/external/bsd/bind/dist/bin/tests/system/dlv/ns1/root.db
deleted file mode 100644
index f857e628d88..00000000000
--- a/external/bsd/bind/dist/bin/tests/system/dlv/ns1/root.db
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC")
-;
-; Permission to use, copy, modify, and/or distribute this software for any
-; purpose with or without fee is hereby granted, provided that the above
-; copyright notice and this permission notice appear in all copies.
-;
-; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-; PERFORMANCE OF THIS SOFTWARE.
-
-; Id: root.db,v 1.4 2007-06-19 23:47:02 tbox Exp
-
-$TTL 120
-@ SOA ns.rootservers.utld hostmaster.ns.rootservers.utld (
- 1 3600 1200 604800 60 )
-@ NS ns.rootservers.utld
-ns A 10.53.0.1
-;
-utld NS ns.utld
-ns.utld A 10.53.0.2
diff --git a/external/bsd/bind/dist/bin/tests/system/dlzexternal/ns1/named.conf b/external/bsd/bind/dist/bin/tests/system/dlzexternal/ns1/named.conf
deleted file mode 100644
index 6146252a760..00000000000
--- a/external/bsd/bind/dist/bin/tests/system/dlzexternal/ns1/named.conf
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright (C) 2010 Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* Id: named.conf,v 1.3 2010-12-20 23:47:20 tbox Exp */
-
-controls { };
-
-options {
- query-source address 10.53.0.1;
- notify-source 10.53.0.1;
- transfer-source 10.53.0.1;
- port 5300;
- pid-file "named.pid";
- session-keyfile "session.key";
- listen-on { 10.53.0.1; 127.0.0.1; };
- listen-on-v6 { none; };
- recursion no;
- notify yes;
-};
-
-key rndc_key {
- secret "1234abcd8765";
- algorithm hmac-md5;
-};
-
-include "ddns.key";
-
-controls {
- inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
-};
-
-dlz "example zone" {
- database "dlopen ../../../../../contrib/dlz/example/dlz_example.so example.nil";
-};
diff --git a/external/bsd/bind/dist/bin/tests/system/filter-aaaa/filter-aaaa.c b/external/bsd/bind/dist/bin/tests/system/filter-aaaa/filter-aaaa.c
index c26fb3c1ddc..843db862406 100644
--- a/external/bsd/bind/dist/bin/tests/system/filter-aaaa/filter-aaaa.c
+++ b/external/bsd/bind/dist/bin/tests/system/filter-aaaa/filter-aaaa.c
@@ -1,7 +1,7 @@
-/* $NetBSD: filter-aaaa.c,v 1.2 2011/02/16 03:46:52 christos Exp $ */
+/* $NetBSD: filter-aaaa.c,v 1.3 2011/09/11 18:55:31 christos Exp $ */
/*
- * Copyright (C) 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,14 +16,17 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: filter-aaaa.c,v 1.2 2010-06-22 03:58:36 marka Exp */
+/* Id: filter-aaaa.c,v 1.4 2011-07-28 23:47:58 tbox Exp */
#include <config.h>
+#include <isc/util.h>
int
main(int argc, char **argv) {
- argc = argc;
- argv = argv;
+
+ UNUSED(argc);
+ UNUSED(argv);
+
#ifdef ALLOW_FILTER_AAAA_ON_V4
return (0);
#else
diff --git a/external/bsd/bind/dist/bin/tests/system/ixfr/ans2/ans.pl b/external/bsd/bind/dist/bin/tests/system/ixfr/ans2/ans.pl
deleted file mode 100644
index bff909cfcd2..00000000000
--- a/external/bsd/bind/dist/bin/tests/system/ixfr/ans2/ans.pl
+++ /dev/null
@@ -1,157 +0,0 @@
-#!/usr/bin/perl
-#
-# Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC")
-# Copyright (C) 2001 Internet Software Consortium.
-#
-# Permission to use, copy, modify, and/or distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-# Id: ans.pl,v 1.6 2007-09-24 04:13:25 marka Exp
-
-#
-# This is the name server from hell. It provides canned
-# responses based on pattern matching the queries, and
-# can be reprogrammed on-the-fly over a TCP connection.
-#
-# The server listens for control connections on port 5301.
-# A control connection is a TCP stream of lines like
-#
-# /pattern/
-# name ttl type rdata
-# name ttl type rdata
-# ...
-# /pattern/
-# name ttl type rdata
-# name ttl type rdata
-# ...
-#
-# There can be any number of patterns, each associated
-# with any number of response RRs. Each pattern is a
-# Perl regular expression.
-#
-# Each incoming query is converted into a string of the form
-# "qname qtype" (the printable query domain name, space,
-# printable query type) and matched against each pattern.
-#
-# The first pattern matching the query is selected, and
-# the RR following the pattern line are sent in the
-# answer section of the response.
-#
-# Each new control connection causes the current set of
-# patterns and responses to be cleared before adding new
-# ones.
-#
-# The server handles UDP and TCP queries. Zone transfer
-# responses work, but must fit in a single 64 k message.
-#
-
-use IO::File;
-use IO::Socket;
-use Net::DNS;
-use Net::DNS::Packet;
-
-my $ctlsock = IO::Socket::INET->new(LocalAddr => "10.53.0.2",
- LocalPort => 5301, Proto => "tcp", Listen => 5, Reuse => 1) or die "$!";
-
-my $udpsock = IO::Socket::INET->new(LocalAddr => "10.53.0.2",
- LocalPort => 5300, Proto => "udp", Reuse => 1) or die "$!";
-
-my $tcpsock = IO::Socket::INET->new(LocalAddr => "10.53.0.2",
- LocalPort => 5300, Proto => "tcp", Listen => 5, Reuse => 1) or die "$!";
-
-my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
-print $pidf "$$\n" or die "cannot write pid file: $!";
-$pidf->close or die "cannot close pid file: $!";;
-sub rmpid { unlink "ans.pid"; exit 1; };
-
-$SIG{INT} = \&rmpid;
-$SIG{TERM} = \&rmpid;
-
-my @answers = ();
-
-sub handle {
- my ($buf) = @_;
-
- my ($packet, $err) = new Net::DNS::Packet(\$buf, 0);
- $err and die $err;
-
- $packet->header->qr(1);
- $packet->header->aa(1);
-
- my @questions = $packet->question;
- my $qname = $questions[0]->qname;
- my $qtype = $questions[0]->qtype;
-
- my $r;
- foreach $r (@rules) {
- my $pattern = $r->{pattern};
- warn "match $qname $qtype == $pattern";
- if ("$qname $qtype" =~ /$pattern/) {
- my $a;
- foreach $a (@{$r->{answer}}) {
- $packet->push("answer", $a);
- }
- last;
- }
- }
-
- # $packet->print;
-
- return $packet->data;
-}
-
-for (;;) {
- $rin = '';
- vec($rin, fileno($ctlsock), 1) = 1;
- vec($rin, fileno($tcpsock), 1) = 1;
- vec($rin, fileno($udpsock), 1) = 1;
-
- select($rout = $rin, undef, undef, undef);
-
- if (vec($rout, fileno($ctlsock), 1)) {
- warn "ctl conn";
- my $conn = $ctlsock->accept;
- @rules = ();
- while (my $line = $conn->getline) {
- chomp $line;
- if ($line =~ m!^/(.*)/$!) {
- $rule = { pattern => $1, answer => [] };
- push(@rules, $rule);
- } else {
- push(@{$rule->{answer}},
- new Net::DNS::RR($line));
- }
-
- }
- $conn->close;
- } elsif (vec($rout, fileno($udpsock), 1)) {
- printf "UDP request\n";
- $udpsock->recv($buf, 512);
- $response = handle($buf);
- $udpsock->send($response);
- } elsif (vec($rout, fileno($tcpsock), 1)) {
- my $conn = $tcpsock->accept;
- for (;;) {
- printf "TCP request\n";
- my $n = $conn->sysread($lenbuf, 2);
- last unless $n == 2;
- my $len = unpack("n", $lenbuf);
- $n = $conn->sysread($buf, $len);
- last unless $n == $len;
- $response = handle($buf);
- $len = length($response);
- $n = $conn->syswrite(pack("n", $len), 2);
- $n = $conn->syswrite($response, $len);
- }
- $conn->close;
- }
-}
diff --git a/external/bsd/bind/dist/bin/tests/system/tsiggss/ns1/example.nil.db b/external/bsd/bind/dist/bin/tests/system/tsiggss/ns1/example.nil.db
deleted file mode 100644
index 001bb298377..00000000000
--- a/external/bsd/bind/dist/bin/tests/system/tsiggss/ns1/example.nil.db
+++ /dev/null
@@ -1,51 +0,0 @@
-; -*- zone -*-
-; this was generated by a Samba4 provision, and is typical
-; of a AD DNS zone
-$ORIGIN example.nil.
-$TTL 1W
-@ IN SOA blu hostmaster (
- 2010113027 ; serial
- 2D ; refresh
- 4H ; retry
- 6W ; expiry
- 1W ) ; minimum
- IN NS blu
-
- IN A 10.53.0.1
-;
-
-blu IN A 10.53.0.1
-gc._msdcs IN A 10.53.0.1
-
-fb33eb58-5d58-4100-a114-256e0a97ffc1._msdcs IN CNAME blu
-;
-; global catalog servers
-_gc._tcp IN SRV 0 100 3268 blu
-_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 blu
-_ldap._tcp.gc._msdcs IN SRV 0 100 3268 blu
-_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 3268 blu
-;
-; ldap servers
-_ldap._tcp IN SRV 0 100 389 blu
-_ldap._tcp.dc._msdcs IN SRV 0 100 389 blu
-_ldap._tcp.pdc._msdcs IN SRV 0 100 389 blu
-_ldap._tcp.d86745b4-f3e0-4af3-be03-2130d1534be8.domains._msdcs IN SRV 0 100 389 blu
-_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 blu
-_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 blu
-;
-; krb5 servers
-_kerberos._tcp IN SRV 0 100 88 blu
-_kerberos._tcp.dc._msdcs IN SRV 0 100 88 blu
-_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 blu
-_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 blu
-_kerberos._udp IN SRV 0 100 88 blu
-; MIT kpasswd likes to lookup this name on password change
-_kerberos-master._tcp IN SRV 0 100 88 blu
-_kerberos-master._udp IN SRV 0 100 88 blu
-;
-; kpasswd
-_kpasswd._tcp IN SRV 0 100 464 blu
-_kpasswd._udp IN SRV 0 100 464 blu
-;
-; heimdal 'find realm for host' hack
-_kerberos IN TXT EXAMPLE.NIL
diff --git a/external/bsd/bind/dist/bin/tests/tasks/t_tasks.c b/external/bsd/bind/dist/bin/tests/tasks/t_tasks.c
index 1efeebb61ad..1c9209c3ba4 100644
--- a/external/bsd/bind/dist/bin/tests/tasks/t_tasks.c
+++ b/external/bsd/bind/dist/bin/tests/tasks/t_tasks.c
@@ -1,7 +1,7 @@
-/* $NetBSD: t_tasks.c,v 1.2 2011/02/16 03:46:53 christos Exp $ */
+/* $NetBSD: t_tasks.c,v 1.3 2011/09/11 18:55:32 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: t_tasks.c,v 1.42 2009-01-22 23:47:54 tbox Exp */
+/* Id: t_tasks.c,v 1.49 2011-07-27 07:45:55 marka Exp */
#include <config.h>
@@ -70,6 +70,7 @@ t1_callback(isc_task_t *task, isc_event_t *event) {
static void
t1_shutdown(isc_task_t *task, isc_event_t *event) {
+
UNUSED(task);
t_info("shutdown %s\n", (char *)event->ev_arg);
@@ -78,6 +79,7 @@ t1_shutdown(isc_task_t *task, isc_event_t *event) {
static void
my_tick(isc_task_t *task, isc_event_t *event) {
+
UNUSED(task);
t_info("%s\n", (char *)event->ev_arg);
@@ -402,7 +404,7 @@ t2_shutdown(isc_task_t *task, isc_event_t *event) {
isc_result_t isc_result;
- task = task; /* notused */
+ UNUSED(task);
if (event->ev_arg != NULL) {
isc_task_destroy((isc_task_t**) &event->ev_arg);
@@ -596,7 +598,8 @@ static int T3_nprobs;
static void
t3_sde1(isc_task_t *task, isc_event_t *event) {
- task = task;
+
+ UNUSED(task);
if (T3_nevents != T3_NEVENTS) {
t_info("Some events were not processed\n");
@@ -614,7 +617,7 @@ t3_sde1(isc_task_t *task, isc_event_t *event) {
static void
t3_sde2(isc_task_t *task, isc_event_t *event) {
- task = task;
+ UNUSED(task);
if (T3_nevents != T3_NEVENTS) {
t_info("Some events were not processed\n");
@@ -633,7 +636,7 @@ static void
t3_event1(isc_task_t *task, isc_event_t *event) {
isc_result_t isc_result;
- task = task;
+ UNUSED(task);
isc_result = isc_mutex_lock(&T3_mx);
if (isc_result != ISC_R_SUCCESS) {
@@ -656,7 +659,7 @@ t3_event1(isc_task_t *task, isc_event_t *event) {
static void
t3_event2(isc_task_t *task, isc_event_t *event) {
- task = task;
+ UNUSED(task);
++T3_nevents;
isc_event_free(&event);
@@ -735,7 +738,7 @@ t_tasks3(void) {
if (isc_result != ISC_R_SUCCESS) {
t_info("isc_task_create failed %s\n",
isc_result_totext(isc_result));
- isc_mutex_unlock(&T3_mx);
+ (void) isc_mutex_unlock(&T3_mx);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
@@ -746,6 +749,14 @@ t_tasks3(void) {
*/
event = isc_event_allocate(mctx, &senders[1], event_type, t3_event1,
NULL, sizeof(*event));
+ if (event == NULL) {
+ t_info("isc_event_allocate failed\n");
+ (void) isc_mutex_unlock(&T3_mx);
+ isc_task_destroy(&task);
+ isc_taskmgr_destroy(&tmgr);
+ isc_mem_destroy(&mctx);
+ return(T_UNRESOLVED);
+ }
isc_task_send(task, &event);
/*
@@ -754,6 +765,14 @@ t_tasks3(void) {
for (cnt = 0; cnt < T3_NEVENTS; ++cnt) {
event = isc_event_allocate(mctx, &senders[1], event_type,
t3_event2, NULL, sizeof(*event));
+ if (event == NULL) {
+ t_info("isc_event_allocate failed\n");
+ (void) isc_mutex_unlock(&T3_mx);
+ isc_task_destroy(&task);
+ isc_taskmgr_destroy(&tmgr);
+ isc_mem_destroy(&mctx);
+ return(T_UNRESOLVED);
+ }
isc_task_send(task, &event);
}
@@ -764,7 +783,7 @@ t_tasks3(void) {
if (isc_result != ISC_R_SUCCESS) {
t_info("isc_task_send failed %s\n",
isc_result_totext(isc_result));
- isc_mutex_unlock(&T3_mx);
+ (void) isc_mutex_unlock(&T3_mx);
isc_task_destroy(&task);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
@@ -775,7 +794,7 @@ t_tasks3(void) {
if (isc_result != ISC_R_SUCCESS) {
t_info("isc_task_send failed %s\n",
isc_result_totext(isc_result));
- isc_mutex_unlock(&T3_mx);
+ (void) isc_mutex_unlock(&T3_mx);
isc_task_destroy(&task);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
@@ -790,14 +809,14 @@ t_tasks3(void) {
T3_flag = 1;
isc_result = isc_condition_signal(&T3_cv);
if (isc_result != ISC_R_SUCCESS) {
- t_info("isc_task_send failed %s\n",
+ t_info("isc_condition_signal failed %s\n",
isc_result_totext(isc_result));
++T3_nprobs;
}
isc_result = isc_mutex_unlock(&T3_mx);
if (isc_result != ISC_R_SUCCESS) {
- t_info("isc_task_send failed %s\n",
+ t_info("isc_mutex_unlock failed %s\n",
isc_result_totext(isc_result));
++T3_nprobs;
}
@@ -812,11 +831,6 @@ t_tasks3(void) {
++T3_nfails;
}
- if (T3_nevents != T3_nevents) {
- t_info("T3_nevents == %d, expected 2\n", T3_nevents);
- ++T3_nfails;
- }
-
result = T_UNRESOLVED;
if (T3_nfails != 0)
@@ -899,7 +913,6 @@ t_tasks4(void) {
T4_nfails = 0;
T4_flag = 0;
- result = T_UNRESOLVED;
event_type = 4;
workers = 2;
@@ -938,7 +951,7 @@ t_tasks4(void) {
t_info("isc_taskmgr_create failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T4_mx);
- isc_condition_destroy(&T4_cv);
+ (void) isc_condition_destroy(&T4_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -948,7 +961,7 @@ t_tasks4(void) {
t_info("isc_mutex_lock failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T4_mx);
- isc_condition_destroy(&T4_cv);
+ (void) isc_condition_destroy(&T4_cv);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
@@ -960,7 +973,7 @@ t_tasks4(void) {
t_info("isc_task_create failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T4_mx);
- isc_condition_destroy(&T4_cv);
+ (void) isc_condition_destroy(&T4_cv);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
@@ -971,6 +984,15 @@ t_tasks4(void) {
*/
event = isc_event_allocate(mctx, &senders[1], event_type, t4_event1,
NULL, sizeof(*event));
+ if (event == NULL) {
+ t_info("isc_event_allocate failed\n");
+ DESTROYLOCK(&T4_mx);
+ isc_task_destroy(&task);
+ (void) isc_condition_destroy(&T4_cv);
+ isc_taskmgr_destroy(&tmgr);
+ isc_mem_destroy(&mctx);
+ return(T_UNRESOLVED);
+ }
isc_task_send(task, &event);
isc_task_shutdown(task);
@@ -1004,7 +1026,7 @@ t_tasks4(void) {
isc_task_detach(&task);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
- isc_condition_destroy(&T4_cv);
+ (void) isc_condition_destroy(&T4_cv);
DESTROYLOCK(&T4_mx);
result = T_UNRESOLVED;
@@ -1099,7 +1121,6 @@ t_tasks7(void) {
T7_sdflag = 0;
T7_eflag = 0;
- result = T_UNRESOLVED;
event_type = 7;
workers = 2;
@@ -1138,7 +1159,7 @@ t_tasks7(void) {
t_info("isc_taskmgr_create failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T7_mx);
- isc_condition_destroy(&T7_cv);
+ (void) isc_condition_destroy(&T7_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -1148,7 +1169,7 @@ t_tasks7(void) {
t_info("isc_mutex_lock failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T7_mx);
- isc_condition_destroy(&T7_cv);
+ (void) isc_condition_destroy(&T7_cv);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
return(T_FAIL);
@@ -1160,7 +1181,7 @@ t_tasks7(void) {
t_info("isc_task_create failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T7_mx);
- isc_condition_destroy(&T7_cv);
+ (void) isc_condition_destroy(&T7_cv);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
return(T_FAIL);
@@ -1171,7 +1192,7 @@ t_tasks7(void) {
t_info("isc_task_onshutdown returned %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T7_mx);
- isc_condition_destroy(&T7_cv);
+ (void) isc_condition_destroy(&T7_cv);
isc_task_destroy(&task);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
@@ -1180,6 +1201,15 @@ t_tasks7(void) {
event = isc_event_allocate(mctx, &senders[1], event_type, t7_event1,
NULL, sizeof(*event));
+ if (event == NULL) {
+ t_info("isc_event_allocate failed\n");
+ DESTROYLOCK(&T7_mx);
+ (void) isc_condition_destroy(&T7_cv);
+ isc_task_destroy(&task);
+ isc_taskmgr_destroy(&tmgr);
+ isc_mem_destroy(&mctx);
+ return(T_UNRESOLVED);
+ }
isc_task_send(task, &event);
isc_task_shutdown(task);
@@ -1193,7 +1223,7 @@ t_tasks7(void) {
t_info("isc_time_nowplusinterval failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T7_mx);
- isc_condition_destroy(&T7_cv);
+ (void) isc_condition_destroy(&T7_cv);
isc_task_destroy(&task);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
@@ -1205,7 +1235,7 @@ t_tasks7(void) {
t_info("isc_condition_waituntil returned %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T7_mx);
- isc_condition_destroy(&T7_cv);
+ (void) isc_condition_destroy(&T7_cv);
isc_task_destroy(&task);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
@@ -1223,7 +1253,7 @@ t_tasks7(void) {
isc_task_detach(&task);
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
- isc_condition_destroy(&T7_cv);
+ (void) isc_condition_destroy(&T7_cv);
DESTROYLOCK(&T7_mx);
result = T_UNRESOLVED;
@@ -1276,7 +1306,7 @@ static void
t10_event1(isc_task_t *task, isc_event_t *event) {
isc_result_t isc_result;
- task = task;
+ UNUSED(task);
isc_result = isc_mutex_lock(&T10_mx);
if (isc_result != ISC_R_SUCCESS) {
@@ -1311,7 +1341,7 @@ t10_event2(isc_task_t *task, isc_event_t *event) {
int type_match;
int tag_match;
- task = task;
+ UNUSED(task);
sender_match = 0;
type_match = 0;
@@ -1367,7 +1397,7 @@ static void
t10_sde(isc_task_t *task, isc_event_t *event) {
isc_result_t isc_result;
- task = task;
+ UNUSED(task);
isc_result = isc_mutex_lock(&T10_mx);
if (isc_result != ISC_R_SUCCESS) {
@@ -1467,7 +1497,7 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
isc_result_totext(isc_result));
isc_mem_destroy(&mctx);
DESTROYLOCK(&T10_mx);
- isc_condition_destroy(&T10_cv);
+ (void) isc_condition_destroy(&T10_cv);
++*nprobs;
return;
}
@@ -1480,7 +1510,7 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T10_mx);
- isc_condition_destroy(&T10_cv);
+ (void) isc_condition_destroy(&T10_cv);
++*nprobs;
return;
}
@@ -1493,7 +1523,7 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T10_mx);
- isc_condition_destroy(&T10_cv);
+ (void) isc_condition_destroy(&T10_cv);
++*nprobs;
return;
}
@@ -1504,6 +1534,16 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
event = isc_event_allocate(mctx, (void *)1, (isc_eventtype_t)T_CONTROL,
t10_event1, NULL, sizeof(*event));
+ if (event == NULL) {
+ t_info("isc_event_allocate failed\n");
+ isc_task_destroy(&task);
+ isc_taskmgr_destroy(&tmgr);
+ isc_mem_destroy(&mctx);
+ DESTROYLOCK(&T10_mx);
+ (void) isc_condition_destroy(&T10_cv);
+ ++*nprobs;
+ return;
+ }
isc_task_send(task, &event);
/*
@@ -1521,6 +1561,17 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
(isc_eventtype_t)(type + type_cnt),
t10_event2, NULL, sizeof(*event));
+ if (eventtab[event_cnt] == NULL) {
+ t_info("isc_event_allocate failed\n");
+ isc_task_destroy(&task);
+ isc_taskmgr_destroy(&tmgr);
+ isc_mem_destroy(&mctx);
+ DESTROYLOCK(&T10_mx);
+ (void) isc_condition_destroy(&T10_cv);
+ ++*nprobs;
+ return;
+ }
+
eventtab[event_cnt]->ev_tag =
(void *)((uintptr_t)tag + tag_cnt);
@@ -1579,7 +1630,7 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T10_mx);
- isc_condition_destroy(&T10_cv);
+ (void) isc_condition_destroy(&T10_cv);
++*nprobs;
return;
}
@@ -1612,7 +1663,7 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T10_mx);
- isc_condition_destroy(&T10_cv);
+ (void) isc_condition_destroy(&T10_cv);
++*nprobs;
return;
}
@@ -1625,7 +1676,7 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T10_mx);
- isc_condition_destroy(&T10_cv);
+ (void) isc_condition_destroy(&T10_cv);
++*nfails;
return;
}
@@ -1642,7 +1693,7 @@ t_taskpurge_x(int sender, int type, int tag, void *purge_sender,
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T10_mx);
- isc_condition_destroy(&T10_cv);
+ (void) isc_condition_destroy(&T10_cv);
if (T_debug)
t_info("task processed %d events\n", T10_eventcnt);
@@ -1734,7 +1785,7 @@ static void
t11_event1(isc_task_t *task, isc_event_t *event) {
isc_result_t isc_result;
- task = task;
+ UNUSED(task);
isc_result = isc_mutex_lock(&T11_mx);
if (isc_result != ISC_R_SUCCESS) {
@@ -1859,7 +1910,7 @@ t_tasks11(int purgable) {
isc_result_totext(isc_result));
isc_mem_destroy(&mctx);
DESTROYLOCK(&T11_mx);
- isc_condition_destroy(&T11_cv);
+ (void) isc_condition_destroy(&T11_cv);
return(T_UNRESOLVED);
}
@@ -1871,7 +1922,7 @@ t_tasks11(int purgable) {
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T11_mx);
- isc_condition_destroy(&T11_cv);
+ (void) isc_condition_destroy(&T11_cv);
return(T_UNRESOLVED);
}
@@ -1883,7 +1934,7 @@ t_tasks11(int purgable) {
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T11_mx);
- isc_condition_destroy(&T11_cv);
+ (void) isc_condition_destroy(&T11_cv);
return(T_UNRESOLVED);
}
@@ -1892,11 +1943,28 @@ t_tasks11(int purgable) {
*/
event1 = isc_event_allocate(mctx, (void *)1, (isc_eventtype_t)1,
t11_event1, NULL, sizeof(*event1));
-
+ if (event1 == NULL) {
+ t_info("isc_event_allocate failed\n");
+ isc_task_destroy(&task);
+ isc_taskmgr_destroy(&tmgr);
+ isc_mem_destroy(&mctx);
+ DESTROYLOCK(&T11_mx);
+ (void) isc_condition_destroy(&T11_cv);
+ return(T_UNRESOLVED);
+ }
isc_task_send(task, &event1);
event2 = isc_event_allocate(mctx, (void *)1, (isc_eventtype_t)1,
t11_event2, NULL, sizeof(*event2));
+ if (event2 == NULL) {
+ t_info("isc_event_allocate failed\n");
+ isc_task_destroy(&task);
+ isc_taskmgr_destroy(&tmgr);
+ isc_mem_destroy(&mctx);
+ DESTROYLOCK(&T11_mx);
+ (void) isc_condition_destroy(&T11_cv);
+ return(T_UNRESOLVED);
+ }
event2_clone = event2;
if (purgable)
event2->ev_attributes &= ~ISC_EVENTATTR_NOPURGE;
@@ -1966,7 +2034,7 @@ t_tasks11(int purgable) {
isc_taskmgr_destroy(&tmgr);
isc_mem_destroy(&mctx);
DESTROYLOCK(&T11_mx);
- isc_condition_destroy(&T11_cv);
+ (void) isc_condition_destroy(&T11_cv);
if (T11_eventcnt != (purgable ? 0 : 1)) {
t_info("Event was %s purged\n",
diff --git a/external/bsd/bind/dist/bin/tests/timers/t_timers.c b/external/bsd/bind/dist/bin/tests/timers/t_timers.c
index f1ab5c4aa80..5902b78bcec 100644
--- a/external/bsd/bind/dist/bin/tests/timers/t_timers.c
+++ b/external/bsd/bind/dist/bin/tests/timers/t_timers.c
@@ -1,7 +1,7 @@
-/* $NetBSD: t_timers.c,v 1.2 2011/02/16 03:46:53 christos Exp $ */
+/* $NetBSD: t_timers.c,v 1.3 2011/09/11 18:55:32 christos Exp $ */
/*
- * Copyright (C) 2004, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: t_timers.c,v 1.30 2009-01-22 23:47:54 tbox Exp */
+/* Id: t_timers.c,v 1.33 2011-03-14 14:13:10 fdupont Exp */
#include <config.h>
@@ -65,8 +65,8 @@ static void
tx_sde(isc_task_t *task, isc_event_t *event) {
isc_result_t isc_result;
- task = task;
- event = event;
+ UNUSED(task);
+ UNUSED(event);
/*
* Signal shutdown processing complete.
@@ -239,7 +239,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
t_info("isc_taskmgr_create failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&Tx_mx);
- isc_condition_destroy(&Tx_cv);
+ (void) isc_condition_destroy(&Tx_cv);
isc_mem_destroy(&mctx);
++Tx_nprobs;
return;
@@ -252,7 +252,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
isc_result_totext(isc_result));
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&Tx_mx);
- isc_condition_destroy(&Tx_cv);
+ (void) isc_condition_destroy(&Tx_cv);
isc_mem_destroy(&mctx);
++Tx_nprobs;
return;
@@ -265,7 +265,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
isc_timermgr_destroy(&timermgr);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&Tx_mx);
- isc_condition_destroy(&Tx_cv);
+ (void) isc_condition_destroy(&Tx_cv);
isc_mem_destroy(&mctx);
++Tx_nprobs;
return;
@@ -279,7 +279,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
isc_timermgr_destroy(&timermgr);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&Tx_mx);
- isc_condition_destroy(&Tx_cv);
+ (void) isc_condition_destroy(&Tx_cv);
isc_mem_destroy(&mctx);
++Tx_nprobs;
return;
@@ -293,7 +293,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
isc_task_destroy(&task);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&Tx_mx);
- isc_condition_destroy(&Tx_cv);
+ (void) isc_condition_destroy(&Tx_cv);
isc_mem_destroy(&mctx);
++Tx_nprobs;
return;
@@ -305,7 +305,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
isc_task_destroy(&task);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&Tx_mx);
- isc_condition_destroy(&Tx_cv);
+ (void) isc_condition_destroy(&Tx_cv);
isc_mem_destroy(&mctx);
++Tx_nprobs;
return;
@@ -321,7 +321,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
isc_task_destroy(&task);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&Tx_mx);
- isc_condition_destroy(&Tx_cv);
+ (void) isc_condition_destroy(&Tx_cv);
isc_mem_destroy(&mctx);
++Tx_nprobs;
return;
@@ -350,7 +350,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
isc_taskmgr_destroy(&tmgr);
isc_timermgr_destroy(&timermgr);
DESTROYLOCK(&Tx_mx);
- isc_condition_destroy(&Tx_cv);
+ (void) isc_condition_destroy(&Tx_cv);
isc_mem_destroy(&mctx);
}
@@ -778,7 +778,7 @@ t5_tick_event(isc_task_t *task, isc_event_t *event) {
isc_time_t expires;
isc_interval_t interval;
- task = task;
+ UNUSED(task);
++T5_eventcnt;
t_info("t5_tick_event %d\n", T5_eventcnt);
@@ -931,7 +931,7 @@ t_timers5(void) {
t_info("isc_taskmgr_create failed %s\n",
isc_result_totext(isc_result));
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -943,7 +943,7 @@ t_timers5(void) {
isc_result_totext(isc_result));
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -956,7 +956,7 @@ t_timers5(void) {
isc_timermgr_destroy(&timermgr);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -969,7 +969,7 @@ t_timers5(void) {
isc_task_destroy(&T5_task1);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -983,7 +983,7 @@ t_timers5(void) {
isc_task_destroy(&T5_task1);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -995,7 +995,7 @@ t_timers5(void) {
isc_timermgr_destroy(&timermgr);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -1020,7 +1020,7 @@ t_timers5(void) {
isc_task_destroy(&T5_task2);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -1037,7 +1037,7 @@ t_timers5(void) {
isc_task_destroy(&T5_task2);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
return(T_UNRESOLVED);
}
@@ -1056,7 +1056,7 @@ t_timers5(void) {
isc_task_destroy(&T5_task2);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
++T5_nprobs;
return(T_UNRESOLVED);
@@ -1093,7 +1093,7 @@ t_timers5(void) {
isc_task_destroy(&T5_task2);
isc_taskmgr_destroy(&tmgr);
DESTROYLOCK(&T5_mx);
- isc_condition_destroy(&T5_cv);
+ (void) isc_condition_destroy(&T5_cv);
isc_mem_destroy(&mctx);
result = T_UNRESOLVED;
diff --git a/external/bsd/bind/dist/bin/tools/genrandom.8 b/external/bsd/bind/dist/bin/tools/genrandom.8
index fc6aa3047c1..f459375ff0a 100644
--- a/external/bsd/bind/dist/bin/tools/genrandom.8
+++ b/external/bsd/bind/dist/bin/tools/genrandom.8
@@ -1,6 +1,6 @@
-.\" $NetBSD: genrandom.8,v 1.2 2011/02/16 03:46:54 christos Exp $
+.\" $NetBSD: genrandom.8,v 1.3 2011/09/11 18:55:32 christos Exp $
.\"
-.\" Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" Id: genrandom.8,v 1.8 2010-05-19 01:14:14 tbox Exp
+.\" Id: genrandom.8,v 1.9 2011-08-09 01:14:53 tbox Exp
.\"
.hy 0
.ad l
@@ -55,7 +55,7 @@ size
The size of the file, in kilobytes, to generate.
.RE
.PP
-domain
+filename
.RS 4
The file name into which random data should be written.
.RE
@@ -67,5 +67,5 @@ The file name into which random data should be written.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009\-2011 Internet Systems Consortium, Inc. ("ISC")
.br
diff --git a/external/bsd/bind/dist/bin/tools/nsec3hash.c b/external/bsd/bind/dist/bin/tools/nsec3hash.c
index 31102760466..6c48c80cb23 100644
--- a/external/bsd/bind/dist/bin/tools/nsec3hash.c
+++ b/external/bsd/bind/dist/bin/tools/nsec3hash.c
@@ -1,4 +1,4 @@
-/* $NetBSD: nsec3hash.c,v 1.2 2011/02/16 03:46:54 christos Exp $ */
+/* $NetBSD: nsec3hash.c,v 1.3 2011/09/11 18:55:32 christos Exp $ */
/*
* Copyright (C) 2006, 2008, 2009 Internet Systems Consortium, Inc. ("ISC")
@@ -61,7 +61,7 @@ check_result(isc_result_t result, const char *message) {
}
static void
-usage() {
+usage(void) {
fatal("salt hash iterations domain");
}
diff --git a/external/bsd/bind/dist/config.h.in b/external/bsd/bind/dist/config.h.in
index 53a8f350d9c..b20df970445 100644
--- a/external/bsd/bind/dist/config.h.in
+++ b/external/bsd/bind/dist/config.h.in
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: config.h.in,v 1.143.8.1 2011-02-03 05:52:35 marka Exp */
+/* Id: config.h.in,v 1.147 2011-07-28 13:33:09 tbox Exp */
/*! \file */
@@ -150,6 +150,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to enable the "filter-aaaa-on-v4" option. */
#undef ALLOW_FILTER_AAAA_ON_V4
+/* define if ATF unit tests are to be built. */
+#undef ATF_TEST
+
/* Define if recvmsg() does not meet all of the BSD socket API specifications.
*/
#undef BROKEN_RECVMSG
@@ -241,9 +244,6 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to 1 if you have the `c_r' library (-lc_r). */
#undef HAVE_LIBC_R
-/* Define to 1 if you have the `dl' library (-ldl). */
-#undef HAVE_LIBDL
-
/* Define to 1 if you have the `nsl' library (-lnsl). */
#undef HAVE_LIBNSL
@@ -352,6 +352,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to 1 if you have the <unistd.h> header file. */
#undef HAVE_UNISTD_H
+/* Define to 1 if you have the `usleep' function. */
+#undef HAVE_USLEEP
+
/* return type of gai_strerror */
#undef IRS_GAISTRERROR_RETURN_T
@@ -361,6 +364,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to the flags type used by getnameinfo(3). */
#undef IRS_GETNAMEINFO_FLAGS_T
+/* Define to allow building of objects for dlopen(). */
+#undef ISC_DLZ_DLOPEN
+
/* Defined if extern char *optarg is not declared. */
#undef NEED_OPTARG
@@ -390,6 +396,9 @@ int sigwait(const unsigned int *set, int *sig);
(O_NDELAY/O_NONBLOCK). */
#undef PORT_NONBLOCK
+/* The size of `void *', as computed by sizeof. */
+#undef SIZEOF_VOID_P
+
/* Define to 1 if you have the ANSI C header files. */
#undef STDC_HEADERS
diff --git a/external/bsd/bind/dist/contrib/dlz/drivers/dlz_dlopen_driver.c b/external/bsd/bind/dist/contrib/dlz/drivers/dlz_dlopen_driver.c
index 734db8184e9..5b6e0ccc594 100644
--- a/external/bsd/bind/dist/contrib/dlz/drivers/dlz_dlopen_driver.c
+++ b/external/bsd/bind/dist/contrib/dlz/drivers/dlz_dlopen_driver.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dlz_dlopen_driver.c,v 1.2 2011/02/16 03:46:55 christos Exp $ */
+/* $NetBSD: dlz_dlopen_driver.c,v 1.3 2011/09/11 18:55:32 christos Exp $ */
/*
* Copyright (C) 2010 Andrew Tridgell
diff --git a/external/bsd/bind/dist/contrib/dlz/drivers/dlz_drivers.c b/external/bsd/bind/dist/contrib/dlz/drivers/dlz_drivers.c
index a2236963df0..8f612ad416b 100644
--- a/external/bsd/bind/dist/contrib/dlz/drivers/dlz_drivers.c
+++ b/external/bsd/bind/dist/contrib/dlz/drivers/dlz_drivers.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dlz_drivers.c,v 1.2 2011/02/16 03:46:55 christos Exp $ */
+/* $NetBSD: dlz_drivers.c,v 1.3 2011/09/11 18:55:32 christos Exp $ */
/*
* Copyright (C) 2005 Internet Systems Consortium, Inc. ("ISC")
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dlz_drivers.c,v 1.3 2010-12-18 01:56:20 each Exp */
+/* Id: dlz_drivers.c,v 1.4 2011-03-10 04:36:16 each Exp */
/*! \file */
@@ -63,10 +63,6 @@
#include <dlz/dlz_odbc_driver.h>
#endif
-#ifdef DLZ_DLOPEN
-#include <dlz/dlz_dlopen_driver.h>
-#endif
-
/*%
* Call init functions for all relevant DLZ drivers.
*/
@@ -121,12 +117,6 @@ dlz_drivers_init(void) {
return (result);
#endif
-#ifdef DLZ_DLOPEN
- result = dlz_dlopen_init();
- if (result != ISC_R_SUCCESS)
- return (result);
-#endif
-
return (result);
}
@@ -166,8 +156,4 @@ dlz_drivers_clear(void) {
dlz_odbc_clear();
#endif
-#ifdef DLZ_DLOPEN
- dlz_dlopen_clear();
-#endif
-
}
diff --git a/external/bsd/bind/dist/contrib/dlz/drivers/dlz_ldap_driver.c b/external/bsd/bind/dist/contrib/dlz/drivers/dlz_ldap_driver.c
index ffa565aa3c8..a330cfdff25 100644
--- a/external/bsd/bind/dist/contrib/dlz/drivers/dlz_ldap_driver.c
+++ b/external/bsd/bind/dist/contrib/dlz/drivers/dlz_ldap_driver.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dlz_ldap_driver.c,v 1.2 2011/02/16 03:46:55 christos Exp $ */
+/* $NetBSD: dlz_ldap_driver.c,v 1.3 2011/09/11 18:55:32 christos Exp $ */
/*
* Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
@@ -17,7 +17,7 @@
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
* USE OR PERFORMANCE OF THIS SOFTWARE.
*
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * The development of Dynamically Loadable Zones (DLZ) for BIND 9 was
* conceived and contributed by Rob Butler.
*
* Permission to use, copy, modify, and distribute this software for any
@@ -104,7 +104,6 @@ static dns_sdlzimplementation_t *dlz_ldap = NULL;
*/
typedef struct {
-
#ifdef ISC_PLATFORM_USETHREADS
db_list_t *db; /*%< handle to a list of DB */
#else
@@ -115,7 +114,6 @@ typedef struct {
char *cred; /*%< password for simple authentication method */
int protocol; /*%< LDAP communication protocol version */
char *hosts; /*%< LDAP server hosts */
-
} ldap_instance_t;
/* forward references */
@@ -131,10 +129,8 @@ dlz_ldap_destroy(void *driverarg, void *dbdata);
*/
/*% checks that the LDAP URL parameters make sense */
-
static isc_result_t
dlz_ldap_checkURL(char *URL, int attrCnt, const char *msg) {
-
isc_result_t result = ISC_R_SUCCESS;
int ldap_result;
LDAPURLDesc *ldap_url = NULL;
@@ -201,17 +197,15 @@ dlz_ldap_checkURL(char *URL, int attrCnt, const char *msg) {
}
cleanup:
-
if (ldap_url != NULL)
ldap_free_urldesc(ldap_url);
- return result;
+ return (result);
}
-/*% Connects / reconnects to LDAP server */
+/*% Connects / reconnects to LDAP server */
static isc_result_t
dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
-
isc_result_t result;
int ldap_result;
@@ -226,7 +220,7 @@ dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
/* initialize. */
dbc->dbconn = ldap_init(dbi->hosts, LDAP_PORT);
if (dbc->dbconn == NULL)
- return ISC_R_NOMEMORY;
+ return (ISC_R_NOMEMORY);
/* set protocol version. */
ldap_result = ldap_set_option((LDAP *) dbc->dbconn,
@@ -245,7 +239,7 @@ dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
goto cleanup;
}
- return ISC_R_SUCCESS;
+ return (ISC_R_SUCCESS);
cleanup:
@@ -255,7 +249,7 @@ dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
dbc->dbconn = NULL;
}
- return result;
+ return (result);
}
#ifdef ISC_PLATFORM_USETHREADS
@@ -267,9 +261,7 @@ dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
* multithreaded operation.
*/
static void
-ldap_destroy_dblist(db_list_t *dblist)
-{
-
+ldap_destroy_dblist(db_list_t *dblist) {
dbinstance_t *ndbi = NULL;
dbinstance_t *dbi = NULL;
@@ -301,10 +293,8 @@ ldap_destroy_dblist(db_list_t *dblist)
* This function is only used when the driver is compiled for
* multithreaded operation.
*/
-
static dbinstance_t *
-ldap_find_avail_conn(db_list_t *dblist)
-{
+ldap_find_avail_conn(db_list_t *dblist) {
dbinstance_t *dbi = NULL;
dbinstance_t *head;
int count = 0;
@@ -316,7 +306,7 @@ ldap_find_avail_conn(db_list_t *dblist)
while (count < dbc_search_limit) {
/* try to lock on the mutex */
if (isc_mutex_trylock(&dbi->instance_lock) == ISC_R_SUCCESS)
- return dbi; /* success, return the DBI for use. */
+ return (dbi); /* success, return the DBI for use. */
/* not successful, keep trying */
dbi = ISC_LIST_NEXT(dbi, link);
@@ -332,9 +322,8 @@ ldap_find_avail_conn(db_list_t *dblist)
"LDAP driver unable to find available connection "
"after searching %d times",
count);
- return NULL;
+ return (NULL);
}
-
#endif /* ISC_PLATFORM_USETHREADS */
static isc_result_t
@@ -363,12 +352,11 @@ ldap_process_results(LDAP *dbc, LDAPMessage *msg, char ** attrs,
isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
DNS_LOGMODULE_DLZ, ISC_LOG_INFO,
"LDAP no entries to process.");
- return ISC_R_FAILURE;
+ return (ISC_R_FAILURE);
}
/* loop through all entries returned */
while (entry != NULL) {
-
/* reset for this loop */
ttl = 0;
len = 0;
@@ -376,7 +364,7 @@ ldap_process_results(LDAP *dbc, LDAPMessage *msg, char ** attrs,
attribute = attrs[i];
/* determine how much space we need for data string */
- for (j=0; attrs[j] != NULL; j++) {
+ for (j = 0; attrs[j] != NULL; j++) {
/* get the list of values for this attribute. */
vals = ldap_get_values(dbc, entry, attrs[j]);
/* skip empty attributes. */
@@ -389,7 +377,7 @@ ldap_process_results(LDAP *dbc, LDAPMessage *msg, char ** attrs,
len = len + strlen(vals[0]) + 1;
/* free vals for next loop */
ldap_value_free(vals);
- } /* end for (j=0; attrs[j] != NULL, j++) loop */
+ } /* end for (j = 0; attrs[j] != NULL, j++) loop */
/* allocate memory for data string */
data = isc_mem_allocate(ns_g_mctx, len + 1);
@@ -413,7 +401,6 @@ ldap_process_results(LDAP *dbc, LDAPMessage *msg, char ** attrs,
/* loop through the attributes in the order specified. */
while (attribute != NULL) {
-
/* get the list of values for this attribute. */
vals = ldap_get_values(dbc, entry, attribute);
@@ -488,18 +475,20 @@ ldap_process_results(LDAP *dbc, LDAPMessage *msg, char ** attrs,
isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
"LDAP driver unable "
- "to retrieve dns type");
+ "to retrieve DNS type");
result = ISC_R_FAILURE;
goto cleanup;
}
+
if (strlen(data) < 1) {
isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
"LDAP driver unable "
- "to retrieve dns data");
+ "to retrieve DNS data");
result = ISC_R_FAILURE;
goto cleanup;
}
+
if (allnodes == isc_boolean_true) {
if (strcasecmp(host, "~") == 0)
result = dns_sdlz_putnamedrr(
@@ -509,16 +498,32 @@ ldap_process_results(LDAP *dbc, LDAPMessage *msg, char ** attrs,
result = dns_sdlz_putnamedrr(
(dns_sdlzallnodes_t *) ptr,
host, type, ttl, data);
- }
- else
+ if (result != ISC_R_SUCCESS)
+ isc_log_write(dns_lctx,
+ DNS_LOGCATEGORY_DATABASE,
+ DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
+ "dlz-ldap: putnamedrr failed "
+ "for \"%s %s %u %s\", %s",
+ host, type, ttl, data,
+ isc_result_totext(result));
+ } else {
result = dns_sdlz_putrr((dns_sdlzlookup_t *) ptr,
type, ttl, data);
+ if (result != ISC_R_SUCCESS)
+ isc_log_write(dns_lctx,
+ DNS_LOGCATEGORY_DATABASE,
+ DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
+ "dlz-ldap: putrr failed "
+ "for \"%s %u %s\", %s",
+ type, ttl, data,
+ isc_result_totext(result));
+ }
if (result != ISC_R_SUCCESS) {
isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
"LDAP driver failed "
- "while sending data to Bind.");
+ "while sending data to BIND.");
goto cleanup;
}
@@ -533,7 +538,6 @@ ldap_process_results(LDAP *dbc, LDAPMessage *msg, char ** attrs,
} /* end while (entry != NULL) */
cleanup:
-
/* de-allocate memory */
if (vals != NULL)
ldap_value_free(vals);
@@ -544,7 +548,7 @@ ldap_process_results(LDAP *dbc, LDAPMessage *msg, char ** attrs,
if (data != NULL)
isc_mem_free(ns_g_mctx, data);
- return result;
+ return (result);
}
/*%
@@ -592,7 +596,7 @@ ldap_get_results(const char *zone, const char *record,
/* if DBI is null, can't do anything else */
if (dbi == NULL)
- return ISC_R_FAILURE;
+ return (ISC_R_FAILURE);
/* set fields */
if (zone != NULL) {
@@ -721,7 +725,7 @@ ldap_get_results(const char *zone, const char *record,
goto cleanup;
}
- for (i=0; i < 3; i++) {
+ for (i = 0; i < 3; i++) {
/*
* dbi->dbconn may be null if trying to reconnect on a
@@ -786,7 +790,7 @@ ldap_get_results(const char *zone, const char *record,
goto cleanup;
break;
} /* close switch(ldap_result) */
- } /* end for (int i=0 i < 3; i++) */
+ } /* end for (int i = 0 i < 3; i++) */
if (result != ISC_R_SUCCESS)
goto cleanup;
@@ -832,7 +836,6 @@ ldap_get_results(const char *zone, const char *record,
result = ISC_R_UNEXPECTED;
}
-
cleanup:
/* it's always good to cleanup after yourself */
@@ -863,13 +866,12 @@ ldap_get_results(const char *zone, const char *record,
isc_mem_free(ns_g_mctx, querystring );
/* return result */
- return result;
+ return (result);
}
/*
* DLZ methods
*/
-
static isc_result_t
dlz_ldap_allowzonexfr(void *driverarg, void *dbdata, const char *name,
const char *client)
@@ -881,11 +883,12 @@ dlz_ldap_allowzonexfr(void *driverarg, void *dbdata, const char *name,
/* check to see if we are authoritative for the zone first */
result = dlz_ldap_findzone(driverarg, dbdata, name);
if (result != ISC_R_SUCCESS) {
- return result;
+ return (result);
}
/* get all the zone data */
- return ldap_get_results(name, NULL, client, ALLOWXFR, dbdata, NULL);
+ result = ldap_get_results(name, NULL, client, ALLOWXFR, dbdata, NULL);
+ return (result);
}
static isc_result_t
@@ -893,7 +896,7 @@ dlz_ldap_allnodes(const char *zone, void *driverarg, void *dbdata,
dns_sdlzallnodes_t *allnodes)
{
UNUSED(driverarg);
- return ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata, allnodes);
+ return (ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata, allnodes));
}
static isc_result_t
@@ -901,27 +904,29 @@ dlz_ldap_authority(const char *zone, void *driverarg, void *dbdata,
dns_sdlzlookup_t *lookup)
{
UNUSED(driverarg);
- return ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata, lookup);
+ return (ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata, lookup));
}
static isc_result_t
-dlz_ldap_findzone(void *driverarg, void *dbdata, const char *name)
-{
+dlz_ldap_findzone(void *driverarg, void *dbdata, const char *name) {
UNUSED(driverarg);
- return ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL);
+ return (ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL));
}
static isc_result_t
dlz_ldap_lookup(const char *zone, const char *name, void *driverarg,
void *dbdata, dns_sdlzlookup_t *lookup)
{
+ isc_result_t result;
UNUSED(driverarg);
+
if (strcmp(name, "*") == 0)
- return ldap_get_results(zone, "~", NULL,
- LOOKUP, dbdata, lookup);
+ result = ldap_get_results(zone, "~", NULL, LOOKUP,
+ dbdata, lookup);
else
- return ldap_get_results(zone, name, NULL,
- LOOKUP, dbdata, lookup);
+ result = ldap_get_results(zone, name, NULL, LOOKUP,
+ dbdata, lookup);
+ return (result);
}
@@ -929,7 +934,6 @@ static isc_result_t
dlz_ldap_create(const char *dlzname, unsigned int argc, char *argv[],
void *driverarg, void **dbdata)
{
-
isc_result_t result;
ldap_instance_t *ldap_inst = NULL;
dbinstance_t *dbi = NULL;
@@ -1025,24 +1029,24 @@ dlz_ldap_create(const char *dlzname, unsigned int argc, char *argv[],
case 12:
result = dlz_ldap_checkURL(argv[11], 0, "allow zone transfer");
if (result != ISC_R_SUCCESS)
- return result;
+ return (result);
case 11:
result = dlz_ldap_checkURL(argv[10], 3, "all nodes");
if (result != ISC_R_SUCCESS)
- return result;
+ return (result);
case 10:
if (strlen(argv[9]) > 0) {
result = dlz_ldap_checkURL(argv[9], 3, "authority");
if (result != ISC_R_SUCCESS)
- return result;
+ return (result);
}
case 9:
result = dlz_ldap_checkURL(argv[8], 3, "lookup");
if (result != ISC_R_SUCCESS)
- return result;
+ return (result);
result = dlz_ldap_checkURL(argv[7], 0, "find zone");
if (result != ISC_R_SUCCESS)
- return result;
+ return (result);
break;
default:
/* not really needed, should shut up compiler. */
@@ -1234,36 +1238,28 @@ dlz_ldap_create(const char *dlzname, unsigned int argc, char *argv[],
return(ISC_R_SUCCESS);
cleanup:
-
dlz_ldap_destroy(NULL, ldap_inst);
return(ISC_R_FAILURE);
}
void
-dlz_ldap_destroy(void *driverarg, void *dbdata)
-{
-
+dlz_ldap_destroy(void *driverarg, void *dbdata) {
UNUSED(driverarg);
if (dbdata != NULL) {
-
#ifdef ISC_PLATFORM_USETHREADS
-
/* cleanup the list of DBI's */
ldap_destroy_dblist((db_list_t *)
((ldap_instance_t *)dbdata)->db);
#else /* ISC_PLATFORM_USETHREADS */
-
- /* release connection */
if (((ldap_instance_t *)dbdata)->db->dbconn != NULL)
ldap_unbind_s((LDAP *)
((ldap_instance_t *)dbdata)->db->dbconn);
/* destroy single DB instance */
destroy_sqldbinstance(((ldap_instance_t *)dbdata)->db);
-
#endif /* ISC_PLATFORM_USETHREADS */
if (((ldap_instance_t *)dbdata)->hosts != NULL)
@@ -1324,8 +1320,7 @@ dlz_ldap_init(void) {
result = ISC_R_UNEXPECTED;
}
-
- return result;
+ return (result);
}
/*%
@@ -1333,7 +1328,6 @@ dlz_ldap_init(void) {
*/
void
dlz_ldap_clear(void) {
-
/*
* Write debugging message to log
*/
diff --git a/external/bsd/bind/dist/contrib/dlz/drivers/include/dlz/dlz_dlopen_driver.h b/external/bsd/bind/dist/contrib/dlz/drivers/include/dlz/dlz_dlopen_driver.h
index 74b61d882ae..a3ecbeb36c6 100644
--- a/external/bsd/bind/dist/contrib/dlz/drivers/include/dlz/dlz_dlopen_driver.h
+++ b/external/bsd/bind/dist/contrib/dlz/drivers/include/dlz/dlz_dlopen_driver.h
@@ -1,55 +1 @@
-/* $NetBSD: dlz_dlopen_driver.h,v 1.2 2011/02/16 03:46:55 christos Exp $ */
-
-/*
- * Copyright (C) 2010 Andrew Tridgell
- *
- * based on dlz_stub_driver.h
- * which is:
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- * Copyright (C) 1999-2001 Internet Software Consortium.
- * see dlz_stub_driver.h for details
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_DLOPEN_DRIVER_H
-#define DLZ_DLOPEN_DRIVER_H
-
-isc_result_t
-dlz_dlopen_init(void);
-
-void
-dlz_dlopen_clear(void);
-
-#define DLZ_DLOPEN_VERSION 1
-
-#endif
+/* $NetBSD: dlz_dlopen_driver.h,v 1.3 2011/09/11 18:55:32 christos Exp $ */
diff --git a/external/bsd/bind/dist/doc/draft/draft-ietf-dnsext-rfc2671bis-edns0-02.txt b/external/bsd/bind/dist/doc/draft/draft-ietf-dnsext-rfc2671bis-edns0-02.txt
deleted file mode 100644
index ba1b4147f4d..00000000000
--- a/external/bsd/bind/dist/doc/draft/draft-ietf-dnsext-rfc2671bis-edns0-02.txt
+++ /dev/null
@@ -1,616 +0,0 @@
-
-
-
-DNSEXT Working Group M. Graff
-Internet-Draft P. Vixie
-Obsoletes: 2671 (if approved) Internet Systems Consortium
-Intended status: Standards Track July 28, 2009
-Expires: January 29, 2010
-
-
- Extension Mechanisms for DNS (EDNS0)
- draft-ietf-dnsext-rfc2671bis-edns0-02
-
-Status of this Memo
-
- This Internet-Draft is submitted to IETF in full conformance with the
- provisions of BCP 78 and BCP 79.
-
- Internet-Drafts are working documents of the Internet Engineering
- Task Force (IETF), its areas, and its working groups. Note that
- other groups may also distribute working documents as Internet-
- Drafts.
-
- Internet-Drafts are draft documents valid for a maximum of six months
- and may be updated, replaced, or obsoleted by other documents at any
- time. It is inappropriate to use Internet-Drafts as reference
- material or to cite them other than as "work in progress."
-
- The list of current Internet-Drafts can be accessed at
- http://www.ietf.org/ietf/1id-abstracts.txt.
-
- The list of Internet-Draft Shadow Directories can be accessed at
- http://www.ietf.org/shadow.html.
-
- This Internet-Draft will expire on January 29, 2010.
-
-Copyright Notice
-
- Copyright (c) 2009 IETF Trust and the persons identified as the
- document authors. All rights reserved.
-
- This document is subject to BCP 78 and the IETF Trust's Legal
- Provisions Relating to IETF Documents in effect on the date of
- publication of this document (http://trustee.ietf.org/license-info).
- Please review these documents carefully, as they describe your rights
- and restrictions with respect to this document.
-
-Abstract
-
- The Domain Name System's wire protocol includes a number of fixed
- fields whose range has been or soon will be exhausted and does not
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 1]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
- allow requestors to advertise their capabilities to responders. This
- document describes backward compatible mechanisms for allowing the
- protocol to grow.
-
- This document updates the EDNS0 specification based on 10 years of
- operational experience.
-
-
-Table of Contents
-
- 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
- 2. Requirements Language . . . . . . . . . . . . . . . . . . . . 3
- 3. EDNS Support Requirement . . . . . . . . . . . . . . . . . . . 3
- 4. Affected Protocol Elements . . . . . . . . . . . . . . . . . . 3
- 4.1. Message Header . . . . . . . . . . . . . . . . . . . . . . 3
- 4.2. Label Types . . . . . . . . . . . . . . . . . . . . . . . 4
- 4.3. UDP Message Size . . . . . . . . . . . . . . . . . . . . . 4
- 5. Extended Label Types . . . . . . . . . . . . . . . . . . . . . 4
- 6. OPT pseudo-RR . . . . . . . . . . . . . . . . . . . . . . . . 4
- 6.1. OPT Record Behavior . . . . . . . . . . . . . . . . . . . 4
- 6.2. OPT Record Format . . . . . . . . . . . . . . . . . . . . 5
- 6.3. Requestor's Payload Size . . . . . . . . . . . . . . . . . 6
- 6.4. Responder's Payload Size . . . . . . . . . . . . . . . . . 6
- 6.5. Payload Size Selection . . . . . . . . . . . . . . . . . . 7
- 6.6. Middleware Boxes . . . . . . . . . . . . . . . . . . . . . 7
- 6.7. Extended RCODE . . . . . . . . . . . . . . . . . . . . . . 7
- 6.8. OPT Options Type Allocation Procedure . . . . . . . . . . 8
- 7. Transport Considerations . . . . . . . . . . . . . . . . . . . 8
- 8. Security Considerations . . . . . . . . . . . . . . . . . . . 9
- 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
- 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10
- 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
- 11.1. Normative References . . . . . . . . . . . . . . . . . . . 10
- 11.2. Informative References . . . . . . . . . . . . . . . . . . 10
- Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 10
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 2]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
-1. Introduction
-
- DNS [RFC1035] specifies a Message Format and within such messages
- there are standard formats for encoding options, errors, and name
- compression. The maximum allowable size of a DNS Message is fixed.
- Many of DNS's protocol limits are too small for uses which are or
- which are desired to become common. There is no way for
- implementations to advertise their capabilities.
-
- Unextended agents will not know how to interpret the protocol
- extensions detailed here. In practice, these clients will be
- upgraded when they have need of a new feature, and only new features
- will make use of the extensions. Extended agents must be prepared
- for behaviour of unextended clients in the face of new protocol
- elements, and fall back gracefully to unextended DNS. [RFC2671]
- originally proposed extensions to the basic DNS protocol to overcome
- these deficiencies. This memo refines that specification and
- obsoletes [RFC2671].
-
-
-2. Requirements Language
-
- The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
- "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
- document are to be interpreted as described in RFC 2119 [RFC2119].
-
-
-3. EDNS Support Requirement
-
- EDNS support is manditory in a modern world. DNSSEC requires EDNS
- support, and many other featres are made possible only by EDNS
- support to request or advertise them.
-
-
-4. Affected Protocol Elements
-
-4.1. Message Header
-
- The DNS Message Header's (see , section 4.1.1 [RFC1035]) second full
- 16-bit word is divided into a 4-bit OPCODE, a 4-bit RCODE, and a
- number of 1-bit flags. The original reserved Z bits have been
- allocated to various purposes, and most of the RCODE values are now
- in use. More flags and more possible RCODEs are needed. The OPT
- pseudo-RR specified below contains subfields that carry a bit field
- extension of the RCODE field and additional flag bits, respectively.
-
-
-
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 3]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
-4.2. Label Types
-
- The first two bits of a wire format domain label are used to denote
- the type of the label. ,section 4.1.4 [RFC1035] allocates two of the
- four possible types and reserves the other two. More label types
- were proposed in [RFC2671] section 3.
-
-4.3. UDP Message Size
-
- DNS Messages are limited to 512 octets in size when sent over UDP.
- While the minimum maximum reassembly buffer size still allows a limit
- of 512 octets of UDP payload, most of the hosts now connected to the
- Internet are able to reassemble larger datagrams. Some mechanism
- must be created to allow requestors to advertise larger buffer sizes
- to responders. To this end, the OPT pseudo-RR specified below
- contains a maximum payload size field.
-
-
-5. Extended Label Types
-
- The first octet in the on-the-wire representation of a DNS label
- specifies the label type; the basic DNS specification [RFC1035]
- dedicates the two most significant bits of that octet for this
- purpose.
-
- This document reserves DNS label type 0b01 for use as an indication
- for Extended Label Types. A specific extended label type is selected
- by the 6 least significant bits of the first octet. Thus, Extended
- Label Types are indicated by the values 64-127 (0b01xxxxxx) in the
- first octet of the label.
-
- This document does not describe any specific Extended Label Type.
-
- In practice, Extended Label Types are difficult to use due to support
- in clients and intermediate gateways. Therefore, the registry of
- Extended Label Types is requested to be closed. They cause
- interoperability problems and at present no defined label types are
- in use.
-
-
-6. OPT pseudo-RR
-
-6.1. OPT Record Behavior
-
- One OPT pseudo-RR (RR type 41) MAY be added to the additional data
- section of a request. If present in requests, compliant responders
- which implement EDNS MUST include an OPT record in non-truncated
- responses, and SHOULD attempt to include them in all responses. An
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 4]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
- OPT is called a pseudo-RR because it pertains to a particular
- transport level message and not to any actual DNS data. OPT RRs MUST
- NOT be cached, forwarded, or stored in or loaded from master files.
- The quantity of OPT pseudo-RRs per message MUST be either zero or
- one, but not greater.
-
-6.2. OPT Record Format
-
- An OPT RR has a fixed part and a variable set of options expressed as
- {attribute, value} pairs. The fixed part holds some DNS meta data
- and also a small collection of basic extension elements which we
- expect to be so popular that it would be a waste of wire space to
- encode them as {attribute, value} pairs.
-
- The fixed part of an OPT RR is structured as follows:
-
- +------------+--------------+------------------------------+
- | Field Name | Field Type | Description |
- +------------+--------------+------------------------------+
- | NAME | domain name | empty (root domain) |
- | TYPE | u_int16_t | OPT |
- | CLASS | u_int16_t | requestor's UDP payload size |
- | TTL | u_int32_t | extended RCODE and flags |
- | RDLEN | u_int16_t | describes RDATA |
- | RDATA | octet stream | {attribute,value} pairs |
- +------------+--------------+------------------------------+
-
- OPT RR Format
-
- The variable part of an OPT RR is encoded in its RDATA and is
- structured as zero or more of the following:
-
-
- +0 (MSB) +1 (LSB)
- +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
- 0: | OPTION-CODE |
- +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
- 2: | OPTION-LENGTH |
- +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
- 4: | |
- / OPTION-DATA /
- / /
- +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
-
-
-
-
-
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 5]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
- OPTION-CODE
- Assigned by Expert Review.
-
- OPTION-LENGTH
- Size (in octets) of OPTION-DATA.
-
- OPTION-DATA
- Varies per OPTION-CODE.
-
- Order of appearance of option tuples is never relevant. Any option
- whose meaning is affected by other options is so affected no matter
- which one comes first in the OPT RDATA.
-
- Any OPTION-CODE values not understood by a responder or requestor
- MUST be ignored. Specifications of such options might wish to
- include some kind of signalled acknowledgement. For example, an
- option specification might say that if a responder sees option XYZ,
- it SHOULD include option XYZ in its response.
-
-6.3. Requestor's Payload Size
-
- The requestor's UDP payload size (which OPT stores in the RR CLASS
- field) is the number of octets of the largest UDP payload that can be
- reassembled and delivered in the requestor's network stack. Note
- that path MTU, with or without fragmentation, may be smaller than
- this. Values lower than 512 MUST be treated as equal to 512.
-
- Note that a 512-octet UDP payload requires a 576-octet IP reassembly
- buffer. Choosing 1280 for IPv4 over Ethernet would be reasonable.
- The consequence of choosing too large a value may be an ICMP message
- from an intermediate gateway, or even a silent drop of the response
- message.
-
- The requestor's maximum payload size can change over time, and MUST
- therefore not be cached for use beyond the transaction in which it is
- advertised.
-
-6.4. Responder's Payload Size
-
- The responder's maximum payload size can change over time, but can be
- reasonably expected to remain constant between two sequential
- transactions; for example, a meaningless QUERY to discover a
- responder's maximum UDP payload size, followed immediately by an
- UPDATE which takes advantage of this size. (This is considered
- preferrable to the outright use of TCP for oversized requests, if
- there is any reason to suspect that the responder implements EDNS,
- and if a request will not fit in the default 512 payload size limit.)
-
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 6]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
-6.5. Payload Size Selection
-
- Due to transaction overhead, it is unwise to advertise an
- architectural limit as a maximum UDP payload size. Just because your
- stack can reassemble 64KB datagrams, don't assume that you want to
- spend more than about 4KB of state memory per ongoing transaction.
-
- A requestor MAY choose to implement a fallback to smaller advertised
- sizes to work around firewall or other network limitations. A
- requestor SHOULD choose to use a fallback mechanism which begins with
- a large size, such as 4096. If that fails, a fallback around the
- 1220 byte range SHOULD be tried, as it has a reasonable chance to fit
- within a single Ethernet frame. Failing that, a requestor MAY choose
- a 512 byte packet, which with large answers may cause a TCP retry.
-
-6.6. Middleware Boxes
-
- Middleware boxes MUST NOT limit DNS messages over UDP to 512 bytes.
-
- Middleware boxes which simply forward requests to a recursive
- resolver MUST NOT modify the OPT record contents in either direction.
-
-6.7. Extended RCODE
-
- The extended RCODE and flags (which OPT stores in the RR TTL field)
- are structured as follows:
-
- +0 (MSB) +1 (LSB)
- +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
- 0: | EXTENDED-RCODE | VERSION |
- +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
- 2: | DO| Z |
- +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
-
- EXTENDED-RCODE
- Forms upper 8 bits of extended 12-bit RCODE. Note that
- EXTENDED-RCODE value "0" indicates that an unextended RCODE is
- in use (values "0" through "15").
-
- VERSION
- Indicates the implementation level of whoever sets it. Full
- conformance with this specification is indicated by version
- ``0.'' Requestors are encouraged to set this to the lowest
- implemented level capable of expressing a transaction, to
- minimize the responder and network load of discovering the
- greatest common implementation level between requestor and
- responder. A requestor's version numbering strategy MAY
- ideally be a run time configuration option.
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 7]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
- If a responder does not implement the VERSION level of the
- request, then it answers with RCODE=BADVERS. All responses
- MUST be limited in format to the VERSION level of the request,
- but the VERSION of each response SHOULD be the highest
- implementation level of the responder. In this way a requestor
- will learn the implementation level of a responder as a side
- effect of every response, including error responses and
- including RCODE=BADVERS.
-
- DO
- DNSSEC OK bit as defined by [RFC3225].
-
- Z
- Set to zero by senders and ignored by receivers, unless
- modified in a subsequent specification.
-
-6.8. OPT Options Type Allocation Procedure
-
- Allocations assigned by expert review. TBD
-
-
-7. Transport Considerations
-
- The presence of an OPT pseudo-RR in a request should be taken as an
- indication that the requestor fully implements the given version of
- EDNS, and can correctly understand any response that conforms to that
- feature's specification.
-
- Lack of presence of an OPT record in a request MUST be taken as an
- indication that the requestor does not implement any part of this
- specification and that the responder MUST NOT use any protocol
- extension described here in its response.
-
- Responders who do not implement these protocol extensions MUST
- respond with FORMERR messages without any OPT record.
-
- If there is a problem with processing the OPT record itself, such as
- an option value that is badly formatted or includes out of range
- values, a FORMERR MAY be retured. If this occurs the response MUST
- include an OPT record. This MAY be used to distinguish between
- servers whcih do not implement EDNS and format errors within EDNS.
-
- If EDNS is used in a request, and the response arrives with TC set
- and with no EDNS OPT RR, a requestor SHOULD assume that truncation
- prevented the OPT RR from being appended by the responder, and
- further, that EDNS is not used in the response. Correspondingly, an
- EDNS responder who cannot fit all necessary elements (including an
- OPT RR) into a response, SHOULD respond with a normal (unextended)
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 8]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
- DNS response, possibly setting TC if the response will not fit in the
- unextended response message's 512-octet size.
-
-
-8. Security Considerations
-
- Requestor-side specification of the maximum buffer size may open a
- new DNS denial of service attack if responders can be made to send
- messages which are too large for intermediate gateways to forward,
- thus leading to potential ICMP storms between gateways and
- responders.
-
- Announcing very large UDP buffer sizes may result in dropping by
- firewalls. This could cause retransmissions with no hope of success.
- Some devices reject fragmented UDP packets.
-
- Announcing too small UDP buffer sizes may result in fallback to TCP.
- This is especially important with DNSSEC, where answers are much
- larger.
-
-
-9. IANA Considerations
-
- The IANA has assigned RR type code 41 for OPT.
-
- [RFC2671] specified a number of IANA sub-registries within "DOMAIN
- NAME SYSTEM PARAMETERS:" "EDNS Extended Label Type", "EDNS Option
- Codes", "EDNS Version Numbers", and "Domain System Response Code."
- IANA is advised to re-parent these subregistries to this document.
-
- RFC 2671 created an extended label type registry. We request that
- this registry be closed.
-
- This document assigns extended label type 0bxx111111 as "Reserved for
- future extended label types." We request that IANA record this
- assignment.
-
- This document assigns option code 65535 to "Reserved for future
- expansion."
-
- This document expands the RCODE space from 4 bits to 12 bits. This
- will allow IANA to assign more than the 16 distinct RCODE values
- allowed in RFC 1035 [RFC1035].
-
- This document assigns EDNS Extended RCODE "16" to "BADVERS".
-
- IESG approval should be required to create new entries in the EDNS
- Extended Label Type or EDNS Version Number registries, while any
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 9]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
- published RFC (including Informational, Experimental, or BCP) should
- be grounds for allocation of an EDNS Option Code.
-
-
-10. Acknowledgements
-
- Paul Mockapetris, Mark Andrews, Robert Elz, Don Lewis, Bob Halley,
- Donald Eastlake, Rob Austein, Matt Crawford, Randy Bush, and Thomas
- Narten were each instrumental in creating and refining this
- specification.
-
-
-11. References
-
-11.1. Normative References
-
- [RFC1035] Mockapetris, P., "Domain names - implementation and
- specification", STD 13, RFC 1035, November 1987.
-
- [RFC2671] Vixie, P., "Extension Mechanisms for DNS (EDNS0)",
- RFC 2671, August 1999.
-
- [RFC3225] Conrad, D., "Indicating Resolver Support of DNSSEC",
- RFC 3225, December 2001.
-
-11.2. Informative References
-
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
- Requirement Levels", BCP 14, RFC 2119, March 1997.
-
-
-Authors' Addresses
-
- Michael Graff
- Internet Systems Consortium
- 950 Charter Street
- Redwood City, California 94063
- US
-
- Phone: +1 650.423.1304
- Email: mgraff@isc.org
-
-
-
-
-
-
-
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 10]
-
-Internet-Draft EDNS0 Extensions July 2009
-
-
- Paul Vixie
- Internet Systems Consortium
- 950 Charter Street
- Redwood City, California 94063
- US
-
- Phone: +1 650.423.1301
- Email: vixie@isc.org
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Graff & Vixie Expires January 29, 2010 [Page 11]
-
diff --git a/external/bsd/bind/dist/doc/draft/draft-ietf-dnsop-default-local-zones-10.txt b/external/bsd/bind/dist/doc/draft/draft-ietf-dnsop-default-local-zones-10.txt
deleted file mode 100644
index e137ef35199..00000000000
--- a/external/bsd/bind/dist/doc/draft/draft-ietf-dnsop-default-local-zones-10.txt
+++ /dev/null
@@ -1,728 +0,0 @@
-
-
-
-Network Working Group M. Andrews
-Internet-Draft ISC
-Intended status: BCP March 25, 2010
-Expires: September 26, 2010
-
-
- Locally-served DNS Zones
- draft-ietf-dnsop-default-local-zones-10
-
-Abstract
-
- Experience with the Domain Name System (DNS) has shown that there are
- a number of DNS zones all iterative resolvers and recursive
- nameservers should automatically serve, unless configured otherwise.
- RFC 4193 specifies that this should occur for D.F.IP6.ARPA. This
- document extends the practice to cover the IN-ADDR.ARPA zones for RFC
- 1918 address space and other well known zones with similar
- characteristics.
-
-Status of this Memo
-
- This Internet-Draft is submitted to IETF in full conformance with the
- provisions of BCP 78 and BCP 79.
-
- Internet-Drafts are working documents of the Internet Engineering
- Task Force (IETF), its areas, and its working groups. Note that
- other groups may also distribute working documents as Internet-
- Drafts.
-
- Internet-Drafts are draft documents valid for a maximum of six months
- and may be updated, replaced, or obsoleted by other documents at any
- time. It is inappropriate to use Internet-Drafts as reference
- material or to cite them other than as "work in progress."
-
- The list of current Internet-Drafts can be accessed at
- http://www.ietf.org/ietf/1id-abstracts.txt.
-
- The list of Internet-Draft Shadow Directories can be accessed at
- http://www.ietf.org/shadow.html.
-
- This Internet-Draft will expire on September 26, 2010.
-
-Copyright Notice
-
- Copyright (c) 2010 IETF Trust and the persons identified as the
- document authors. All rights reserved.
-
- This document is subject to BCP 78 and the IETF Trust's Legal
-
-
-
-Andrews Expires September 26, 2010 [Page 1]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
- Provisions Relating to IETF Documents
- (http://trustee.ietf.org/license-info) in effect on the date of
- publication of this document. Please review these documents
- carefully, as they describe your rights and restrictions with respect
- to this document. Code Components extracted from this document must
- include Simplified BSD License text as described in Section 4.e of
- the Trust Legal Provisions and are provided without warranty as
- described in the BSD License.
-
- This document may contain material from IETF Documents or IETF
- Contributions published or made publicly available before November
- 10, 2008. The person(s) controlling the copyright in some of this
- material may not have granted the IETF Trust the right to allow
- modifications of such material outside the IETF Standards Process.
- Without obtaining an adequate license from the person(s) controlling
- the copyright in such materials, this document may not be modified
- outside the IETF Standards Process, and derivative works of it may
- not be created outside the IETF Standards Process, except to format
- it for publication as an RFC or to translate it into languages other
- than English.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Andrews Expires September 26, 2010 [Page 2]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
-Table of Contents
-
- 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
- 1.1. Reserved Words . . . . . . . . . . . . . . . . . . . . . . 3
- 2. Effects on sites using RFC 1918 addresses. . . . . . . . . . . 4
- 3. Changes to Iterative Resolver Behaviour. . . . . . . . . . . . 4
- 4. Lists Of Zones Covered . . . . . . . . . . . . . . . . . . . . 5
- 4.1. RFC1918 Zones . . . . . . . . . . . . . . . . . . . . . . 5
- 4.2. RFC3330 and RFC5737 Zones . . . . . . . . . . . . . . . . 6
- 4.3. Local IPv6 Unicast Addresses . . . . . . . . . . . . . . . 6
- 4.4. IPv6 Locally Assigned Local Addresses . . . . . . . . . . 7
- 4.5. IPv6 Link Local Addresses . . . . . . . . . . . . . . . . 7
- 4.6. IPv6 Example Prefix . . . . . . . . . . . . . . . . . . . 7
- 5. Zones that are Out-Of-Scope . . . . . . . . . . . . . . . . . 7
- 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8
- 7. Security Considerations . . . . . . . . . . . . . . . . . . . 8
- 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 9
- 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 9
- 9.1. Normative References . . . . . . . . . . . . . . . . . . . 9
- 9.2. Informative References . . . . . . . . . . . . . . . . . . 10
- Appendix A. Change History [To Be Removed on Publication] . . . . 10
- A.1. draft-ietf-dnsop-default-local-zones-10.txt . . . . . . . 10
- A.2. draft-ietf-dnsop-default-local-zones-09.txt . . . . . . . 10
- A.3. draft-ietf-dnsop-default-local-zones-08.txt . . . . . . . 11
- A.4. draft-ietf-dnsop-default-local-zones-07.txt . . . . . . . 11
- A.5. draft-ietf-dnsop-default-local-zones-06.txt . . . . . . . 11
- A.6. draft-ietf-dnsop-default-local-zones-05.txt . . . . . . . 11
- A.7. draft-ietf-dnsop-default-local-zones-04.txt . . . . . . . 11
- A.8. draft-ietf-dnsop-default-local-zones-03.txt . . . . . . . 11
- A.9. draft-ietf-dnsop-default-local-zones-02.txt . . . . . . . 11
- A.10. draft-ietf-dnsop-default-local-zones-01.txt . . . . . . . 11
- A.11. draft-ietf-dnsop-default-local-zones-00.txt . . . . . . . 11
- A.12. draft-andrews-full-service-resolvers-03.txt . . . . . . . 12
- A.13. draft-andrews-full-service-resolvers-02.txt . . . . . . . 12
- Appendix B. Proposed Status [To Be Removed on Publication] . . . 12
- Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 12
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Andrews Expires September 26, 2010 [Page 3]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
-1. Introduction
-
- Experience with the Domain Name System (DNS, [RFC1034] and [RFC1035])
- has shown that there are a number of DNS zones that all iterative
- resolvers and recursive nameservers SHOULD automatically serve,
- unless intentionally configured otherwise. These zones include, but
- are not limited to, the IN-ADDR.ARPA zones for the address space
- allocated by [RFC1918] and the IP6.ARPA zones for locally assigned
- unique local IPv6 addresses defined in [RFC4193].
-
- This recommendation is made because data has shown that significant
- leakage of queries for these name spaces is occurring, despite
- instructions to restrict them, and because it has therefore become
- necessary to deploy sacrificial name servers to protect the immediate
- parent name servers for these zones from excessive, unintentional,
- query load [AS112] [I-D.draft-ietf-dnsop-as112-ops]
- [I-D.draft-ietf-dnsop-as112-under-attack-help-help]. There is every
- expectation that the query load will continue to increase unless
- steps are taken as outlined here.
-
- Additionally, queries from clients behind badly configured firewalls
- that allow outgoing queries for these name spaces but drop the
- responses, put a significant load on the root servers (forward but no
- reverse zones configured). They also cause operational load for the
- root server operators as they have to reply to enquiries about why
- the root servers are "attacking" these clients. Changing the default
- configuration will address all these issues for the zones listed in
- Section 4.
-
- [RFC4193] recommends that queries for D.F.IP6.ARPA be handled
- locally. This document extends the recommendation to cover the IN-
- ADDR.ARPA zones for [RFC1918] and other well known IN-ADDR.ARPA and
- IP6.ARPA zones for which queries should not appear on the public
- Internet.
-
- It is hoped that by doing this the number of sacrificial servers
- [AS112] will not have to be increased, and may in time be reduced.
-
- This recommendation should also help DNS responsiveness for sites
- which are using [RFC1918] addresses but do not follow the last
- paragraph in Section 3 of [RFC1918].
-
-1.1. Reserved Words
-
- The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
- "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
- document are to be interpreted as described in [RFC2119].
-
-
-
-
-Andrews Expires September 26, 2010 [Page 4]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
-2. Effects on sites using RFC 1918 addresses.
-
- For most sites using [RFC1918] addresses, the changes here will have
- little or no detrimental effect. If the site does not already have
- the reverse tree populated the only effect will be that the name
- error responses will be generated locally rather than remotely.
-
- For sites that do have the reverse tree populated, most will either
- have a local copy of the zones or will be forwarding the queries to
- servers which have local copies of the zone. Therefore this
- recommendation will not be relevant.
-
- The most significant impact will be felt at sites that make use of
- delegations for [RFC1918] addresses and have populated these zones.
- These sites will need to override the default configuration expressed
- in this document to allow resolution to continue. Typically, such
- sites will be fully disconnected from the Internet and have their own
- root servers for their own non-Internet DNS tree.
-
-
-3. Changes to Iterative Resolver Behaviour.
-
- Unless configured otherwise, an iterative resolver will now return
- authoritatively (aa=1) name errors (RCODE=3) for queries within the
- zones in Section 4, with the obvious exception of queries for the
- zone name itself where SOA, NS and "no data" responses will be
- returned as appropriate to the query type. One common way to do this
- all at once is to serve empty (SOA and NS only) zones.
-
- An implementation of this recommendation MUST provide a mechanism to
- disable this new behaviour, and SHOULD allow this decision on a zone
- by zone basis.
-
- If using empty zones one SHOULD NOT use the same NS and SOA records
- as used on the public Internet servers as that will make it harder to
- detect the origin of the responses and thus any leakage to the public
- Internet servers. This document recommends that the NS record
- defaults to the name of the zone and the SOA MNAME defaults to the
- name of the only NS RR's target. The SOA RNAME should default to
- "nobody.invalid." [RFC2606]. Implementations SHOULD provide a
- mechanism to set these values. No address records need to be
- provided for the name server.
-
- Below is an example of a generic empty zone in master file format.
- It will produce a negative cache TTL of 3 hours.
-
- @ 10800 IN SOA @ nobody.invalid. 1 3600 1200 604800 10800
- @ 10800 IN NS @
-
-
-
-Andrews Expires September 26, 2010 [Page 5]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
- The SOA RR is needed to support negative caching [RFC2308] of name
- error responses and to point clients to the primary master for DNS
- dynamic updates.
-
- SOA values of particular importance are the MNAME, the SOA RR's TTL
- and the negTTL value. Both TTL values SHOULD match. The rest of the
- SOA timer values MAY be chosen arbitrarily since they are not
- intended to control any zone transfer activity.
-
- The NS RR is needed as some UPDATE [RFC2136] clients use NS queries
- to discover the zone to be updated. Having no address records for
- the name server is expected to abort UPDATE processing in the client.
-
-
-4. Lists Of Zones Covered
-
- The following subsections are intended to seed the IANA registry as
- requested in the IANA Considerations Section. The zone name is the
- entity to be registered.
-
-4.1. RFC1918 Zones
-
- The following zones correspond to the IPv4 address space reserved in
- [RFC1918].
-
- +----------------------+
- | Zone |
- +----------------------+
- | 10.IN-ADDR.ARPA |
- | 16.172.IN-ADDR.ARPA |
- | 17.172.IN-ADDR.ARPA |
- | 18.172.IN-ADDR.ARPA |
- | 19.172.IN-ADDR.ARPA |
- | 20.172.IN-ADDR.ARPA |
- | 21.172.IN-ADDR.ARPA |
- | 22.172.IN-ADDR.ARPA |
- | 23.172.IN-ADDR.ARPA |
- | 24.172.IN-ADDR.ARPA |
- | 25.172.IN-ADDR.ARPA |
- | 26.172.IN-ADDR.ARPA |
- | 27.172.IN-ADDR.ARPA |
- | 28.172.IN-ADDR.ARPA |
- | 29.172.IN-ADDR.ARPA |
- | 30.172.IN-ADDR.ARPA |
- | 31.172.IN-ADDR.ARPA |
- | 168.192.IN-ADDR.ARPA |
- +----------------------+
-
-
-
-
-Andrews Expires September 26, 2010 [Page 6]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
-4.2. RFC3330 and RFC5737 Zones
-
- The following zones correspond to those address ranges from [RFC3330]
- and [RFC5737] that are not expected to appear as source or
- destination addresses on the public Internet and to not have a unique
- name to associate with.
-
- The recommendation to serve an empty zone 127.IN-ADDR.ARPA is not a
- attempt to discourage any practice to provide a PTR RR for
- 1.0.0.127.IN-ADDR.ARPA locally. In fact, a meaningful reverse
- mapping should exist, but the exact setup is out of the scope of this
- document. Similar logic applies to the reverse mapping for ::1
- (Section 4.3). The recommendations made here simply assume no other
- coverage for these domains exists.
-
- +------------------------------+------------------------+
- | Zone | Description |
- +------------------------------+------------------------+
- | 0.IN-ADDR.ARPA | IPv4 "THIS" NETWORK |
- | 127.IN-ADDR.ARPA | IPv4 LOOP-BACK NETWORK |
- | 254.169.IN-ADDR.ARPA | IPv4 LINK LOCAL |
- | 2.0.192.IN-ADDR.ARPA | IPv4 TEST NET 1 |
- | 100.51.198.IN-ADDR.ARPA | IPv4 TEST NET 2 |
- | 113.0.203.IN-ADDR.ARPA | IPv4 TEST NET 3 |
- | 255.255.255.255.IN-ADDR.ARPA | IPv4 BROADCAST |
- +------------------------------+------------------------+
-
-4.3. Local IPv6 Unicast Addresses
-
- The reverse mappings ([RFC3596], Section 2.5 IP6.ARPA Domain) for the
- IPv6 Unspecified (::) and Loopback (::1) addresses ([RFC4291],
- Sections 2.4, 2.5.2 and 2.5.3) are covered by these two zones:
-
- +-------------------------------------------+
- | Zone |
- +-------------------------------------------+
- | 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ |
- | 0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA |
- | 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ |
- | 0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA |
- +-------------------------------------------+
-
- Note: Line breaks and a escapes '\' have been inserted above for
- readability and to adhere to line width constraints. They are not
- parts of the zone names.
-
-
-
-
-
-
-Andrews Expires September 26, 2010 [Page 7]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
-4.4. IPv6 Locally Assigned Local Addresses
-
- Section 4.4 of [RFC4193] already required special treatment of:
-
- +--------------+
- | Zone |
- +--------------+
- | D.F.IP6.ARPA |
- +--------------+
-
-4.5. IPv6 Link Local Addresses
-
- IPv6 Link-Local Addresses as of [RFC4291], Section 2.5.6 are covered
- by four distinct reverse DNS zones:
-
- +----------------+
- | Zone |
- +----------------+
- | 8.E.F.IP6.ARPA |
- | 9.E.F.IP6.ARPA |
- | A.E.F.IP6.ARPA |
- | B.E.F.IP6.ARPA |
- +----------------+
-
-4.6. IPv6 Example Prefix
-
- IPv6 example prefix [RFC3849].
-
- +--------------------------+
- | Zone |
- +--------------------------+
- | 8.B.D.0.1.0.0.2.IP6.ARPA |
- +--------------------------+
-
- Note: 8.B.D.0.1.0.0.2.IP6.ARPA is not being used as a example here.
-
-
-5. Zones that are Out-Of-Scope
-
- IPv6 site-local addresses (deprecated, see [RFC4291] Sections 2.4 and
- 2.5.7), and IPv6 Non-Locally Assigned Local addresses ([RFC4193]) are
- not covered here.
-
- It is expected that IPv6 site-local addresses will be self correcting
- as IPv6 implementations remove support for site-local addresses.
- However, sacrificial servers for the zones C.E.F.IP6.ARPA through
- F.E.F.IP6.ARPA may still need to be deployed in the short term if the
- traffic becomes excessive.
-
-
-
-Andrews Expires September 26, 2010 [Page 8]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
- For IPv6 Non-Locally Assigned Local addresses (L = 0) [RFC4193],
- there has been no decision made about whether the Regional Internet
- Registries (RIRs) will provide delegations in this space or not. If
- they don't, then C.F.IP6.ARPA will need to be added to the list in
- Section 4.4. If they do, then registries will need to take steps to
- ensure that name servers are provided for these addresses.
-
- This document also ignores IP6.INT. IP6.INT has been wound up with
- only legacy resolvers now generating reverse queries under IP6.INT
- [RFC4159].
-
- This document has also deliberately ignored names immediately under
- the root domain. While there is a subset of queries to the root name
- servers which could be addressed using the techniques described here
- (e.g. .local, .workgroup and IPv4 addresses), there is also a vast
- amount of traffic that requires a different strategy (e.g. lookups
- for unqualified hostnames, IPv6 addresses).
-
-
-6. IANA Considerations
-
- This document requests that IANA establish a registry of zones which
- require this default behaviour. The initial contents of this
- registry are defined in Section 4. Implementors are encouraged to
- periodically check this registry and adjust their implementations to
- reflect changes therein.
-
- This registry can be amended through "IETF Review" as per [RFC5226].
-
- IANA should co-ordinate with the RIRs to ensure that, as DNSSEC is
- deployed in the reverse tree, delegations for these zones are made in
- the manner described in Section 7.
-
-
-7. Security Considerations
-
- During the initial deployment phase, particularly where [RFC1918]
- addresses are in use, there may be some clients that unexpectedly
- receive a name error rather than a PTR record. This may cause some
- service disruption until their recursive name server(s) have been re-
- configured.
-
- As DNSSEC is deployed within the IN-ADDR.ARPA and IP6.ARPA
- namespaces, the zones listed above will need to be delegated as
- insecure delegations, or be within insecure zones. This will allow
- DNSSEC validation to succeed for queries in these spaces despite not
- being answered from the delegated servers.
-
-
-
-
-Andrews Expires September 26, 2010 [Page 9]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
- It is recommended that sites actively using these namespaces secure
- them using DNSSEC [RFC4035] by publishing and using DNSSEC trust
- anchors. This will protect the clients from accidental import of
- unsigned responses from the Internet.
-
-
-8. Acknowledgements
-
- This work was supported by the US National Science Foundation
- (research grant SCI-0427144) and DNS-OARC.
-
-
-9. References
-
-9.1. Normative References
-
- [RFC1034] Mockapetris, P., "DOMAIN NAMES - CONCEPTS AND FACILITIES",
- STD 13, RFC 1034, November 1987.
-
- [RFC1035] Mockapetris, P., "DOMAIN NAMES - IMPLEMENTATION AND
- SPECIFICATION", STD 13, RFC 1035, November 1987.
-
- [RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.,
- and E. Lear, "Address Allocation for Private Internets",
- BCP 5, RFC 1918, February 1996.
-
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
- Requirement Levels", BCP 14, RFC 2119, March 1997.
-
- [RFC2136] Vixie, P., Thomson, A., Rekhter, Y., and J. Bound,
- "Dynamic Updates in the Domain Name System (DNS UPDATE)",
- RFC 2136, April 1997.
-
- [RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS
- NCACHE)", RFC 2398, March 1998.
-
- [RFC2606] Eastlake, D. and A. Panitz, "Reserved Top Level DNS
- Names", BCP 32, RFC 2606, June 1999.
-
- [RFC3596] Thomson, S., Huitema, C., Ksinant, V., and M. Souissi,
- "DNS Extensions to Support IPv6", RFC 3596, October 2003.
-
- [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S.
- Rose, "Protocol Modifications for the DNS Security
- Extensions", RFC 4035, March 2005.
-
- [RFC4159] Huston, G., "Deprecation of "ip6.int"", BCP 109, RFC 4159,
- August 2005.
-
-
-
-Andrews Expires September 26, 2010 [Page 10]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
- [RFC4193] Hinden, R. and B. Haberman, "Unique Local IPv6 Unicast
- Addresses", RFC 4193, October 2005.
-
- [RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing
- Architecture", RFC 4291, February 2006.
-
- [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
- IANA Considerations Section in RFCs", BCP 26, RFC 5226,
- October 2008.
-
-9.2. Informative References
-
- [AS112] "AS112 Project", <http://www.as112.net/>.
-
- [I-D.draft-ietf-dnsop-as112-ops]
- Abley, J. and W. Maton, "AS112 Nameserver Operations",
- draft-ietf-dnsop-as112-ops-01 (work in progress),
- November 2007.
-
- [I-D.draft-ietf-dnsop-as112-under-attack-help-help]
- Abley, J. and W. Maton, "I'm Being Attacked by
- PRISONER.IANA.ORG!",
- draft-ietf-dnsop-as112-under-attack-help-help-01 (work in
- progress), November 2007.
-
- [RFC3330] "Special-Use IPv4 Addresses", RFC 3330, September 2002.
-
- [RFC3849] Huston, G., Lord, A., and P. Smith, "IPv6 Address Prefix
- Reserved for Documentation", RFC 3849, July 2004.
-
- [RFC5737] Arkko, J., Cotton, M., and L. Vergoda, "IPv4 Address
- Blocks Reserved for Documentation", RFC 5737,
- January 2010.
-
-
-Appendix A. Change History [To Be Removed on Publication]
-
-A.1. draft-ietf-dnsop-default-local-zones-10.txt
-
- added RFC 5737 zones
-
-A.2. draft-ietf-dnsop-default-local-zones-09.txt
-
- refresh awaiting writeup
-
-
-
-
-
-
-
-Andrews Expires September 26, 2010 [Page 11]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
-A.3. draft-ietf-dnsop-default-local-zones-08.txt
-
- editorial, reference updates
-
-A.4. draft-ietf-dnsop-default-local-zones-07.txt
-
- none, expiry prevention
-
-A.5. draft-ietf-dnsop-default-local-zones-06.txt
-
- add IPv6 example prefix
-
-A.6. draft-ietf-dnsop-default-local-zones-05.txt
-
- none, expiry prevention
-
-A.7. draft-ietf-dnsop-default-local-zones-04.txt
-
- Centrally Assigned Local addresses -> Non-Locally Assigned Local
- address
-
-A.8. draft-ietf-dnsop-default-local-zones-03.txt
-
- expanded section 4 descriptions
-
- Added references [RFC2136], [RFC3596],
- [I-D.draft-ietf-dnsop-as112-ops] and
- [I-D.draft-ietf-dnsop-as112-under-attack-help-help].
-
- Revised language.
-
-A.9. draft-ietf-dnsop-default-local-zones-02.txt
-
- RNAME now "nobody.invalid."
-
- Revised language.
-
-A.10. draft-ietf-dnsop-default-local-zones-01.txt
-
- Revised impact description.
-
- Updated to reflect change in IP6.INT status.
-
-A.11. draft-ietf-dnsop-default-local-zones-00.txt
-
- Adopted by DNSOP.
-
- "Author's Note" re-titled "Zones that are Out-Of-Scope"
-
-
-
-Andrews Expires September 26, 2010 [Page 12]
-
-Internet-Draft Locally-served DNS Zones March 2010
-
-
- Add note that these zone are expected to seed the IANA registry.
-
- Title changed.
-
-A.12. draft-andrews-full-service-resolvers-03.txt
-
- Added "Proposed Status".
-
-A.13. draft-andrews-full-service-resolvers-02.txt
-
- Added 0.IN-ADDR.ARPA.
-
-
-Appendix B. Proposed Status [To Be Removed on Publication]
-
- This Internet-Draft is being submitted for eventual publication as an
- RFC with a proposed status of Best Current Practice.
-
-
-Author's Address
-
- Mark P. Andrews
- Internet Systems Consortium
- 950 Charter Street
- Redwood City, CA 94063
- US
-
- Email: marka@isc.org
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Andrews Expires September 26, 2010 [Page 13]
-
diff --git a/external/bsd/bind/dist/doc/draft/draft-ietf-dnsop-dnssec-key-timing-00.txt b/external/bsd/bind/dist/doc/draft/draft-ietf-dnsop-dnssec-key-timing-00.txt
deleted file mode 100644
index 6028ee89d64..00000000000
--- a/external/bsd/bind/dist/doc/draft/draft-ietf-dnsop-dnssec-key-timing-00.txt
+++ /dev/null
@@ -1,1960 +0,0 @@
-
-
-
-Internet Engineering Task Force S. Morris
-Internet-Draft ISC
-Intended status: Informational J. Ihren
-Expires: January 2, 2011 Netnod
- J. Dickinson
- Sinodun
- July 1, 2010
-
-
- DNSSEC Key Timing Considerations
- draft-ietf-dnsop-dnssec-key-timing-00.txt
-
-Abstract
-
- This document describes the issues surrounding the timing of events
- in the rolling of a key in a DNSSEC-secured zone. It presents
- timelines for the key rollover and explicitly identifies the
- relationships between the various parameters affecting the process.
-
-Status of this Memo
-
- This Internet-Draft is submitted in full conformance with the
- provisions of BCP 78 and BCP 79.
-
- Internet-Drafts are working documents of the Internet Engineering
- Task Force (IETF). Note that other groups may also distribute
- working documents as Internet-Drafts. The list of current Internet-
- Drafts is at http://datatracker.ietf.org/drafts/current/.
-
- Internet-Drafts are draft documents valid for a maximum of six months
- and may be updated, replaced, or obsoleted by other documents at any
- time. It is inappropriate to use Internet-Drafts as reference
- material or to cite them other than as "work in progress."
-
- This Internet-Draft will expire on January 2, 2011.
-
-Copyright Notice
-
- Copyright (c) 2010 IETF Trust and the persons identified as the
- document authors. All rights reserved.
-
- This document is subject to BCP 78 and the IETF Trust's Legal
- Provisions Relating to IETF Documents
- (http://trustee.ietf.org/license-info) in effect on the date of
- publication of this document. Please review these documents
- carefully, as they describe your rights and restrictions with respect
- to this document. Code Components extracted from this document must
- include Simplified BSD License text as described in Section 4.e of
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 1]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- the Trust Legal Provisions and are provided without warranty as
- described in the Simplified BSD License.
-
-
-Table of Contents
-
- 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
- 1.1. Key Rolling Considerations . . . . . . . . . . . . . . . . 3
- 1.2. Types of Keys . . . . . . . . . . . . . . . . . . . . . . 4
- 1.3. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4
- 2. Rollover Methods . . . . . . . . . . . . . . . . . . . . . . . 4
- 2.1. ZSK Rollovers . . . . . . . . . . . . . . . . . . . . . . 4
- 2.2. KSK Rollovers . . . . . . . . . . . . . . . . . . . . . . 6
- 2.3. Summary . . . . . . . . . . . . . . . . . . . . . . . . . 7
- 3. Key Rollover Timelines . . . . . . . . . . . . . . . . . . . . 8
- 3.1. Key States . . . . . . . . . . . . . . . . . . . . . . . . 8
- 3.2. Zone-Signing Key Timelines . . . . . . . . . . . . . . . . 9
- 3.2.1. Pre-Publication Method . . . . . . . . . . . . . . . . 9
- 3.2.2. Double-Signature Method . . . . . . . . . . . . . . . 13
- 3.2.3. Double-RRSIG Method . . . . . . . . . . . . . . . . . 14
- 3.3. Key-Signing Key Rollover Timelines . . . . . . . . . . . . 17
- 3.3.1. Double-Signature Method . . . . . . . . . . . . . . . 17
- 3.3.2. Double-DS Method . . . . . . . . . . . . . . . . . . . 20
- 3.3.3. Double-RRset Method . . . . . . . . . . . . . . . . . 22
- 3.3.4. Interaction with Configured Trust Anchors . . . . . . 25
- 3.3.4.1. Addition of KSK . . . . . . . . . . . . . . . . . 25
- 3.3.4.2. Removal of KSK . . . . . . . . . . . . . . . . . . 25
- 3.3.5. Introduction of First KSK . . . . . . . . . . . . . . 26
- 4. Standby Keys . . . . . . . . . . . . . . . . . . . . . . . . . 27
- 5. Algorithm Considerations . . . . . . . . . . . . . . . . . . . 28
- 6. Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
- 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 28
- 8. Security Considerations . . . . . . . . . . . . . . . . . . . 28
- 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 29
- 10. Change History . . . . . . . . . . . . . . . . . . . . . . . . 29
- 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 30
- 11.1. Normative References . . . . . . . . . . . . . . . . . . . 30
- 11.2. Informative References . . . . . . . . . . . . . . . . . . 30
- Appendix A. List of Symbols . . . . . . . . . . . . . . . . . . . 30
- Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 34
-
-
-
-
-
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 2]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
-1. Introduction
-
-1.1. Key Rolling Considerations
-
- When a zone is secured with DNSSEC, the zone manager must be prepared
- to replace ("roll") the keys used in the signing process. The
- rolling of keys may be caused by compromise of one or more of the
- existing keys, or it may be due to a management policy that demands
- periodic key replacement for security or operational reasons. In
- order to implement a key rollover, the keys need to be introduced
- into and removed from the zone at the appropriate times.
- Considerations that must be taken into account are:
-
- o DNSKEY records and associated information (such as RRSIG records
- created with the key or the associated DS records) are not only
- held at the authoritative nameserver, they are also cached at
- client resolvers. The data on these systems can be interlinked,
- e.g. a validating resolver may try to validate a signature
- retrieved from a cache with a key obtained separately.
-
- o A query for the key RRset returns all DNSKEY records in the zone.
- As there is limited space in the UDP packet (even with EDNS0
- support), dead key records must be periodically removed. (For the
- same reason, the number of stand-by keys in the zone should be
- restricted to the minimum required to support the key management
- policy.)
-
- o Zone "boot-strapping" events, where a zone is signed for the first
- time, can be common in configurations where a large number of
- zones are being served. Procedures should be able to cope with
- the introduction of keys into the zone for the first time as well
- as "steady-state", where the records are being replaced as part of
- normal zone maintenance.
-
- o To allow for an emergency re-signing of the zone as soon as
- possible after a key compromise has been detected, stand-by keys
- (additional keys over and above those used to sign the zone) need
- to be present.
-
- Management policy, e.g. how long a key is used for, also needs to be
- considered. However, the point of key management logic is not to
- ensure that a "rollover" is completed at a certain time but rather to
- ensure that no changes are made to the state of keys published in the
- zone until it is "safe" to do so ("safe" in this context meaning that
- at no time during the rollover process does any part of the zone ever
- go bogus). In other words, although key management logic enforces
- policy, it may not enforce it strictly.
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 3]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
-1.2. Types of Keys
-
- Although DNSSEC validation treats all keys equally, [RFC4033]
- recognises the broad classification of zone-signing keys (ZSK) and
- key-signing keys (KSK). A ZSK is used to authenticate information
- within the zone; a KSK is used to authenticate the key set in the
- zone. The main implication for this distinction concerns the
- consistency of information during a rollover.
-
- During operation, a validating resolver must use separate pieces of
- information to perform an authentication. At the time of
- authentication, each piece of information may be in the validating
- resolver's cache or may need to be retrieved from the authoritative
- server. The rollover process needs to happen in such a way that at
- all times through the rollover the information is consistent. With a
- ZSK, the information is the RRSIG (plus associated RRset) and the
- DNSKEY. These are both obtained from the same zone. In the case of
- the KSK, the information is the DNSKEY and DS RRset with the latter
- being obtained from a different zone.
-
- There are similarities in the rolling of ZSKs and KSKs: replace the
- RRSIG (plus RR) by the DNSKEY and replace the DNSKEY by the DS, and
- the ZSK rolling algorithms are virtually the same as the KSK
- algorithms. However, there are a number of differences, and for this
- reason the two types of rollovers are described separately in this
- document.
-
-1.3. Terminology
-
- The terminology used in this document is as defined in [RFC4033] and
- [RFC5011].
-
- A large number of symbols are used to identify times, intervals, etc.
- All are listed in Appendix A.
-
-
-2. Rollover Methods
-
-2.1. ZSK Rollovers
-
- A ZSK can be rolled in one of three ways:
-
- o Pre-Publication. Described in [RFC4641], the new key is
- introduced into the DNSKEY RRset, leaving the existing keys and
- signatures in place. This state of affairs remains in place for
- long enough to ensure that any DNSKEY RRsets cached in client
- validating resolvers contain both keys. At that point signatures
- created with the old key can be replaced by those created with the
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 4]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- new key, and the old signatures removed. During the re-signing
- process (which may or may not be atomic depending on how the zone
- is managed), it doesn't matter which key an RRSIG record retrieved
- by a client was created with; clients with a cached copy of the
- DNSKEY RRset will have a copy containing both the old and new
- keys.
-
- Once the zone contains only signatures created with the new key,
- there is an interval during which RRSIG records created with the
- old key expire from client caches. After this, there will be no
- signatures anywhere that were created using the old key, and it
- can can be removed from the DNSKEY RRset.
-
- o Double-Signature. Also mentioned in [RFC4641], this involves
- introducing the new key into the zone and using it to create
- additional RRSIG records; the old key and existing RRSIG records
- are retained. During the period in which the zone is being signed
- (again, the signing process may not be atomic), client resolvers
- are always able to validate RRSIGs: any combination of old and new
- DNSKEY RRset and RRSIG allows at least one signature to be
- validated.
-
- Once the signing process is complete and enough time has elapsed
- to allow all old information to expire from caches, the old key
- and signatures can be removed from the zone. As before, during
- this period any combination of DNSKEY RRset and RRSIG will allow
- validation of at least one signature.
-
- o Double-RRSIG. Strictly speaking, the use of the term "Double-
- Signature" above is a misnomer as the method is not only double
- signature, it is also double key as well. A true Double-Signature
- method (here called the Double-RRSIG method) involves introducing
- new signatures in the zone (while still retaining the old ones)
- but not the new key.
-
- Once the signing process is complete and enough time has elapsed
- to ensure that all caches that may contain an RR and associated
- RRSIG to have a copy of both signatures, the ZSK is changed.
- After a further interval during which the old DNSKEY RRset expires
- from caches, the old signatures are removed from the zone.
-
- Of three methods, Double-Signature is the simplest conceptually -
- introduce the new key and new signatures, then approximately one TTL
- later remove the old key and signatures. The drawback of this method
- is a noticeable increase in the size of the DNSSEC data, affecting
- both the overall size of the zone and the size of the responses.
-
- Pre-Publication is more complex - introduce the new key,
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 5]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- approximately one TTL later sign the records, and approximately one
- TTL after that remove the old key. However, the amount of DNSSEC
- data is kept to a minimum which reduces the impact on performance.
-
- The Double-RRSIG combines the increase in data volume of the Double-
- Signature method with the complexity of Pre-Publication. It has few
- (if any) advantages and a description is only included here for
- completeness.
-
-2.2. KSK Rollovers
-
- In the ZSK case the issue for the validating resolver is to ensure
- that it has access to the ZSK that corresponds to a particular
- signature. In the KSK case this can never be a problem as the KSK is
- only used for one signature (that over the DNSKEY RRset) and both the
- key the signature travel together. Instead, the issue is to ensure
- that the KSK is trusted.
-
- Trust in the KSK is either due to the existence of an explicitly
- configured trust anchor in the validating resolver or DS record in
- the parent zone (which is itself trusted). If the former, [RFC5011]
- timings will be needed to roll the keys. If the latter, the rollover
- algorithm will need to involve the parent zone in the addition and
- removal of DS records, so timings are not wholly under the control of
- the zone manager. (The zone manager may elect to include [RFC5011]
- timings in the key rolling process so as to cope with the possibility
- that the key has also been explicitly configured as a trust anchor.)
-
- It is important to note that this does not preclude the development
- of key rollover logic; in accordance with the goal of the rollover
- logic being able to determine when a state change is "safe", the only
- effect of being dependent on the parent is that there may be a period
- of waiting for the parent to respond in addition to any delay the key
- rollover logic requires. Although this introduces additional delays,
- even with a parent that is less than ideally responsive the only
- effect will be a slowdown in the rollover state transitions. This
- may cause a policy violation, but will not cause any operational
- problems.
-
- Like the ZSK case, there are three methods for rolling a KSK:
-
- o Double-Signature: Also known as Double-DNSKEY, the new KSK is
- added to the DNSKEY RRset which is then signed with both the old
- and new key. After waiting for the old RRset to expire from
- caches, the DS record in the parent zone is changed. After
- waiting a further interval for this change to be reflected in
- caches, the old key is removed from the RRset. (The name "Double-
- Signature" is used because, like the ZSK method of the same name,
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 6]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- the new key is introduced and immediately used for signing.)
-
- o Double-DS: the new DS record is published. After waiting for this
- change to propagate into the caches of all validating resolvers,
- the KSK is changed. After a further interval during which the old
- DNSKEY RRset expires from caches, the old DS record is removed.
-
- o Double-RRset: the new KSK is added to the DNSKEY RRset which is
- then signed with both the old and new key, and the new DS record
- added to the parent zone. After waiting a suitable interval for
- the old DS and DNSKEY RRsets to expire from validating resolver
- caches, the old DNSKEY and DS record are removed.
-
- In essence, "Double-Signature" means that the new KSK is introduced
- first and used to sign the DNSKEY RRset. The DS record is changed,
- and finally the old KSK removed. With "Double-DS" it is the other
- way around. Finally, Double-RRset does both updates more or less in
- parallel.
-
- The strategies have different advantages and disadvantages:
-
- o Double-Signature minimizes the number of interactions with the
- parent zone. However, for the period of the rollover the DNSKEY
- RRset is signed with two KSKs, so increasing the size of the
- response to a query for this data.
-
- o Double-DS keeps the size of the DNSKEY RRset to a minimum, but
- does require the additional administrative overhead of two
- interactions with the parent to roll a KSK. (Although this can be
- mitigated if the parent has the ability for a child zone to
- schedule the withdrawal of the old key at the same time as the
- introduction of the new one.)
-
- o Finally, Double-RRset allows the rollover to be done in roughly
- half the time of the other two methods; it also supports policies
- that require a period of running with old and new KSKs
- simultaneously. However, it does have the disadvantages of both
- the other two methods - it requires two signatures during the
- period of the rollover and two interactions with the parent.
-
-2.3. Summary
-
- The methods can be summarised as follows:
-
-
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 7]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- +------------------+------------------+-----------------------------+
- | ZSK Method | KSK Method | Description |
- +------------------+------------------+-----------------------------+
- | Pre-Publication | (not applicable) | Publish the DNSKEY before |
- | | | the RRSIG. |
- | Double-Signature | Double-Signature | Publish the DNSKEY and |
- | | | RRSIG at same time. (For a |
- | | | KSK, this happens before |
- | | | the DS is published.) |
- | Double-RRSIG | (not applicable) | Publish RRSIG before the |
- | | | DNSKEY. |
- | (not applicable) | Double-DS | Publish DS before the |
- | | | DNSKEY. |
- | (not applicable) | Double-RRset | Publish DNSKEY and DS in |
- | | | parallel. |
- +------------------+------------------+-----------------------------+
-
- Table 1
-
-
-3. Key Rollover Timelines
-
-3.1. Key States
-
- During the rolling process, a key moves through different states.
- These states are:
-
- Generated The key has been created, but has not yet been used for
- anything.
-
- Published The DNSKEY record - or information associated with it -
- is published in the zone, but predecessors of the key (or
- associated information) may be held in resolver caches.
-
- The idea of "associated information" is used in rollover
- methods where RRSIG or DS records are published first and
- the DNSKEY is changed in an atomic operation. It allows
- the rollover still to be thought of as moving through a
- set of states. In the rest of this section, the term
- "key" should be taken to mean "key or associated
- information".
-
- Ready The key has been published for long enough to guarantee
- that all caches that might contain a copy of the key
- RRset have a copy that includes this key.
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 8]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Active The key is in the zone and has started to be used to sign
- RRsets or authenticate the DNSKEY RRset. Note that when
- this state is entered, it might not be possible for every
- validating resolver to use the key for validation: the
- zone signing may not have finished, or the data might not
- have reached the resolver because of propagation delays
- and/or caching issues. If this is the case, the resolver
- will have to rely on the key's predecessor instead.
-
- Retired The key is in the zone but a successor key has become
- active. As there may still be information in caches that
- that require use of the key, it is being retained until
- this information expires.
-
- Dead The key is published in the zone but there is no
- information anywhere that requires its presence.
-
- Removed The key has been removed from the zone.
-
- There is one additional state, used where [RFC5011] considerations
- are in effect (see Section 3.3.4):
-
- Revoked The key is published for a period with the "revoke" bit
- set as a way of notifying validating resolvers that have
- configured it as a trust anchor that it is about to be
- removed from the zone.
-
-3.2. Zone-Signing Key Timelines
-
-3.2.1. Pre-Publication Method
-
- The following diagram shows the time line of a particular ZSK and its
- replacement by its successor using the Pre-Publication method. Time
- increases along the horizontal scale from left to right and the
- vertical lines indicate events in the life of the key. The events
- are numbered; significant times and time intervals are marked.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 9]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- |1| |2| |3| |4| |5| |6| |7| |8| |9|
- | | | | | | | | |
- Key N | |<-Ipub->|<--->|<-------Lzsk----->|<-Iret->|<--->|
- | | | | | | | | |
- Key N+1 | | | | |<-Ipub->|<->|<---Lzsk-- - -
- | | | | | | | | |
- Tgen Tpub Trdy Tact TpubS Tret Tdea Trem
-
- ---- Time ---->
-
-
- Figure 1: Timeline for a Pre-Publication ZSK rollover.
-
- Event 1: key N is generated at the generate time (Tgen). Although
- there is no reason why the key cannot be generated immediately prior
- to publication in the zone (Event 2), some implementations may find
- it convenient to create a pool of keys in one operation and draw from
- that pool as required. For this reason, it is shown as a separate
- event. Keys that are available for use but not published are said to
- be generated.
-
- Event 2: key N's DNSKEY record is put into the zone, i.e. it is added
- to the DNSKEY RRset which is then re-signed with the current key-
- signing key. The time at which this occurs is the key's publication
- time (Tpub), and the key is now said to be published. Note that the
- key is not yet used to sign records.
-
- Event 3: before it can be used, the key must be published for long
- enough to guarantee that any resolver that has a copy of the DNSKEY
- RRset from the zone in its cache will have a copy of the RRset that
- includes this key: in other words, that any prior cached information
- about the DNSKEY RRset has expired.
-
- This interval is the publication interval (Ipub) and, for the second
- or subsequent keys in the zone, is given by:
-
- Ipub = Dprp + TTLkey
-
- Here, Dprp is the propagation delay - the time taken for any change
- introduced at the master to replicate to all slave servers - which
- depends on the depth of the master-slave hierarchy. TTLkey is the
- time-to-live (TTL) for the DNSKEY records in the zone. The sum is
- therefore the time taken for existing DNSKEY records to expire from
- the caches of downstream validating resolvers, regardless of the
- nameserver from which they were retrieved.
-
- In the case of the first key in the zone, Ipub is slightly different
- because it is not information about a DNSKEY RRset that may be
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 10]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- cached, it is information about its absence. In this case:
-
- Ipub = Dprp + Ingc
-
- where Ingc is the negative cache interval from the zone's SOA record,
- calculated according to [RFC2308] as the minimum of the TTL of the
- SOA record itself (TTLsoa), and the "minimum" field in the record's
- parameters (SOAmin), i.e.
-
- Ingc = min(TTLsoa, SOAmin)
-
- After a delay of Ipub, the key is said to be ready and could be used
- to sign records. The time at which this event occurs is the key's
- ready time (Trdy), which is given by:
-
- Trdy = Tpub + Ipub
-
- Event 4: at some later time, the key starts being used to sign
- RRsets. This point is the active time (Tact) and after this, the key
- is said to be active.
-
- Event 5: while this key is active, thought must be given to its
- successor (key N+1). As with the introduction of the currently
- active key into the zone, the successor key will need to be published
- at least Ipub before it is used. Denoting the publication time of
- the successor key by TpubS, then:
-
- TpubS <= Tact + Lzsk - Ipub
-
- Here, Lzsk is the length of time for which a ZSK will be used (the
- ZSK lifetime). It should be noted that unlike the publication
- interval, Lzsk is not determined by timing logic, but by key
- management policy. Lzsk will be set by the operator according to
- their assessment of the risks posed by continuing to use a key and
- the risks associated with key rollover. However, operational
- considerations may mean a key is active for slightly more or less
- than Lzsk.
-
- Event 6: while the key N is still active, its successor becomes
- ready. From this time onwards, it could be used to sign the zone.
-
- Event 7: at some point the decision is made to start signing the zone
- using the successor key. This will be when the current key has been
- in use for an interval equal to the ZSK lifetime, hence:
-
- Tret = Tact + Lzsk
-
- This point in time is the retire time (Tret) of key N; after this the
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 11]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- key is said to be retired. (This time is also the point at which the
- successor key becomes active.)
-
- Event 8: the retired key needs to be retained in the zone whilst any
- RRSIG records created using this key are still published in the zone
- or held in resolver caches. (It is possible that a resolver could
- have an unexpired RRSIG record and an expired DNSKEY RRset in the
- cache when it is asked to provide both to a client. In this case the
- DNSKEY RRset would need to be looked up again.) This means that once
- the key is no longer used to sign records, it should be retained in
- the zone for at least the retire interval (Iret) given by:
-
- Iret = Dsgn + Dprp + TTLsig
-
- Dsgn is the delay needed to ensure that all existing RRsets have been
- re-signed with the new key. Dprp is (as described above) the
- propagation delay, required to guarantee that the updated zone
- information has reached all slave servers, and TTLsig is the TTL of
- the RRSIG records.
-
- (It should be noted that an upper limit on the retire interval is
- given by:
-
- Iret = Lsig + Dskw
-
- where Lsig is the lifetime of a signature (i.e. the interval between
- the time the signature was created and the signature end time), and
- Dskw is the clock skew - the maximum difference in time between the
- server and a validating resolver. The reasoning here is that
- whatever happens, a key only has to be available while any signatures
- created with it are valid. Wherever a signature record is held -
- published in the zone and/or held in a resolver cache - it won't be
- valid for longer than Lsig after it was created. The Dskw term is
- present to account for the fact that the signature end time is an
- absolute time rather than interval, and systems may not agree exactly
- about the time.)
-
- The time at which all RRSIG records created with this key have
- expired from resolver caches is the dead time (Tdea), given by:
-
- Tdea = Tret + Iret
-
- ...at which point the key is said to be dead.
-
- Event 9: at any time after the key becomes dead, it can be removed
- from the zone and the DNSKEY RRset re-signed with the current key-
- signing key. This time is the removal time (Trem), given by:
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 12]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Trem >= Tdea
-
- ...at which time the key is said to be removed.
-
-3.2.2. Double-Signature Method
-
- In the Double-Signature method, both the new key and signatures
- created using it are introduced at the same time. After a period
- during which this information propagates to validating resolver
- caches, the old key and signature are removed. The time line for the
- method is shown below:
-
-
-
- |1| |2| |3| |4| |5| |6|
- | | | | | |
- Key N | |<-------Lzsk------>|<-----Iret----->| |
- | | | | | |
- Key N+1 | | | |<----------Lzsk------- - -
- | | | | | |
- Tgen Tact Tret Tdea Trem
-
- ---- Time ---->
-
-
- Figure 2: Timeline for a Double-Signature ZSK rollover.
-
- Event 1: key N is generated at the generate time (Tgen). Although
- there is no reason why the key cannot be generated immediately prior
- to publication in the zone (Event 2), some implementations may find
- it convenient to create a pool of keys in one operation and draw from
- that pool as required. For this reason, it is shown as a separate
- event. Keys that are available for use but not published are said to
- be generated.
-
- Event 2: key N is added to the DNSKEY RRset and is immediately used
- to sign the zone; existing signatures in the zone are not removed.
- This is the active time (Tact) and the key is said to be active.
-
- Event 3: at some time later, the predecessor key (key N-1) and its
- signatures can be withdrawn from the zone. (The timing of key
- removal is discussed further in the description of event 5.)
-
- Event 4: the successor key (key N+1) is introduced into the zone and
- starts being used to sign RRsets. The successor is key is now active
- and the current key (key N) is said to be retired. This time is the
- retire time of the key (Tret); it is also the active time of the
- successor key (TactS).
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 13]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Tret = Tact + Lzsk
-
- Event 5: before key N can be withdrawn from the zone, all RRsets that
- need to be signed must have been signed by the successor key (as a
- result, all these RRsets are now signed twice, once by key N and once
- by its successor) and the information must have reached all
- validating resolvers that may have RRsets from this zone cached.
-
- This takes Iret, the retire interval, given by the expression:
-
- Iret = Dsgn + Dprp + max(TTLkey, TTLsig)
-
- As before, Dsgn is the time taken to sign the zone with the new key
- and Dprp is the propagation delay. The final term is the period to
- wait for old key and signature data to expire from caches. After the
- end of this interval, key N is said to be dead. This occurs at the
- dead time (Tdea) so:
-
- Tdea = Tret + Iret
-
- Event 6: at some later time key N and its signatures can be removed
- from the zone. This is the removal time Trem, given by:
-
- Trem >= Tdea
-
-3.2.3. Double-RRSIG Method
-
- As noted above, "Double-Signature" is simultaneous rollover of both
- signature and key. The time line for a pure Double-Signature ZSK
- rollover (the Double-RRSIG method) - where new signatures are
- introduced, the key changed, and finally the old signatures removed -
- is shown below:
-
-
-
- |1||2| |3| |4||5| |6||7| |8||9| |10| |11|
- | | | | | | | | | | |
- Key N | |<-Dsgn->| | |<-----------Lzsk-------->|<-Iret->| |
- | |<---IpubG-->| |<-IpubK->| | | | | |
- | | | | | | | | | | |
- Key N+1 | | | | | | |<-IpubG->| | | |
- | | | | | | | | | | |
- Tgen Tpub Trdy Tact TpubS TrdyS Tret Tdea Trem
-
- ---- Time ---->
-
-
- Figure 3: Timeline for a Double-Signature ZSK rollover.
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 14]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Event 1: key N is generated at the generate time (Tgen). Although
- there is no reason why the key cannot be generated immediately prior
- to publication in the zone (Event 2), some implementations may find
- it convenient to create a pool of keys in one operation and draw from
- that pool as required. For this reason, it is shown as a separate
- event. Keys that are available for use but not published are said to
- be generated.
-
- Event 2: key N is used to sign the zone but existing signatures are
- retained. Although the new ZSK is not published in the zone at this
- point, for analogy with the other ZSK rollover methods and because
- this is the first time that key information is visible (albeit
- indirectly through the created signatures) this time is called the
- publish time (Tpub).
-
- Event 3: after the signing interval, Dsgn, all RRsets that need to be
- signed have been signed by the new key. (As a result, all these
- RRsets are now signed twice, once by the existing key and once by the
- (still-absent) key N.
-
- Event 4: there is now a delay while the this information reaches all
- validating resolvers that may have RRsets from the zone cached. This
- interval is given by the expression:
-
- Dprp + TTLsig
-
- ...comprising the delay for the information to propagate through the
- nameserver infrastructure plus the time taken for signature
- information to expire from caches.
-
- Again in analogy with other key rollover methods, this is defined as
- key N's ready time (Trdy) and the key is said to be in the ready
- state. (Although the key is not in the zone, it is ready to be
- used.) The interval between the publication and ready times is the
- publication interval of the signature, IpubG, i.e.
-
- Trdy = Tpub + IpubG
-
- where
-
- IpubG = Dsgn + Dprp + TTLsig
-
- Event 5: at some later time the predecessor key is removed and the
- key N added to the DNSKEY RRset. As all the RRs have signatures
- created by the old and new keys, the records can still be
- authenticated. This time is the active time (Tact) and the key is
- now said to be active.
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 15]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Event 6: After IpubK - the publication interval of the key - the
- newly added DNSKEY RRset has propagated through to all validating
- resolvers. At this point the old signatures can be removed from the
- zone. IpubK is given by:
-
- IpubK = Dprp + TTLkey
-
- Event 7: as before, at some later time thought must be given to
- rolling the key. The first step is to publish signatures created by
- the successor key (key N+1) early enough so that key N can be
- replaced after it has been active for its scheduled lifetime. This
- occurs at TpubS (the publication time of the successor), given by:
-
- TpubS <= Tact + Lzsk - IpubG
-
- Event 8: the signatures have propagated through the zone and the new
- key could be added to the zone. This time is the ready time of the
- successor (TrdyS).
-
- TrdyS = TpubS + IpubG
-
- ... where IpubG is as defined above.
-
- Event 9: at some later time key N is removed from the zone and the
- successor key added. This is the retire time of the key (Tret).
-
- Event 10: The signatures must remain in the zone for long enough that
- the new DNSKEY RRset has had enough time to propagate to all caches.
- Once caches contain the new DNSKEY, the old signatures are no longer
- of use and can be considered to be dead. The time at which this
- occurs is the dead time (Tdea), given by:
-
- Tdea = Tret + Iret
-
- ... where Iret is the retire interval, given by:
-
- Iret = IpubK
-
- Event 11: At some later time the signatures can be removed from the
- zone. Although the key has is not longer in the zone, this is
- information associated with it and so the time can be regarded as the
- key's remove time (Trem), given by:
-
- Trem >= Tdea
-
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 16]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
-3.3. Key-Signing Key Rollover Timelines
-
-3.3.1. Double-Signature Method
-
- The Double-Signature method (also knows as the double-DNSKEY method)
- involves introducing the new KSK to the zone and waiting until its
- presence has been registered by all validating resolvers. At this
- point, the DS record in the parent is changed. Once that change has
- propagated to all validating resolvers, the old KSK is removed.
-
- The timing diagram for such a rollover is:
-
-
-
- |1| |2| |3| |4| |5| |6|
- | | | | | |
- Key N | |<-Ipub->|<--->|<-Dreg->|<---------Lksk--- - -
- | | | | | |
- Key N+1 | | | | | |
- | | | | | |
- Tgen Tpub Trdy Tsub Tact
-
- ---- Time ---->
-
- (continued...)
-
- |7| |8| |9| |10| |11| |12|
- | | | | | |
- Key N - - -------------Lksk------->|<-Iret->| |
- | | | | | |
- Key N+1 |<-Ipub->|<--->|<-Dreg->|<--------Lksk----- - -
- | | | | | |
- TpubS TrdyS TsubS Tret Tdea Trem
-
- ---- Time (cont) ---->
-
-
- Figure 4: Timeline for a Double-Signature KSK rollover.
-
- Event 1: key N is generated at time Tgen. As before, although there
- is no reason why the key cannot be generated immediately prior to
- publication, some implementations may find it convenient to create a
- central pool of keys and draw from it. For this reason, it is again
- shown as a separate event.
-
- Event 2: key N is introduced into the zone; it is added to the DNSKEY
- RRset, which is then signed by key N and all currently active KSKs.
- (So at this point, the DNSKEY RRset is signed by both key N and its
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 17]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- predecessor KSK. If other KSKs were active, it is signed by these as
- well.) This is the publication time (Tpub); after this the key is
- said to be published.
-
- Event 3: before it can be used, the key must be published for long
- enough to guarantee that any validating resolver that has a copy of
- the DNSKEY RRset from the zone in its cache will have a copy of the
- RRset that includes this key: in other words, that any prior cached
- information about the DNSKEY RRset has expired.
-
- The interval is the publication interval (Ipub) and, for the second
- or subsequent KSKs in the zone, is given by:
-
- Ipub = Dprp + TTLkey
-
- ... where Dprp is the propagation delay for the zone and TTLkey the
- TTL for the DNSKEY RRset. The time at which this occurs is the key's
- ready time, Trdy, given by:
-
- Trdy = Tpub + Ipub
-
- Event 4: at some later time, the DS RR corresponding to the new KSK
- is submitted to the parent zone for publication. This time is the
- submission time, Tsub.
-
- Event 5: the DS record is published in the parent zone. As this is
- the point at which all information for authentication - both DNSKEY
- and DS record - is available in the two zones, it is the active time
- of the key:
-
- Tact = Tsub + Dreg
-
- ... where Dreg is the registration delay, the time taken after the DS
- record has been received by the parent zone manager for it to be
- placed in the zone. (Parent zones are often managed by different
- entities, and this term accounts of the organisational overhead of
- transferring a record.)
-
- Event 6: at some time later, all validating resolvers that have the
- DS RRset cached will have a copy that includes the new DS record.
- For the second or subsequent DS records, this interval is given by
- the expression:
-
- DprpP + TTLds
-
- ... where DprpP is the propagation delay in the parent zone and TTLds
- the TTL assigned to DS records in that zone.
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 18]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- In the case of the first DS record for the zone in question, the
- expression is slightly different because it is not information about
- a DS RRset that may be cached, it is information about its absence.
- In this case, the interval is:
-
- DprpP + IngcP
-
- where IngcP is the negative cache interval from the zone's SOA
- record, calculated according to [RFC2308] as the minimum of the TTL
- of the parent SOA record itself (TTLsoaP), and the "minimum" field in
- the record's parameters (SOAminP), i.e.
-
- IngcP = min(TTLsoaP, SOAminP)
-
- Event 7: while key N is active, thought needs to be given to its
- successor (key N+1). At some time before the scheduled end of the
- KSK lifetime, the successor KSK is introduced into the zone and is
- used to sign the DNSKEY RRset. (As before, this means that the
- DNSKEY RRset is signed by both the current and successor KSK.) This
- is the publication time of the successor key, TpubS.
-
- Event 8: after an interval Ipub, the successor key becomes ready (in
- that all validating resolvers that have a copy of the DNSKEY RRset
- have a copy of this key). This is the successor ready time, TrdyS.
-
- Event 9: at the successor submission time (TsubS), the DS record
- corresponding to the successor key is submitted to the parent zone.
-
- Event 10: the successor DS record is published in the parent zone and
- the current DS record withdrawn. The current key is said to be
- retired and the time at which this occurs is Tret, given by:
-
- The relationships between these times are:
-
- TpubS <= Tact + Lksk - Dreg - Ipub
-
- Tret = Tact + Lksk
-
- ... where Lksk is the scheduled lifetime of the KSK.
-
- Event 11: key N must remain in the zone until any validators that
- have the DS RRset cached have a copy of the DS RRset containing the
- new DS record. This interval is the retire interval, given by:
-
- Iret = DprpP + TTLds
-
- ... where DprpP is the propagation delay in the parent zone and TTLds
- the TTL of a DS record.
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 19]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- As the key is no longer used for anything, it can also be said to be
- dead, in which case:
-
- Tdea = Tret + Iret
-
- Event 12: at some later time, key N is removed from the zone (at the
- remove time Trem); the key is now said to be removed.
-
- Trem >= Tdea
-
-3.3.2. Double-DS Method
-
- The Double-DS method is the reverse of the Double-Signature method is
- that it is the DS record that is pre-published (in the parent), and
- not the DNSKEY.
-
- The timeline for the key rollover is shown below:
-
-
-
- |1| |2| |3| |4| |5| |6|
- | | | | | |
- Key N | |<-Dreg->|<-IpubP->|<-->|<---------Lksk------- - -
- | | | | | |
- Key N+1 | | | | |<---->|<--Dreg+IpubP- - -
- | | | | | |
- Tgen Tsub Tpub Trdy Tact TsubS
-
- ---- Time ---->
-
- (continued...)
-
- |7| |8| |9| |10|
- | | | |
- Key N - - -----Lksk---------->|<-Iret->| |
- | | | |
- Key N+1 - - --Dreg+IpubP->|<--->|<------Lksk------ - -
- | | | |
- TrdyS Tret Tdea Trem
-
- ---- Time ---->
-
-
- Figure 5: Timeline for a Double-DS KSK rollover.
-
- Event 1: key N is generated at time Tgen. As before, although there
- is no reason why the key cannot be generated immediately prior to
- publication, some implementations may find it convenient to create a
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 20]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- central pool of keys and draw from it. For this reason, it is again
- shown as a separate event.
-
- Event 2: the DS record corresponding to key N is submitted for
- publication in the parent zone. This time is the submission time
- (Tsub).
-
- Event 3: after the registration delay, Dreg, the DS record is
- published in the parent zone. This is the publication time Tpub,
- given by:
-
- Tpub = Tsub + Dreg
-
- Event 4: at some later time, any validating resolver that has copies
- of the DS RRset in its cache will have a copy of the DS record for
- key N. At this point, key N, if introduced into the DNSKEY RRset,
- could be used to validate the zone. For this reason, this time is
- known as the key's ready time, Trdy, and is given by:
-
- Trdy = Tpub + IpubP
-
- IpubP is the parent publication interval and is given by the
- expression:
-
- IpubP = DprpP + TTLds
-
- ... where DprpP is the propagation delay in the parent zone and TTLds
- the TTL assigned to DS records in that zone.
-
- Event 5: at some later time, the key rollover takes place. The
- predecessor key is withdrawn from the DNSKEY RRset and the new key
- (key N) introduced and used to sign the RRset.
-
- As both DS records have been in the parent zone long enough to ensure
- that they are in the cache of any validating resolvers that have the
- DS RRset cached, the zone can be authenticated throughout the
- rollover - either the resolver has a copy of the DNSKEY RRset (and
- associated RRSIGs) authenticated by the predecessor key, or it has a
- copy of the updated RRset authenticated with the new key.
-
- This time is the key's active time (Tact) and at this point the key
- is said to be active.
-
- Event 6: at some point thought must be given to key replacement. The
- DS record for the successor key must be submitted to the parent zone
- at a time such that when the current key is withdrawn, any validating
- resolver that has DS records in its cache will have data about the DS
- record of the successor key. The time at which this occurs is the
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 21]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- submission time of the successor, given by:
-
- TsubS <= Tact + Lksk - IpubP - Dreg
-
- ... where Lksk is the lifetime of the KSK.
-
- Event 7: the successor key (key N+1) enters the ready state i.e. its
- DS record is now in the caches of all validating resolvers that have
- the parent DS RRset cached. (This is the ready time of the
- successor, TrdyS.)
-
- Event 8: when the current key has been active for its lifetime
- (Lksk), the current key is removed from the DNSKEY RRset and the
- successor key added; the RRset is then signed with the successor key.
- This point is the retire time of the key, Tret, given by:
-
- Tret = Tact + Lksk
-
- Event 9: at some later time, all copies of the old DNSKEY RRset have
- expired from caches and the old DS record is no longer needed. This
- is called the dead time, Tdea, and is given by:
-
- Tdea = Tret + Iret
-
- ... where Iret is the retire interval, given by:
-
- Iret = Dprp + TTLkey
-
- As before, this term includes the time taken to propagate the RRset
- change through the master-slave hierarchy and the time take for the
- DNSKEY RRset to expire from caches.
-
- Event 10: at some later time, the DS record is removed from the
- parent zone. This is the removal time (Trem), given by:
-
- Trem >= Tdea
-
-3.3.3. Double-RRset Method
-
- In the Double-RRset method, both the DS and DNSKEY records are
- changed at the same time, so for a period the zone can be
- authenticated with either key. The advantage of this method is its
- applicability in cases where zone management policy requires overlap
- of authentication keys during a roll.
-
- The timeline for this rollover is shown below:
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 22]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- |1| |2| |3| |4| |5| |6| |7|
- | | | | | | |
- Key N | |<-Dreg->|<-----Lksk----->|<-Iret->| |
- | | | | | | |
- Key N+1 | | | |<-Dreg->|<-----Lksk-- - -
- | | | | | | |
- Tgen Tpub Tact TpubS Tret Tdea Trem
-
- ---- Time ---->
-
-
- Figure 6: Timeline for a Double-RRset KSK rollover.
-
- Event 1: key N is created at time Tgen and thereby immediately
- becomes generated. As before, although there is no reason why the
- key cannot be generated immediately prior to publication, some
- implementations may find it convenient to create a central pool of
- keys and draw from it. For this reason, it is again shown as a
- separate event.
-
- Event 2: the key is added to and used for signing the DNSKEY RRset
- and is thereby published in the zone. At the same time the
- corresponding DS record is submitted to the parent zone for
- publication. This time is the publish time (Tpub) and the key is now
- said to be published.
-
- Event 3: after Dreg, the registration delay, the DS record is
- published in the parent zone. At this point, the zones have all the
- information needed for a validating resolver to authenticate the
- zone, although the information may not yet have reached all
- validating resolver caches. This time is the active time (Tact) and
- the key is said to be active.
-
- Tact = Tpub + Dreg
-
- Event 4: at some point we need to give thought to key replacement.
- The successor key must be introduced into the zone (and its DS record
- submitted to the parent) at a time such that it becomes active when
- the current key has been active for its lifetime, Lksk. This time is
- TpubS, the publication time of the successor key, and is given by:
-
- TpubS <= Tact + Lksk - Dreg
-
- ... where Lksk is the lifetime of the KSK.
-
- Event 5: the successor key's DS record appears in the parent zone and
- the successor key becomes active. At this point, the current key
- becomes retired. This occurs at Tret, given by:
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 23]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Tret = Tact + Lksk
-
- Event 6: the current DNSKEY and DS record must be retained in the
- zones until any any validating resolver that has cached the DNSKEY
- and/or DS RRsets will have a copy of the data for the successor key.
- At this point the current key information is dead, as any validating
- resolver can perform authentication using the successor key. This is
- the dead time, Tdea, given by:
-
- Tdea = Tret + Iret
-
- ... where Iret is the retire interval. This depends on how long both
- the successor DNSKEY and DS records take to propagate through the
- nameserver infrastructure and thence into validator caches. These
- delays are the publication intervals of the child and parent zones
- respectively, so a suitable expression for Iret is:
-
- Iret = max(IpubP, IpubC)
-
- IpubC is the publication interval of the DNSKEY in the child zone,
- IpubP that of the DS record in the parent.
-
- The child term comprises two parts - the time taken for the
- introduction of the DNSKEY record to be propagated to the downstream
- secondary servers (= DprpC, the child propagation delay) and the time
- taken for information about the DNSKEY RRset to expire from the
- validating resolver cache, i.e.
-
- IpubC = DprpC + TTLkey
-
- TTLkey is the TTL for a DNSKEY record in the child zone. The parent
- term is similar:
-
- IpubP = DprpP + TTLds
-
- DprpP the propagation delay in the parent zone and TTLds the TTL for
- a DS record in the parent zone.
-
- Event 7: at some later time, the DNSKEY record can be removed from
- the child zone and a request can be made to remove the DS record from
- the parent zone. This is the removal time, Trem and is given by:
-
- Trem >= Tdea
-
-
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 24]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
-3.3.4. Interaction with Configured Trust Anchors
-
- Although the preceding sections have been concerned with rolling KSKs
- where the trust anchor is a DS record in the parent zone, zone
- managers may want to take account of the possibility that some
- validating resolvers may have configured trust anchors directly.
-
- Rolling a configured trust anchor is dealt with in [RFC5011]. It
- requires introducing the KSK to be used as the trust anchor into the
- zone for a period of time before use, and retaining it (with the
- "revoke" bit set) for some time after use. The Double-Signature and
- Double-RRset methods can be adapted to include [RFC5011]
- recommendations so that the rollover will also be signalled to
- validating resolvers with configured trust anchors. (The
- recommendations are not suitable for the Double-DS method.
- Introducing the new key early and retaining the old key after use
- effectively converts it into a form of Double-RRset.)
-
-3.3.4.1. Addition of KSK
-
- When the new key is introduced, the publication interval (Ipub) in
- the Double-Signature method should also be subject to the condition:
-
- Ipub >= max(30 days, TTLkey)
-
- ... where the right had side of the expression is the add hold-down
- time defined in section 2.4.1 of [RFC5011].
-
- In the Double-RRSIG method, the key should not be regarded as being
- active until the add hold-down time has passed. In other words, the
- following condition should be enforced:
-
- Tact >= Tpub + max(30 days, TTLkey)
-
- (Effectively, this means extending the lifetime of the key by an
- appropriate amount.)
-
-3.3.4.2. Removal of KSK
-
- The timeline for the removal of the key in both methods is modified
- by introducing a new state, "revoked". When the key reaches the end
- of the retire period, instead of being declared "dead", it is
- revoked; the "revoke" bit is set on the DNSKEY RR and is published in
- (and used to sign) the DNSKEY RRset. The key is maintained in this
- state for the "revoke" interval, Irev, given by:
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 25]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Irev >= 30 days
-
- ... 30 days being the [RFC5011] remove hold-down time. After this
- time, the key is dead and can be removed from the zone when
- convenient.
-
-3.3.5. Introduction of First KSK
-
- There is an additional consideration when introducing a KSK into a
- zone for the first time, and that is that no validating resolver
- should be in a position where it can access the trust anchor before
- the KSK appears in the zone. To do so will cause the validating
- resolver to declare the zone to be bogus.
-
- This is important: in the case of a secure parent, it means ensuring
- that the DS record is not published in the parent zone until there is
- no possibility that a validating resolver can obtain the record yet
- not be able to obtain the corresponding DNSKEY. In the case of an
- insecure parent, i.e. the initial creation of a new security apex, it
- is important to not configure trust anchors in validating resolvers
- until the DNSKEY RRset has had sufficient time to propagate. In both
- cases, this time is the trust anchor availability time (Ttaa) given
- by:
-
- Ttaa >= Tpub + IpubC
-
- where
-
- IpubC = DprpC + TTLkeyC
-
- or
-
- IpubC = DprpC + IngcC
-
- The first expression applies if there was previously a DNSKEY RRset
- in the child zone, the expression for IpubC including the TTLkeyC
- term to account for the time taken for that RRset to expire from
- caches. (It is possible that the zone was signed but that the trust
- anchor had not been submitted to the parent.)
-
- If the introduction of the KSK caused the appearance of the first
- DNSKEY RRset in the child zone, the second expression applies in
- which the TTLkeyC term is replaced by Ingc to allow for the effect of
- negative caching.
-
- As before, IngcC is the negative cache interval from the child zone's
- SOA record, calculated according to [RFC2308] as the minimum of the
- TTL of the SOA record itself (TTLsoaC), and the "minimum" field in
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 26]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- the record's parameters (SOAminC), i.e.
-
- IngcC = min(TTLsoaC, SOAminC)
-
-
-4. Standby Keys
-
- Although keys will usually be rolled according to some regular
- schedule, there may be occasions when an emergency rollover is
- required, e.g. if the active key is suspected of being compromised.
- The aim of the emergency rollover is to allow the zone to be re-
- signed with a new key as soon as possible. As a key must be in the
- ready state to sign the zone, having at least one additional key (a
- standby key) in this state at all times will minimise delay.
-
- In the case of a ZSK, a standby key only really makes sense with the
- Pre-Publication method. A permanent standby DNSKEY RR should be
- included in zone or successor keys could be introduced as soon as
- possible after a key becomes active. Either way results in an
- additional ZSK in the DNSKEY RRset that can immediately be used to
- sign the zone if the current key is compromised.
-
- (Although in theory the mechanism could be used with both the Double-
- Signature and Double-RRSIG methods, it would require Pre-Publication
- of the signatures. Essentially, the standby key would be permanently
- active, as it would have to be periodically used to renew signatures.
- Zones would also permanently require two sets of signatures,
- something that could have a performance impact in large zones.)
-
- A standby key can also be used with the Double-Signature and
- Double-DS methods of rolling a KSK. (The idea of a standby key in
- the Double-RRset effectively means having two active keys.) The
- Double-Signature method requires that the standby KSK be included in
- the DNSKEY RRset; rolling the key then requires just the introduction
- of the DS record in the parent. (Note that the DNSKEY should also be
- used to sign the DNSKEY RRset. As the RRset and its signatures
- travel together, merely adding the DNSKEY does not provide the
- desired time saving; to be used in a rollover requires that the
- DNSKEY RRset be signed with the standby key, and this introduces a
- delay whilst the RRset and its signatures propagate to the caches of
- validating resolvers. There is no time advantage over introducing a
- new DNSKEY and signing the RRset with it at the same time.)
-
- In the Double-DS method of rolling a KSK, it is not a standby key
- that is present, it is a standby DS record in the parent zone.
- Whatever algorithm is used, the standby item of data can be
- introduced as a permanent standby, or be a successor introduced as
- early as possible.
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 27]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
-5. Algorithm Considerations
-
- The preceding sections have implicitly assumed that all keys and
- signatures are created using a single algorithm. However, [RFC4035]
- (section 2.4) states that "There MUST be an RRSIG for each RRset
- using at least one DNSKEY of each algorithm in the zone apex DNSKEY
- RRset".
-
- Except in the case of an algorithm rollover - where the algorithms
- used to create the signatures are being changed - there is no
- relationship between the keys of different algorithms. This means
- that they can be rolled independently of one another. In other
- words, the key rollover logic described above should be run
- separately for each algorithm; the union of the results is included
- in the zone, which is signed using the active key for each algorithm.
-
-
-6. Summary
-
- For ZSKs, "Pre-Publication" is generally considered to be the
- preferred way of rolling keys. As shown in this document, the time
- taken to roll is wholly dependent on parameters under the control of
- the zone manager.
-
- In contrast, "Double-RRset" is the most efficient method for KSK
- rollover due to the ability to have new DS records and DNSKEY RRsets
- propagate in parallel. The time taken to roll KSKs may depend on
- factors related to the parent zone if the parent is signed. For
- zones that intend to comply with the recommendations of [RFC5011], in
- virtually all cases the rollover time will be determined by the
- RFC5011 "add hold-down" and "remove hold-down" times. It should be
- emphasized that this delay is a policy choice and not a function of
- timing values and that it also requires changes to the rollover
- process due to the need to manage revocation of trust anchors.
-
- Finally, the treatment of emergency key rollover is significantly
- simplified by the introduction of stand-by keys as standard practice
- during all types of rollovers.
-
-
-7. IANA Considerations
-
- This memo includes no request to IANA.
-
-
-8. Security Considerations
-
- This document does not introduce any new security issues beyond those
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 28]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- already discussed in [RFC4033], [RFC4034], [RFC4035] and [RFC5011].
-
-
-9. Acknowledgements
-
- The authors gratefully acknowledge help and contributions from Roy
- Arends and Wouter Wijngaards.
-
-
-10. Change History
-
- o draft-morris-dnsop-dnssec-key-timing-02
- * General restructuring.
- * Added descriptions of more rollovers (IETF-76 meeting).
- * Improved description of key states and removed diagram.
- * Provided simpler description of standby keys.
- * Added section concerning first key in a zone.
- * Moved [RFC5011] to a separate section.
- * Various nits fixed (Alfred Hones, Jeremy Reed, Scott Rose, Sion
- Lloyd, Tony FinchX).
-
- o draft-morris-dnsop-dnssec-key-timing-01
- * Use latest boilerplate for IPR text.
- * List different ways to roll a KSK (acknowledgements to Mark
- Andrews).
- * Restructure to concentrate on key timing, not management
- procedures.
- * Change symbol notation (Diane Davidowicz and others).
- * Added key state transition diagram (Diane Davidowicz).
- * Corrected spelling, formatting, grammatical and style errors
- (Diane Davidowicz, Alfred Hoenes and Jinmei Tatuya).
- * Added note that in the case of multiple algorithms, the
- signatures and rollovers for each algorithm can be considered as
- more or less independent (Alfred Hoenes).
- * Take account of the fact that signing a zone is not atomic
- (Chris Thompson).
- * Add section contrasting pre-publication rollover with double
- signature rollover (Matthijs Mekking).
- * Retained distinction between first and subsequent keys in
- definition of initial publication interval (Matthijs Mekking).
-
- o draft-morris-dnsop-dnssec-key-timing-00
- Initial draft.
-
-
-11. References
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 29]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
-11.1. Normative References
-
- [RFC2308] Andrews, M., "Negative Caching of DNS Queries (DNS
- NCACHE)", RFC 2308, March 1998.
-
- [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S.
- Rose, "DNS Security Introduction and Requirements",
- RFC 4033, March 2005.
-
- [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S.
- Rose, "Resource Records for the DNS Security Extensions",
- RFC 4034, March 2005.
-
- [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S.
- Rose, "Protocol Modifications for the DNS Security
- Extensions", RFC 4035, March 2005.
-
- [RFC5011] StJohns, M., "Automated Updates of DNS Security (DNSSEC)
- Trust Anchors", RFC 5011, September 2007.
-
-11.2. Informative References
-
- [RFC4641] Kolkman, O. and R. Gieben, "DNSSEC Operational Practices",
- RFC 4641, September 2006.
-
-
-Appendix A. List of Symbols
-
- The document defines a number of symbols, all of which are listed
- here. All are of the form:
-
- All symbols used in the text are of the form:
-
- <TYPE><id><INST>
-
- where:
-
- <TYPE> is an upper-case character indicating what type the symbol is.
- Defined types are:
-
- D delay: interval that is a feature of the process
-
- I interval between two events
-
- L lifetime: interval set by the zone manager
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 30]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- SOA parameter related to SOA RR
-
- T a point in time
-
- TTL TTL of a record
-
- T and I are self-explanatory. D, and L are also time periods, but
- whereas I values are intervals between two events (even if the events
- are defined in terms of the interval, e.g. the dead time occurs
- "retire interval" after the retire time), D, and L are fixed
- intervals. An "L" interval (lifetime) is chosen by the zone manager
- and is a feature of policy. A "D" interval (delay) is a feature of
- the process, probably outside control of the zone manager. SOA and
- TTL are used just because they are common terms.
-
- <id> is lower-case and defines what object or event the variable is
- related to, e.g.
-
- act active
-
- ngc negative cache
-
- pub publication
-
- Finally, <INST> is a capital letter that distinguishes between the
- same variable applying to different instances of an object and is one
- of:
-
- C child
-
- G signature
-
- K key
-
- P parent
-
- S successor
-
- The list of variables used in the text is:
-
- Dprp Propagation delay. The amount of time for a change made at
- a master nameserver to propagate to all the slave
- nameservers.
-
- DprpC Propagation delay in the child zone.
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 31]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- DprpP Propagation delay in the parent zone.
-
- Dreg Registration delay. As a parent zone is often managed by a
- different organisation to that managing the child zone, the
- delays associated with passing data between zones is
- captured by this term.
-
- Dskw Clock skew. The maximum difference in time between the
- signing system and the resolver.
-
- Dsgn Signing delay. After the introduction of a new ZSK, the
- amount of time taken for all the RRs in the zone to be
- signed with it.
-
- Ingc Negative cache interval.
-
- IngcP Negative cache interval of the child zone.
-
- IngcP Negative cache interval of the parent zone.
-
- Ipub Publication interval. The amount of time that must elapse
- after the publication of a key before it can be considered
- to have entered the ready state.
-
- IpubC Publication interval in the child zone.
-
- IpubG Publication interval for the signature.
-
- IpubK Publication interval for the key.
-
- IpubP Publication interval in the parent zone.
-
- Iret Retire interval. The amount of time that must elapse after
- a key enters the retire state for any signatures created
- with it to be purged from validating resolver caches.
-
- Irev Revoke interval. The amount of time that a KSK must remain
- published with the revoke bit set to satisfy [RFC5011]
- considerations.
-
- Lksk Lifetime of a key-signing key. This is the intended amount
- of time for which this particular KSK is regarded as the
- active KSK. Depending on when the key is rolled-over, the
- actual lifetime may be longer or shorter than this.
-
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 32]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Lzsk Lifetime of a zone-signing key. This is the intended
- amount of time for which the ZSK is used to sign the zone.
- Depending on when the key is rolled-over, the actual
- lifetime may be longer or shorter than this.
-
- Lsig Lifetime of a signature: the difference in time between the
- signature's expiration time and the time at which the
- signature was created. (Note that this is not the
- difference between the signature's expiration and inception
- times: the latter is usually set a small amount of time
- before the signature is created to allow for clock skew
- between the signing system and the validating resolver.)
-
- SOAmin Value of the "minimum" field from an SOA record.
-
- SOAminC Value of the "minimum" field from an SOA record in the
- child zone.
-
- SOAminP Value of the "minimum" field from an SOA record in the
- parent zone.
-
- Tact Active time of the key; the time at which the key is
- regarded as the principal key for the zone.
-
- TactS Active time of the successor key.
-
- Tdea Dead time of a key. Applicable only to ZSKs, this is the
- time at which any record signatures held in validating
- resolver caches are guaranteed to be created with the
- successor key.
-
- Tgen Generate time of a key. The time that a key is created.
-
- Tpub Publish time of a key. The time that a key appears in a
- zone for the first time.
-
- TpubS Publish time of the successor key.
-
- Trem Removal time of a key. The time at which a key is removed
- from the zone.
-
- Tret Retire time of a key. The time at which a successor key
- starts being used to sign the zone.
-
- Trdy Ready time of a key. The time at which it can be
- guaranteed that validating resolvers that have key
- information from this zone cached have a copy of this key
- in their cache. (In the case of KSKs, should the
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 33]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- validating resolvers also have DS information from the
- parent zone cached, the cache must include information
- about the DS record corresponding to the key.)
-
- TrdyS Ready time of a successor key.
-
- Tsub Submit time - the time at which the DS record of a KSK is
- submitted to the parent.
-
- TsubS Submit time of the successor key.
-
- TTLds Time to live of a DS record (in the parent zone).
-
- TTLkey Time to live of a DNSKEY record.
-
- TTLkeyC Time to live of a DNSKEY record in the child zone.
-
- TTLsoa Time to live of a SOA record.
-
- TTLsoaC Time to live of a SOA record in the child zone.
-
- TTLsoaP Time to live of a SOA record in the parent zone.
-
- TTLsig Time to live of an RRSIG record.
-
- Ttaa Trust anchor availability time. The time at which a trust
- anchor record can be made available when a KSK is first
- introduced into a zone.
-
-
-Authors' Addresses
-
- Stephen Morris
- Internet Systems Consortium
- 950 Charter Street
- Redwood City, CA 94063
- USA
-
- Phone: +1 650 423 1300
- Email: stephen@isc.org
-
-
-
-
-
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 34]
-
-Internet-Draft DNSSEC Key Timing Considerations July 2010
-
-
- Johan Ihren
- Netnod
- Franzengatan 5
- Stockholm, SE-112 51
- Sweden
-
- Phone: +46 8615 8573
- Email: johani@autonomica.se
-
-
- John Dickinson
- Sinodun Internet Technologies Ltd
- Stables 4 Suite 11, Howbery Park
- Wallingford, Oxfordshire OX10 8BA
- UK
-
- Phone: +44 1491 818120
- Email: jad@sinodun.com
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Morris, et al. Expires January 2, 2011 [Page 35]
-
diff --git a/external/bsd/bind/dist/lib/bind9/check.c b/external/bsd/bind/dist/lib/bind9/check.c
index 6d3f6a2d11b..b9cded34bc0 100644
--- a/external/bsd/bind/dist/lib/bind9/check.c
+++ b/external/bsd/bind/dist/lib/bind9/check.c
@@ -1,4 +1,4 @@
-/* $NetBSD: check.c,v 1.2 2011/02/16 03:47:02 christos Exp $ */
+/* $NetBSD: check.c,v 1.3 2011/09/11 18:55:33 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: check.c,v 1.125 2011-01-07 23:47:07 tbox Exp */
+/* Id: check.c,v 1.133 2011-06-17 07:05:02 each Exp */
/*! \file */
@@ -1225,7 +1225,9 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
#define FORWARDZONE 16
#define DELEGATIONZONE 32
#define STATICSTUBZONE 64
-#define CHECKACL 128
+#define REDIRECTZONE 128
+#define STREDIRECTZONE 0 /* Set to REDIRECTZONE to allow xfr-in. */
+#define CHECKACL 256
typedef struct {
const char *name;
@@ -1254,30 +1256,30 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
const cfg_listelt_t *element;
static optionstable options[] = {
- { "allow-query", MASTERZONE | SLAVEZONE | STUBZONE | CHECKACL |
- STATICSTUBZONE },
+ { "allow-query", MASTERZONE | SLAVEZONE | STUBZONE | REDIRECTZONE |
+ CHECKACL | STATICSTUBZONE },
{ "allow-notify", SLAVEZONE | CHECKACL },
{ "allow-transfer", MASTERZONE | SLAVEZONE | CHECKACL },
{ "notify", MASTERZONE | SLAVEZONE },
{ "also-notify", MASTERZONE | SLAVEZONE },
- { "dialup", MASTERZONE | SLAVEZONE | STUBZONE },
+ { "dialup", MASTERZONE | SLAVEZONE | STUBZONE | STREDIRECTZONE },
{ "delegation-only", HINTZONE | STUBZONE | DELEGATIONZONE },
{ "forward", MASTERZONE | SLAVEZONE | STUBZONE | FORWARDZONE },
{ "forwarders", MASTERZONE | SLAVEZONE | STUBZONE | FORWARDZONE },
- { "maintain-ixfr-base", MASTERZONE | SLAVEZONE },
- { "max-ixfr-log-size", MASTERZONE | SLAVEZONE },
+ { "maintain-ixfr-base", MASTERZONE | SLAVEZONE | STREDIRECTZONE },
+ { "max-ixfr-log-size", MASTERZONE | SLAVEZONE | STREDIRECTZONE },
{ "notify-source", MASTERZONE | SLAVEZONE },
{ "notify-source-v6", MASTERZONE | SLAVEZONE },
- { "transfer-source", SLAVEZONE | STUBZONE },
- { "transfer-source-v6", SLAVEZONE | STUBZONE },
- { "max-transfer-time-in", SLAVEZONE | STUBZONE },
+ { "transfer-source", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+ { "transfer-source-v6", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+ { "max-transfer-time-in", SLAVEZONE | STUBZONE | STREDIRECTZONE },
{ "max-transfer-time-out", MASTERZONE | SLAVEZONE },
- { "max-transfer-idle-in", SLAVEZONE | STUBZONE },
+ { "max-transfer-idle-in", SLAVEZONE | STUBZONE | STREDIRECTZONE },
{ "max-transfer-idle-out", MASTERZONE | SLAVEZONE },
- { "max-retry-time", SLAVEZONE | STUBZONE },
- { "min-retry-time", SLAVEZONE | STUBZONE },
- { "max-refresh-time", SLAVEZONE | STUBZONE },
- { "min-refresh-time", SLAVEZONE | STUBZONE },
+ { "max-retry-time", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+ { "min-retry-time", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+ { "max-refresh-time", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+ { "min-refresh-time", SLAVEZONE | STUBZONE | STREDIRECTZONE },
{ "dnssec-secure-to-insecure", MASTERZONE },
{ "sig-validity-interval", MASTERZONE },
{ "sig-re-signing-interval", MASTERZONE },
@@ -1285,17 +1287,17 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
{ "sig-signing-type", MASTERZONE },
{ "sig-signing-signatures", MASTERZONE },
{ "zone-statistics", MASTERZONE | SLAVEZONE | STUBZONE |
- STATICSTUBZONE},
+ STATICSTUBZONE| REDIRECTZONE },
{ "allow-update", MASTERZONE | CHECKACL },
{ "allow-update-forwarding", SLAVEZONE | CHECKACL },
- { "file", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE },
- { "journal", MASTERZONE | SLAVEZONE },
+ { "file", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE | REDIRECTZONE },
+ { "journal", MASTERZONE | SLAVEZONE | STREDIRECTZONE },
{ "ixfr-base", MASTERZONE | SLAVEZONE },
{ "ixfr-tmp-file", MASTERZONE | SLAVEZONE },
- { "masters", SLAVEZONE | STUBZONE },
+ { "masters", SLAVEZONE | STUBZONE | REDIRECTZONE },
{ "pubkey", MASTERZONE | SLAVEZONE | STUBZONE },
{ "update-policy", MASTERZONE },
- { "database", MASTERZONE | SLAVEZONE | STUBZONE },
+ { "database", MASTERZONE | SLAVEZONE | STUBZONE | REDIRECTZONE },
{ "key-directory", MASTERZONE },
{ "check-wildcard", MASTERZONE },
{ "check-mx", MASTERZONE },
@@ -1303,20 +1305,22 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
{ "integrity-check", MASTERZONE },
{ "check-mx-cname", MASTERZONE },
{ "check-srv-cname", MASTERZONE },
- { "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE },
+ { "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE |
+ REDIRECTZONE },
{ "update-check-ksk", MASTERZONE },
{ "dnssec-dnskey-kskonly", MASTERZONE },
+ { "dnssec-loadkeys-interval", MASTERZONE },
{ "auto-dnssec", MASTERZONE },
- { "try-tcp-refresh", SLAVEZONE },
+ { "try-tcp-refresh", SLAVEZONE | STREDIRECTZONE },
{ "server-addresses", STATICSTUBZONE },
{ "server-names", STATICSTUBZONE },
};
static optionstable dialups[] = {
- { "notify", MASTERZONE | SLAVEZONE },
- { "notify-passive", SLAVEZONE },
- { "refresh", SLAVEZONE | STUBZONE },
- { "passive", SLAVEZONE | STUBZONE },
+ { "notify", MASTERZONE | SLAVEZONE | STREDIRECTZONE },
+ { "notify-passive", SLAVEZONE | STREDIRECTZONE },
+ { "refresh", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+ { "passive", SLAVEZONE | STUBZONE | STREDIRECTZONE },
};
znamestr = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
@@ -1346,6 +1350,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
ztype = HINTZONE;
else if (strcasecmp(typestr, "delegation-only") == 0)
ztype = DELEGATIONZONE;
+ else if (strcasecmp(typestr, "redirect") == 0)
+ ztype = REDIRECTZONE;
else {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
"zone '%s': invalid type %s",
@@ -1353,6 +1359,11 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
return (ISC_R_FAILURE);
}
+ if (ztype == REDIRECTZONE && strcmp(znamestr, ".") != 0) {
+ cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR,
+ "redirect zones must be called \".\"");
+ return (ISC_R_FAILURE);
+ }
obj = cfg_tuple_get(zconfig, "class");
if (cfg_obj_isstring(obj)) {
isc_textregion_t r;
@@ -1394,7 +1405,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
zname = dns_fixedname_name(&fixedname);
dns_name_format(zname, namebuf, sizeof(namebuf));
- tresult = nameexist(zconfig, namebuf, ztype == HINTZONE ? 1 : 2,
+ tresult = nameexist(zconfig, namebuf, ztype == HINTZONE ? 1 :
+ ztype == REDIRECTZONE ? 2 : 3,
symtab, "zone '%s': already exists "
"previous definition: %s:%u", logctx, mctx);
if (tresult != ISC_R_SUCCESS)
@@ -2001,7 +2013,7 @@ check_trusted_key(const cfg_obj_t *key, isc_boolean_t managed,
const char *keystr, *keynamestr;
dns_fixedname_t fkeyname;
dns_name_t *keyname;
- isc_buffer_t keydatabuf;
+ isc_buffer_t b;
isc_region_t r;
isc_result_t result = ISC_R_SUCCESS;
isc_result_t tresult;
@@ -2011,9 +2023,20 @@ check_trusted_key(const cfg_obj_t *key, isc_boolean_t managed,
flags = cfg_obj_asuint32(cfg_tuple_get(key, "flags"));
proto = cfg_obj_asuint32(cfg_tuple_get(key, "protocol"));
alg = cfg_obj_asuint32(cfg_tuple_get(key, "algorithm"));
+
+ dns_fixedname_init(&fkeyname);
keyname = dns_fixedname_name(&fkeyname);
keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
+ isc_buffer_init(&b, keynamestr, strlen(keynamestr));
+ isc_buffer_add(&b, strlen(keynamestr));
+ result = dns_name_fromtext(keyname, &b, dns_rootname, 0, NULL);
+ if (result != ISC_R_SUCCESS) {
+ cfg_obj_log(key, logctx, ISC_LOG_WARNING, "bad key name: %s\n",
+ isc_result_totext(result));
+ result = ISC_R_FAILURE;
+ }
+
if (flags > 0xffff) {
cfg_obj_log(key, logctx, ISC_LOG_WARNING,
"flags too big: %u\n", flags);
@@ -2043,17 +2066,17 @@ check_trusted_key(const cfg_obj_t *key, isc_boolean_t managed,
}
}
- isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
+ isc_buffer_init(&b, keydata, sizeof(keydata));
keystr = cfg_obj_asstring(cfg_tuple_get(key, "key"));
- tresult = isc_base64_decodestring(keystr, &keydatabuf);
+ tresult = isc_base64_decodestring(keystr, &b);
if (tresult != ISC_R_SUCCESS) {
cfg_obj_log(key, logctx, ISC_LOG_ERROR,
"%s", isc_result_totext(tresult));
result = ISC_R_FAILURE;
} else {
- isc_buffer_usedregion(&keydatabuf, &r);
+ isc_buffer_usedregion(&b, &r);
if ((alg == DST_ALG_RSASHA1 || alg == DST_ALG_RSAMD5) &&
r.length > 1 && r.base[0] == 1 && r.base[1] == 3)
@@ -2077,9 +2100,16 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
isc_symtab_t *symtab = NULL;
isc_result_t result = ISC_R_SUCCESS;
isc_result_t tresult = ISC_R_SUCCESS;
- cfg_aclconfctx_t actx;
+ cfg_aclconfctx_t *actx = NULL;
const cfg_obj_t *obj;
+ const cfg_obj_t *options = NULL;
isc_boolean_t enablednssec, enablevalidation;
+ const char *valstr = "no";
+
+ /*
+ * Get global options block
+ */
+ (void)cfg_map_get(config, "options", &options);
/*
* Check that all zone statements are syntactically correct and
@@ -2090,7 +2120,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
if (tresult != ISC_R_SUCCESS)
return (ISC_R_NOMEMORY);
- cfg_aclconfctx_init(&actx);
+ cfg_aclconfctx_create(mctx, &actx);
if (voptions != NULL)
(void)cfg_map_get(voptions, "zone", &zones);
@@ -2105,7 +2135,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
const cfg_obj_t *zone = cfg_listelt_value(element);
tresult = check_zoneconf(zone, voptions, config, symtab,
- vclass, &actx, logctx, mctx);
+ vclass, actx, logctx, mctx);
if (tresult != ISC_R_SUCCESS)
result = ISC_R_FAILURE;
}
@@ -2116,8 +2146,6 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
* Check that forwarding is reasonable.
*/
if (voptions == NULL) {
- const cfg_obj_t *options = NULL;
- (void)cfg_map_get(config, "options", &options);
if (options != NULL)
if (check_forward(options, NULL,
logctx) != ISC_R_SUCCESS)
@@ -2131,8 +2159,6 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
* Check that dual-stack-servers is reasonable.
*/
if (voptions == NULL) {
- const cfg_obj_t *options = NULL;
- (void)cfg_map_get(config, "options", &options);
if (options != NULL)
if (check_dual_stack(options, logctx) != ISC_R_SUCCESS)
result = ISC_R_FAILURE;
@@ -2193,8 +2219,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
obj = NULL;
if (voptions != NULL)
(void)cfg_map_get(voptions, "dnssec-enable", &obj);
- if (obj == NULL)
- (void)cfg_map_get(config, "dnssec-enable", &obj);
+ if (obj == NULL && options != NULL)
+ (void)cfg_map_get(options, "dnssec-enable", &obj);
if (obj == NULL)
enablednssec = ISC_TRUE;
else
@@ -2203,16 +2229,23 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
obj = NULL;
if (voptions != NULL)
(void)cfg_map_get(voptions, "dnssec-validation", &obj);
- if (obj == NULL)
- (void)cfg_map_get(config, "dnssec-validation", &obj);
- if (obj == NULL)
- enablevalidation = ISC_FALSE; /* XXXMPA Change for 9.5. */
- else
+ if (obj == NULL && options != NULL)
+ (void)cfg_map_get(options, "dnssec-validation", &obj);
+ if (obj == NULL) {
+ enablevalidation = enablednssec;
+ valstr = "yes";
+ } else if (cfg_obj_isboolean(obj)) {
enablevalidation = cfg_obj_asboolean(obj);
+ valstr = enablevalidation ? "yes" : "no";
+ } else {
+ enablevalidation = ISC_TRUE;
+ valstr = "auto";
+ }
if (enablevalidation && !enablednssec)
cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
- "'dnssec-validation yes;' and 'dnssec-enable no;'");
+ "'dnssec-validation %s;' and 'dnssec-enable no;'",
+ valstr);
/*
* Check trusted-keys and managed-keys.
@@ -2268,25 +2301,25 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
if (tresult != ISC_R_SUCCESS)
result = tresult;
- tresult = check_viewacls(&actx, voptions, config, logctx, mctx);
+ tresult = check_viewacls(actx, voptions, config, logctx, mctx);
if (tresult != ISC_R_SUCCESS)
result = tresult;
- tresult = check_recursionacls(&actx, voptions, viewname,
+ tresult = check_recursionacls(actx, voptions, viewname,
config, logctx, mctx);
if (tresult != ISC_R_SUCCESS)
result = tresult;
- tresult = check_filteraaaa(&actx, voptions, viewname, config,
+ tresult = check_filteraaaa(actx, voptions, viewname, config,
logctx, mctx);
if (tresult != ISC_R_SUCCESS)
result = tresult;
- tresult = check_dns64(&actx, voptions, config, logctx, mctx);
+ tresult = check_dns64(actx, voptions, config, logctx, mctx);
if (tresult != ISC_R_SUCCESS)
result = tresult;
- cfg_aclconfctx_clear(&actx);
+ cfg_aclconfctx_detach(&actx);
return (result);
}
@@ -2443,7 +2476,7 @@ bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
isc_mem_t *mctx)
{
isc_result_t result = ISC_R_SUCCESS, tresult;
- cfg_aclconfctx_t actx;
+ cfg_aclconfctx_t *actx = NULL;
const cfg_listelt_t *element, *element2;
const cfg_obj_t *allow;
const cfg_obj_t *control;
@@ -2464,7 +2497,7 @@ bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
(void)cfg_map_get(config, "key", &keylist);
- cfg_aclconfctx_init(&actx);
+ cfg_aclconfctx_create(mctx, &actx);
/*
* INET: Check allow clause.
@@ -2484,7 +2517,7 @@ bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
control = cfg_listelt_value(element2);
allow = cfg_tuple_get(control, "allow");
tresult = cfg_acl_fromconfig(allow, config, logctx,
- &actx, mctx, 0, &acl);
+ actx, mctx, 0, &acl);
if (acl != NULL)
dns_acl_detach(&acl);
if (tresult != ISC_R_SUCCESS)
@@ -2531,7 +2564,7 @@ bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
result = tresult;
}
}
- cfg_aclconfctx_clear(&actx);
+ cfg_aclconfctx_detach(&actx);
return (result);
}
diff --git a/external/bsd/bind/dist/lib/dns/acl.c b/external/bsd/bind/dist/lib/dns/acl.c
index 9cd6927be80..a5bdaf12c35 100644
--- a/external/bsd/bind/dist/lib/dns/acl.c
+++ b/external/bsd/bind/dist/lib/dns/acl.c
@@ -1,7 +1,7 @@
-/* $NetBSD: acl.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: acl.c,v 1.3 2011/09/11 18:55:33 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: acl.c,v 1.53 2009-01-17 23:47:42 tbox Exp */
+/* Id: acl.c,v 1.55 2011-06-17 23:47:49 tbox Exp */
/*! \file */
@@ -101,6 +101,7 @@ static isc_result_t
dns_acl_anyornone(isc_mem_t *mctx, isc_boolean_t neg, dns_acl_t **target) {
isc_result_t result;
dns_acl_t *acl = NULL;
+
result = dns_acl_create(mctx, 0, &acl);
if (result != ISC_R_SUCCESS)
return (result);
@@ -343,7 +344,6 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos)
}
}
-
/*
* Merge the iptables. Make sure the destination ACL's
* node_count value is set correctly afterward.
@@ -441,6 +441,7 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr,
void
dns_acl_attach(dns_acl_t *source, dns_acl_t **target) {
REQUIRE(DNS_ACL_VALID(source));
+
isc_refcount_increment(&source->refcount, NULL);
*target = source;
}
@@ -448,6 +449,9 @@ dns_acl_attach(dns_acl_t *source, dns_acl_t **target) {
static void
destroy(dns_acl_t *dacl) {
unsigned int i;
+
+ INSIST(!ISC_LINK_LINKED(dacl, nextincache));
+
for (i = 0; i < dacl->length; i++) {
dns_aclelement_t *de = &dacl->elements[i];
if (de->type == dns_aclelementtype_keyname) {
@@ -472,7 +476,9 @@ void
dns_acl_detach(dns_acl_t **aclp) {
dns_acl_t *acl = *aclp;
unsigned int refs;
+
REQUIRE(DNS_ACL_VALID(acl));
+
isc_refcount_decrement(&acl->refcount, &refs);
if (refs == 0)
destroy(acl);
@@ -592,6 +598,7 @@ dns_acl_isinsecure(const dns_acl_t *a) {
isc_result_t
dns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env) {
isc_result_t result;
+
env->localhost = NULL;
env->localnets = NULL;
result = dns_acl_create(mctx, 0, &env->localhost);
diff --git a/external/bsd/bind/dist/lib/dns/adb.c b/external/bsd/bind/dist/lib/dns/adb.c
index 0b1f7e64800..098aba55131 100644
--- a/external/bsd/bind/dist/lib/dns/adb.c
+++ b/external/bsd/bind/dist/lib/dns/adb.c
@@ -1,7 +1,7 @@
-/* $NetBSD: adb.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: adb.c,v 1.3 2011/09/11 18:55:33 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: adb.c,v 1.254 2010-12-21 23:47:08 tbox Exp */
+/* Id: adb.c,v 1.258 2011-03-13 02:49:28 marka Exp */
/*! \file
*
@@ -912,6 +912,8 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
if (rdataset->trust == dns_trust_glue ||
rdataset->trust == dns_trust_additional)
rdataset->ttl = ADB_CACHE_MINIMUM;
+ else if (rdataset->trust == dns_trust_ultimate)
+ rdataset->ttl = 0;
else
rdataset->ttl = ttlclamp(rdataset->ttl);
@@ -2197,7 +2199,6 @@ check_expire_name(dns_adbname_t **namep, isc_stdtime_t now) {
static void
check_stale_name(dns_adb_t *adb, int bucket, isc_stdtime_t now) {
int victims, max_victims;
- isc_boolean_t result;
dns_adbname_t *victim, *next_victim;
isc_boolean_t overmem = isc_mem_isovermem(adb->mctx);
int scans = 0;
@@ -2219,7 +2220,7 @@ check_stale_name(dns_adb_t *adb, int bucket, isc_stdtime_t now) {
INSIST(!NAME_DEAD(victim));
scans++;
next_victim = ISC_LIST_PREV(victim, plink);
- result = check_expire_name(&victim, now);
+ (void)check_expire_name(&victim, now);
if (victim == NULL) {
victims++;
goto next;
@@ -2764,6 +2765,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
REQUIRE((options & DNS_ADBFIND_ADDRESSMASK) != 0);
result = ISC_R_UNEXPECTED;
+ POST(result);
wanted_addresses = (options & DNS_ADBFIND_ADDRESSMASK);
wanted_fetches = 0;
query_pending = 0;
@@ -2815,6 +2817,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
*/
bucket = DNS_ADB_INVALIDBUCKET;
adbname = find_name_and_lock(adb, name, find->options, &bucket);
+ INSIST(bucket != DNS_ADB_INVALIDBUCKET);
if (adb->name_sd[bucket]) {
DP(DEF_LEVEL,
"dns_adb_createfind: returning ISC_R_SHUTTINGDOWN");
@@ -3169,6 +3172,7 @@ dns_adb_cancelfind(dns_adbfind_t *find) {
}
UNLOCK(&adb->namelocks[unlock_bucket]);
bucket = DNS_ADB_INVALIDBUCKET;
+ POST(bucket);
cleanup:
@@ -3947,6 +3951,7 @@ dns_adb_findaddrinfo(dns_adb_t *adb, isc_sockaddr_t *sa,
result = ISC_R_SUCCESS;
bucket = DNS_ADB_INVALIDBUCKET;
entry = find_entry_and_lock(adb, sa, &bucket, now);
+ INSIST(bucket != DNS_ADB_INVALIDBUCKET);
if (adb->entry_sd[bucket]) {
result = ISC_R_SHUTTINGDOWN;
goto unlock;
diff --git a/external/bsd/bind/dist/lib/dns/cache.c b/external/bsd/bind/dist/lib/dns/cache.c
index ca5d9b1bb9b..927302cc077 100644
--- a/external/bsd/bind/dist/lib/dns/cache.c
+++ b/external/bsd/bind/dist/lib/dns/cache.c
@@ -1,7 +1,7 @@
-/* $NetBSD: cache.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: cache.c,v 1.3 2011/09/11 18:55:33 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: cache.c,v 1.87 2009-11-12 23:43:02 each Exp */
+/* Id: cache.c,v 1.90 2011-08-02 20:36:12 each Exp */
/*! \file */
@@ -42,6 +42,8 @@
#include <dns/rdatasetiter.h>
#include <dns/result.h>
+#include "rbtdb.h"
+
#define CACHE_MAGIC ISC_MAGIC('$', '$', '$', '$')
#define VALID_CACHE(cache) ISC_MAGIC_VALID(cache, CACHE_MAGIC)
@@ -123,7 +125,8 @@ struct dns_cache {
unsigned int magic;
isc_mutex_t lock;
isc_mutex_t filelock;
- isc_mem_t *mctx;
+ isc_mem_t *mctx; /* Main cache memory */
+ isc_mem_t *hmctx; /* Heap memory */
char *name;
/* Locked by 'lock'. */
@@ -170,41 +173,54 @@ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
}
isc_result_t
-dns_cache_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
+dns_cache_create(isc_mem_t *cmctx, isc_taskmgr_t *taskmgr,
isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
const char *db_type, unsigned int db_argc, char **db_argv,
dns_cache_t **cachep)
{
- return (dns_cache_create2(mctx, taskmgr, timermgr, rdclass, "",
+ return (dns_cache_create3(cmctx, cmctx, taskmgr, timermgr, rdclass, "",
db_type, db_argc, db_argv, cachep));
}
isc_result_t
-dns_cache_create2(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
+dns_cache_create2(isc_mem_t *cmctx, isc_taskmgr_t *taskmgr,
+ isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
+ const char *cachename, const char *db_type,
+ unsigned int db_argc, char **db_argv, dns_cache_t **cachep)
+{
+ return (dns_cache_create3(cmctx, cmctx, taskmgr, timermgr, rdclass,
+ cachename, db_type, db_argc, db_argv,
+ cachep));
+}
+
+isc_result_t
+dns_cache_create3(isc_mem_t *cmctx, isc_mem_t *hmctx, isc_taskmgr_t *taskmgr,
isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
const char *cachename, const char *db_type,
unsigned int db_argc, char **db_argv, dns_cache_t **cachep)
{
isc_result_t result;
dns_cache_t *cache;
- int i;
+ int i, extra = 0;
isc_task_t *dbtask;
REQUIRE(cachep != NULL);
REQUIRE(*cachep == NULL);
- REQUIRE(mctx != NULL);
+ REQUIRE(cmctx != NULL);
+ REQUIRE(hmctx != NULL);
REQUIRE(cachename != NULL);
- cache = isc_mem_get(mctx, sizeof(*cache));
+ cache = isc_mem_get(cmctx, sizeof(*cache));
if (cache == NULL)
return (ISC_R_NOMEMORY);
- cache->mctx = NULL;
- isc_mem_attach(mctx, &cache->mctx);
+ cache->mctx = cache->hmctx = NULL;
+ isc_mem_attach(cmctx, &cache->mctx);
+ isc_mem_attach(hmctx, &cache->hmctx);
cache->name = NULL;
if (cachename != NULL) {
- cache->name = isc_mem_strdup(mctx, cachename);
+ cache->name = isc_mem_strdup(cmctx, cachename);
if (cache->name == NULL) {
result = ISC_R_NOMEMORY;
goto cleanup_mem;
@@ -223,26 +239,38 @@ dns_cache_create2(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
cache->live_tasks = 0;
cache->rdclass = rdclass;
- cache->db_type = isc_mem_strdup(mctx, db_type);
+ cache->db_type = isc_mem_strdup(cmctx, db_type);
if (cache->db_type == NULL) {
result = ISC_R_NOMEMORY;
goto cleanup_filelock;
}
- cache->db_argc = db_argc;
- if (cache->db_argc == 0)
- cache->db_argv = NULL;
- else {
- cache->db_argv = isc_mem_get(mctx,
+ /*
+ * For databases of type "rbt" we pass hmctx to dns_db_create()
+ * via cache->db_argv, followed by the rest of the arguments in
+ * db_argv (of which there really shouldn't be any).
+ */
+ if (strcmp(cache->db_type, "rbt") == 0)
+ extra = 1;
+
+ cache->db_argc = db_argc + extra;
+ cache->db_argv = NULL;
+
+ if (cache->db_argc != 0) {
+ cache->db_argv = isc_mem_get(cmctx,
cache->db_argc * sizeof(char *));
if (cache->db_argv == NULL) {
result = ISC_R_NOMEMORY;
goto cleanup_dbtype;
}
+
for (i = 0; i < cache->db_argc; i++)
cache->db_argv[i] = NULL;
- for (i = 0; i < cache->db_argc; i++) {
- cache->db_argv[i] = isc_mem_strdup(mctx, db_argv[i]);
+
+ cache->db_argv[0] = (char *) hmctx;
+ for (i = extra; i < cache->db_argc; i++) {
+ cache->db_argv[i] = isc_mem_strdup(cmctx,
+ db_argv[i - extra]);
if (cache->db_argv[i] == NULL) {
result = ISC_R_NOMEMORY;
goto cleanup_dbargv;
@@ -250,6 +278,9 @@ dns_cache_create2(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
}
}
+ /*
+ * Create the database
+ */
cache->db = NULL;
result = cache_create_db(cache, &cache->db);
if (result != ISC_R_SUCCESS)
@@ -286,29 +317,28 @@ dns_cache_create2(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
cleanup_db:
dns_db_detach(&cache->db);
cleanup_dbargv:
- for (i = 0; i < cache->db_argc; i++)
+ for (i = extra; i < cache->db_argc; i++)
if (cache->db_argv[i] != NULL)
- isc_mem_free(mctx, cache->db_argv[i]);
+ isc_mem_free(cmctx, cache->db_argv[i]);
if (cache->db_argv != NULL)
- isc_mem_put(mctx, cache->db_argv,
+ isc_mem_put(cmctx, cache->db_argv,
cache->db_argc * sizeof(char *));
cleanup_dbtype:
- isc_mem_free(mctx, cache->db_type);
+ isc_mem_free(cmctx, cache->db_type);
cleanup_filelock:
DESTROYLOCK(&cache->filelock);
cleanup_lock:
DESTROYLOCK(&cache->lock);
cleanup_mem:
if (cache->name != NULL)
- isc_mem_free(mctx, cache->name);
- isc_mem_put(mctx, cache, sizeof(*cache));
- isc_mem_detach(&mctx);
+ isc_mem_free(cmctx, cache->name);
+ isc_mem_detach(&cache->hmctx);
+ isc_mem_putanddetach(&cache->mctx, cache, sizeof(*cache));
return (result);
}
static void
cache_free(dns_cache_t *cache) {
- isc_mem_t *mctx;
int i;
REQUIRE(VALID_CACHE(cache));
@@ -339,7 +369,14 @@ cache_free(dns_cache_t *cache) {
dns_db_detach(&cache->db);
if (cache->db_argv != NULL) {
- for (i = 0; i < cache->db_argc; i++)
+ /*
+ * We don't free db_argv[0] in "rbt" cache databases
+ * as it's a pointer to hmctx
+ */
+ int extra = 0;
+ if (strcmp(cache->db_type, "rbt") == 0)
+ extra = 1;
+ for (i = extra; i < cache->db_argc; i++)
if (cache->db_argv[i] != NULL)
isc_mem_free(cache->mctx, cache->db_argv[i]);
isc_mem_put(cache->mctx, cache->db_argv,
@@ -354,10 +391,10 @@ cache_free(dns_cache_t *cache) {
DESTROYLOCK(&cache->lock);
DESTROYLOCK(&cache->filelock);
+
cache->magic = 0;
- mctx = cache->mctx;
- isc_mem_put(cache->mctx, cache, sizeof(*cache));
- isc_mem_detach(&mctx);
+ isc_mem_detach(&cache->hmctx);
+ isc_mem_putanddetach(&cache->mctx, cache, sizeof(*cache));
}
@@ -1118,31 +1155,14 @@ dns_cache_flush(dns_cache_t *cache) {
return (ISC_R_SUCCESS);
}
-isc_result_t
-dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) {
+static isc_result_t
+clearnode(dns_db_t *db, dns_dbnode_t *node) {
isc_result_t result;
dns_rdatasetiter_t *iter = NULL;
- dns_dbnode_t *node = NULL;
- dns_db_t *db = NULL;
- LOCK(&cache->lock);
- if (cache->db != NULL)
- dns_db_attach(cache->db, &db);
- UNLOCK(&cache->lock);
- if (db == NULL)
- return (ISC_R_SUCCESS);
- result = dns_db_findnode(cache->db, name, ISC_FALSE, &node);
- if (result == ISC_R_NOTFOUND) {
- result = ISC_R_SUCCESS;
- goto cleanup_db;
- }
- if (result != ISC_R_SUCCESS)
- goto cleanup_db;
-
- result = dns_db_allrdatasets(cache->db, node, NULL,
- (isc_stdtime_t)0, &iter);
+ result = dns_db_allrdatasets(db, node, NULL, (isc_stdtime_t)0, &iter);
if (result != ISC_R_SUCCESS)
- goto cleanup_node;
+ return (result);
for (result = dns_rdatasetiter_first(iter);
result == ISC_R_SUCCESS;
@@ -1152,19 +1172,98 @@ dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) {
dns_rdataset_init(&rdataset);
dns_rdatasetiter_current(iter, &rdataset);
- result = dns_db_deleterdataset(cache->db, node, NULL,
+ result = dns_db_deleterdataset(db, node, NULL,
rdataset.type, rdataset.covers);
dns_rdataset_disassociate(&rdataset);
if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED)
break;
}
+
if (result == ISC_R_NOMORE)
result = ISC_R_SUCCESS;
dns_rdatasetiter_destroy(&iter);
+ return (result);
+}
- cleanup_node:
- dns_db_detachnode(cache->db, &node);
+static isc_result_t
+cleartree(dns_db_t *db, dns_name_t *name) {
+ isc_result_t result;
+ dns_dbiterator_t *iter = NULL;
+ dns_dbnode_t *node = NULL;
+ dns_fixedname_t fnodename;
+ dns_name_t *nodename;
+
+ dns_fixedname_init(&fnodename);
+ nodename = dns_fixedname_name(&fnodename);
+
+ result = dns_db_createiterator(db, 0, &iter);
+ if (result != ISC_R_SUCCESS)
+ goto cleanup;
+
+ result = dns_dbiterator_seek(iter, name);
+ if (result != ISC_R_SUCCESS)
+ goto cleanup;
+
+ while (result == ISC_R_SUCCESS) {
+ result = dns_dbiterator_current(iter, &node, nodename);
+ if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN)
+ goto cleanup;
+ if (! dns_name_issubdomain(nodename, name))
+ goto cleanup;
+
+ result = clearnode(db, node);
+ dns_db_detachnode(db, &node);
+ result = dns_dbiterator_next(iter);
+ }
+
+ cleanup:
+ if (result == ISC_R_NOMORE || result == ISC_R_NOTFOUND)
+ result = ISC_R_SUCCESS;
+ if (node != NULL)
+ dns_db_detachnode(db, &node);
+ if (iter != NULL)
+ dns_dbiterator_destroy(&iter);
+
+ return (result);
+}
+
+isc_result_t
+dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) {
+ return (dns_cache_flushnode(cache, name, ISC_FALSE));
+}
+
+isc_result_t
+dns_cache_flushnode(dns_cache_t *cache, dns_name_t *name,
+ isc_boolean_t tree)
+{
+ isc_result_t result;
+ dns_dbnode_t *node = NULL;
+ dns_db_t *db = NULL;
+
+ if (dns_name_equal(name, dns_rootname))
+ return (dns_cache_flush(cache));
+
+ LOCK(&cache->lock);
+ if (cache->db != NULL)
+ dns_db_attach(cache->db, &db);
+ UNLOCK(&cache->lock);
+ if (db == NULL)
+ return (ISC_R_SUCCESS);
+
+ if (tree) {
+ result = cleartree(cache->db, name);
+ } else {
+ result = dns_db_findnode(cache->db, name, ISC_FALSE, &node);
+ if (result == ISC_R_NOTFOUND) {
+ result = ISC_R_SUCCESS;
+ goto cleanup_db;
+ }
+ if (result != ISC_R_SUCCESS)
+ goto cleanup_db;
+ result = clearnode(cache->db, node);
+ dns_db_detachnode(cache->db, &node);
+ }
cleanup_db:
dns_db_detach(&db);
diff --git a/external/bsd/bind/dist/lib/dns/client.c b/external/bsd/bind/dist/lib/dns/client.c
index bb76890c160..e1c7efc0624 100644
--- a/external/bsd/bind/dist/lib/dns/client.c
+++ b/external/bsd/bind/dist/lib/dns/client.c
@@ -1,7 +1,7 @@
-/* $NetBSD: client.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: client.c,v 1.3 2011/09/11 18:55:33 christos Exp $ */
/*
- * Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: client.c,v 1.12 2010-12-03 12:03:22 marka Exp */
+/* Id: client.c,v 1.14 2011-03-12 04:59:47 tbox Exp */
#include <config.h>
@@ -723,7 +723,7 @@ view_find(resctx_t *rctx, dns_db_t **dbp, dns_dbnode_t **nodep,
static void
client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
isc_mem_t *mctx;
- isc_result_t result, tresult;
+ isc_result_t tresult, result = ISC_R_SUCCESS;
isc_result_t vresult = ISC_R_SUCCESS;
isc_boolean_t want_restart;
isc_boolean_t send_event = ISC_FALSE;
@@ -743,7 +743,6 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
mctx = rctx->view->mctx;
- result = ISC_R_SUCCESS;
name = dns_fixedname_name(&rctx->name);
do {
@@ -784,6 +783,7 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
goto done;
}
} else {
+ INSIST(event != NULL);
INSIST(event->fetch == rctx->fetch);
dns_resolver_destroyfetch(&rctx->fetch);
db = event->db;
@@ -967,6 +967,7 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
&rctx->rdataset);
if (tresult != ISC_R_SUCCESS) {
result = tresult;
+ POST(result);
break;
}
}
@@ -978,6 +979,7 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
* implementation).
*/
result = DNS_R_SERVFAIL; /* better code? */
+ POST(result);
} else {
ISC_LIST_APPEND(rctx->namelist, ansname, link);
ansname = NULL;
@@ -2133,6 +2135,7 @@ receive_soa(isc_task_t *task, isc_event_t *event) {
reqev = (dns_requestevent_t *)event;
request = reqev->request;
result = eresult = reqev->result;
+ POST(result);
uctx = reqev->ev_arg;
client = uctx->client;
soaquery = uctx->soaquery;
@@ -2179,6 +2182,7 @@ receive_soa(isc_task_t *task, isc_event_t *event) {
}
section = DNS_SECTION_ANSWER;
+ POST(section);
if (rcvmsg->rcode != dns_rcode_noerror &&
rcvmsg->rcode != dns_rcode_nxdomain) {
diff --git a/external/bsd/bind/dist/lib/dns/diff.c b/external/bsd/bind/dist/lib/dns/diff.c
index 6c0206e313e..c4590915d1b 100644
--- a/external/bsd/bind/dist/lib/dns/diff.c
+++ b/external/bsd/bind/dist/lib/dns/diff.c
@@ -1,7 +1,7 @@
-/* $NetBSD: diff.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: diff.c,v 1.3 2011/09/11 18:55:33 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: diff.c,v 1.23 2009-12-01 00:47:09 each Exp */
+/* Id: diff.c,v 1.26 2011-03-25 23:53:02 each Exp */
/*! \file */
@@ -266,7 +266,6 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver,
dns_rdataset_t rds;
dns_rdataset_t ardataset;
dns_rdataset_t *modified = NULL;
- isc_boolean_t offline;
op = t->op;
type = t->rdata.type;
@@ -303,7 +302,6 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver,
CHECK(dns_db_findnsec3node(db, name, ISC_TRUE,
&node));
- offline = ISC_FALSE;
while (t != NULL &&
dns_name_equal(&t->name, name) &&
t->op == op &&
@@ -325,8 +323,6 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver,
namebuf, typebuf, classbuf,
(unsigned long) t->ttl,
(unsigned long) rdl.ttl);
- if (t->rdata.flags & DNS_RDATA_OFFLINE)
- offline = ISC_TRUE;
ISC_LIST_APPEND(rdl.rdata, &t->rdata, link);
t = ISC_LIST_NEXT(t, link);
}
@@ -379,6 +375,15 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver,
diff->resign);
dns_db_setsigningtime(db, modified,
resign);
+ if (diff->resign == 0 &&
+ (op == DNS_DIFFOP_ADDRESIGN ||
+ op == DNS_DIFFOP_DELRESIGN))
+ isc_log_write(
+ DIFF_COMMON_LOGARGS,
+ ISC_LOG_WARNING,
+ "resign requested "
+ "with 0 resign "
+ "interval");
}
} else if (result == DNS_R_UNCHANGED) {
/*
@@ -530,7 +535,6 @@ dns_diff_sort(dns_diff_t *diff, dns_diff_compare_func *compare) {
v = isc_mem_get(diff->mctx, length * sizeof(dns_difftuple_t *));
if (v == NULL)
return (ISC_R_NOMEMORY);
- i = 0;
for (i = 0; i < length; i++) {
p = ISC_LIST_HEAD(diff->tuples);
v[i] = p;
diff --git a/external/bsd/bind/dist/lib/dns/dispatch.c b/external/bsd/bind/dist/lib/dns/dispatch.c
index 3db7739a77d..6498f9bab0d 100644
--- a/external/bsd/bind/dist/lib/dns/dispatch.c
+++ b/external/bsd/bind/dist/lib/dns/dispatch.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dispatch.c,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: dispatch.c,v 1.4 2011/09/11 18:55:33 christos Exp $ */
/*
* Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dispatch.c,v 1.168.248.1.2.1 2011-06-02 23:47:34 tbox Exp */
+/* Id: dispatch.c,v 1.174 2011-07-28 23:47:58 tbox Exp */
/*! \file */
@@ -314,14 +314,16 @@ static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr,
dns_dispatch_t *disp,
isc_socketmgr_t *sockmgr,
isc_sockaddr_t *localaddr,
- isc_socket_t **sockp);
+ isc_socket_t **sockp,
+ isc_socket_t *dup_socket);
static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
isc_socketmgr_t *sockmgr,
isc_taskmgr_t *taskmgr,
isc_sockaddr_t *localaddr,
unsigned int maxrequests,
unsigned int attributes,
- dns_dispatch_t **dispp);
+ dns_dispatch_t **dispp,
+ isc_socket_t *dup_socket);
static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr);
static void destroy_mgr(dns_dispatchmgr_t **mgrp);
static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
@@ -329,7 +331,8 @@ static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
isc_boolean_t needaddrtable);
static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
static isc_result_t open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
- unsigned int options, isc_socket_t **sockp);
+ unsigned int options, isc_socket_t **sockp,
+ isc_socket_t *dup_socket);
static isc_boolean_t portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
isc_sockaddr_t *sockaddrp);
@@ -904,7 +907,8 @@ get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest,
portentry = port_search(disp, port);
if (portentry != NULL)
bindoptions |= ISC_SOCKET_REUSEADDRESS;
- result = open_socket(sockmgr, &localaddr, bindoptions, &sock);
+ result = open_socket(sockmgr, &localaddr, bindoptions, &sock,
+ NULL);
if (result == ISC_R_SUCCESS) {
if (portentry == NULL) {
portentry = new_portentry(disp, port);
@@ -915,6 +919,12 @@ get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest,
}
portentry->refs++;
break;
+ } else if (result == ISC_R_NOPERM) {
+ char buf[ISC_SOCKADDR_FORMATSIZE];
+ isc_sockaddr_format(&localaddr, buf, sizeof(buf));
+ dispatch_log(disp, ISC_LOG_WARNING,
+ "open_socket(%s) -> %s: continuing",
+ buf, isc_result_totext(result));
} else if (result != ISC_R_ADDRINUSE)
break;
}
@@ -1297,7 +1307,6 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
* Look at flags. If query, drop it. If response,
* look to see where it goes.
*/
- queue_response = ISC_FALSE;
if ((flags & DNS_MESSAGEFLAG_QR) == 0) {
/* query */
free_buffer(disp, ev->region.base, ev->region.length);
@@ -1556,7 +1565,6 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
* Look at flags. If query, drop it. If response,
* look to see where it goes.
*/
- queue_response = ISC_FALSE;
if ((flags & DNS_MESSAGEFLAG_QR) == 0) {
/*
* Query.
@@ -1785,19 +1793,14 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
static isc_result_t
open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
- unsigned int options, isc_socket_t **sockp)
+ unsigned int options, isc_socket_t **sockp,
+ isc_socket_t *dup_socket)
{
isc_socket_t *sock;
isc_result_t result;
sock = *sockp;
- if (sock == NULL) {
- result = isc_socket_create(mgr, isc_sockaddr_pf(local),
- isc_sockettype_udp, &sock);
- if (result != ISC_R_SUCCESS)
- return (result);
- isc_socket_setname(sock, "dispatcher", NULL);
- } else {
+ if (sock != NULL) {
#ifdef BIND9
result = isc_socket_open(sock);
if (result != ISC_R_SUCCESS)
@@ -1805,8 +1808,19 @@ open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
#else
INSIST(0);
#endif
+ } else if (dup_socket != NULL) {
+ result = isc_socket_dup(dup_socket, &sock);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+ } else {
+ result = isc_socket_create(mgr, isc_sockaddr_pf(local),
+ isc_sockettype_udp, &sock);
+ if (result != ISC_R_SUCCESS)
+ return (result);
}
+ isc_socket_setname(sock, "dispatcher", NULL);
+
#ifndef ISC_ALLOW_MAPPED
isc_socket_ipv6only(sock, ISC_TRUE);
#endif
@@ -2375,9 +2389,9 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
qid->sock_table = isc_mem_get(mgr->mctx, buckets *
sizeof(dispsocketlist_t));
if (qid->sock_table == NULL) {
- isc_mem_put(mgr->mctx, qid, sizeof(*qid));
isc_mem_put(mgr->mctx, qid->qid_table,
buckets * sizeof(dns_displist_t));
+ isc_mem_put(mgr->mctx, qid, sizeof(*qid));
return (ISC_R_NOMEMORY);
}
}
@@ -2644,13 +2658,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
}
isc_result_t
-dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
+dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr,
unsigned int buffersize,
unsigned int maxbuffers, unsigned int maxrequests,
unsigned int buckets, unsigned int increment,
unsigned int attributes, unsigned int mask,
- dns_dispatch_t **dispp)
+ dns_dispatch_t **dispp, dns_dispatch_t *dup_dispatch)
{
isc_result_t result;
dns_dispatch_t *disp = NULL;
@@ -2681,28 +2695,31 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
/*
* See if we have a dispatcher that matches.
*/
- result = dispatch_find(mgr, localaddr, attributes, mask, &disp);
- if (result == ISC_R_SUCCESS) {
- disp->refcount++;
-
- if (disp->maxrequests < maxrequests)
- disp->maxrequests = maxrequests;
-
- if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0 &&
- (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0)
- {
- disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
- if (disp->recv_pending != 0)
- isc_socket_cancel(disp->socket, disp->task[0],
- ISC_SOCKCANCEL_RECV);
- }
+ if (dup_dispatch == NULL) {
+ result = dispatch_find(mgr, localaddr, attributes, mask, &disp);
+ if (result == ISC_R_SUCCESS) {
+ disp->refcount++;
+
+ if (disp->maxrequests < maxrequests)
+ disp->maxrequests = maxrequests;
+
+ if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0
+ && (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0)
+ {
+ disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
+ if (disp->recv_pending != 0)
+ isc_socket_cancel(disp->socket,
+ disp->task[0],
+ ISC_SOCKCANCEL_RECV);
+ }
- UNLOCK(&disp->lock);
- UNLOCK(&mgr->lock);
+ UNLOCK(&disp->lock);
+ UNLOCK(&mgr->lock);
- *dispp = disp;
+ *dispp = disp;
- return (ISC_R_SUCCESS);
+ return (ISC_R_SUCCESS);
+ }
}
createudp:
@@ -2710,7 +2727,11 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
* Nope, create one.
*/
result = dispatch_createudp(mgr, sockmgr, taskmgr, localaddr,
- maxrequests, attributes, &disp);
+ maxrequests, attributes, &disp,
+ dup_dispatch == NULL
+ ? NULL
+ : dup_dispatch->socket);
+
if (result != ISC_R_SUCCESS) {
UNLOCK(&mgr->lock);
return (result);
@@ -2718,9 +2739,24 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
UNLOCK(&mgr->lock);
*dispp = disp;
+
return (ISC_R_SUCCESS);
}
+isc_result_t
+dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
+ isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr,
+ unsigned int buffersize,
+ unsigned int maxbuffers, unsigned int maxrequests,
+ unsigned int buckets, unsigned int increment,
+ unsigned int attributes, unsigned int mask,
+ dns_dispatch_t **dispp)
+{
+ return dns_dispatch_getudp_dup(mgr, sockmgr, taskmgr, localaddr,
+ buffersize, maxbuffers, maxrequests, buckets, increment,
+ attributes, mask, dispp, NULL);
+}
+
/*
* mgr should be locked.
*/
@@ -2732,7 +2768,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
static isc_result_t
get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
isc_socketmgr_t *sockmgr, isc_sockaddr_t *localaddr,
- isc_socket_t **sockp)
+ isc_socket_t **sockp, isc_socket_t *dup_socket)
{
unsigned int i, j;
isc_socket_t *held[DNS_DISPATCH_HELD];
@@ -2772,7 +2808,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
nports)];
isc_sockaddr_setport(&localaddr_bound, prt);
result = open_socket(sockmgr, &localaddr_bound,
- 0, &sock);
+ 0, &sock, NULL);
if (result == ISC_R_SUCCESS ||
result != ISC_R_ADDRINUSE) {
disp->localport = prt;
@@ -2788,7 +2824,8 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
} else {
/* Allow to reuse address for non-random ports. */
result = open_socket(sockmgr, localaddr,
- ISC_SOCKET_REUSEADDRESS, &sock);
+ ISC_SOCKET_REUSEADDRESS, &sock,
+ dup_socket);
if (result == ISC_R_SUCCESS)
*sockp = sock;
@@ -2800,7 +2837,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
i = 0;
for (j = 0; j < 0xffffU; j++) {
- result = open_socket(sockmgr, localaddr, 0, &sock);
+ result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
if (result != ISC_R_SUCCESS)
goto end;
else if (!anyport)
@@ -2839,7 +2876,8 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
isc_sockaddr_t *localaddr,
unsigned int maxrequests,
unsigned int attributes,
- dns_dispatch_t **dispp)
+ dns_dispatch_t **dispp,
+ isc_socket_t *dup_socket)
{
isc_result_t result;
dns_dispatch_t *disp;
@@ -2855,9 +2893,21 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
return (result);
if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) {
- result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock);
+ result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock,
+ dup_socket);
if (result != ISC_R_SUCCESS)
goto deallocate_dispatch;
+
+ if (isc_log_wouldlog(dns_lctx, 90)) {
+ char addrbuf[ISC_SOCKADDR_FORMATSIZE];
+
+ isc_sockaddr_format(localaddr, addrbuf,
+ ISC_SOCKADDR_FORMATSIZE);
+ mgr_log(mgr, LVL(90), "dns_dispatch_createudp: Created"
+ " UDP dispatch for %s with socket fd %d\n",
+ addrbuf, isc_socket_getfd(sock));
+ }
+
} else {
isc_sockaddr_t sa_any;
@@ -2869,7 +2919,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
*/
isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
- result = open_socket(sockmgr, localaddr, 0, &sock);
+ result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
if (sock != NULL)
isc_socket_detach(&sock);
if (result != ISC_R_SUCCESS)
@@ -2936,6 +2986,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
dispatch_log(disp, LVL(90), "created socket %p", disp->socket);
*dispp = disp;
+
return (result);
/*
@@ -2987,7 +3038,6 @@ dns_dispatch_detach(dns_dispatch_t **dispp) {
INSIST(disp->refcount > 0);
disp->refcount--;
- killit = ISC_FALSE;
if (disp->refcount == 0) {
if (disp->recv_pending > 0)
isc_socket_cancel(disp->socket, disp->task[0],
@@ -3260,7 +3310,6 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
disp->requests--;
INSIST(disp->refcount > 0);
disp->refcount--;
- killit = ISC_FALSE;
if (disp->refcount == 0) {
if (disp->recv_pending > 0)
isc_socket_cancel(disp->socket, disp->task[0],
diff --git a/external/bsd/bind/dist/lib/dns/dlz.c b/external/bsd/bind/dist/lib/dns/dlz.c
index a13a3a87ee1..a187d91e928 100644
--- a/external/bsd/bind/dist/lib/dns/dlz.c
+++ b/external/bsd/bind/dist/lib/dns/dlz.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dlz.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: dlz.c,v 1.3 2011/09/11 18:55:34 christos Exp $ */
/*
- * Portions Copyright (C) 2005, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2005, 2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -52,7 +52,7 @@
* USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dlz.c,v 1.10 2010-12-20 23:47:20 tbox Exp */
+/* Id: dlz.c,v 1.12 2011-03-12 04:59:47 tbox Exp */
/*! \file */
@@ -537,7 +537,6 @@ dns_dlz_writeablezone(dns_view_t *view, const char *zone_name) {
isc_buffer_t buffer;
dns_fixedname_t fixorigin;
dns_name_t *origin;
- dns_rdataclass_t zclass;
dns_dlzdb_t *dlzdatabase;
REQUIRE(DNS_DLZ_VALID(view->dlzdatabase));
@@ -555,8 +554,6 @@ dns_dlz_writeablezone(dns_view_t *view, const char *zone_name) {
goto cleanup;
origin = dns_fixedname_name(&fixorigin);
- zclass = view->rdclass;
-
/* See if the zone already exists */
result = dns_view_findzone(view, origin, &dupzone);
if (result == ISC_R_SUCCESS) {
@@ -595,8 +592,6 @@ dns_dlz_writeablezone(dns_view_t *view, const char *zone_name) {
*/
result = dns_view_addzone(view, zone);
- result = ISC_R_SUCCESS;
-
cleanup:
if (zone != NULL)
dns_zone_detach(&zone);
diff --git a/external/bsd/bind/dist/lib/dns/dns64.c b/external/bsd/bind/dist/lib/dns/dns64.c
index d7c4c147cef..a1d7b735166 100644
--- a/external/bsd/bind/dist/lib/dns/dns64.c
+++ b/external/bsd/bind/dist/lib/dns/dns64.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dns64.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: dns64.c,v 1.3 2011/09/11 18:55:34 christos Exp $ */
/*
- * Copyright (C) 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dns64.c,v 1.6 2010-12-09 04:59:09 marka Exp */
+/* Id: dns64.c,v 1.8 2011-03-12 04:59:47 tbox Exp */
#include <config.h>
@@ -255,6 +255,8 @@ dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
*/
if (dns64->excluded == NULL) {
answer = ISC_TRUE;
+ if (aaaaok == NULL)
+ goto done;
for (i = 0; i < aaaaoklen; i++)
aaaaok[i] = ISC_TRUE;
goto done;
diff --git a/external/bsd/bind/dist/lib/dns/dnssec.c b/external/bsd/bind/dist/lib/dns/dnssec.c
index b27be40882c..c6f14ee71e8 100644
--- a/external/bsd/bind/dist/lib/dns/dnssec.c
+++ b/external/bsd/bind/dist/lib/dns/dnssec.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dnssec.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: dnssec.c,v 1.3 2011/09/11 18:55:34 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
*/
/*
- * Id: dnssec.c,v 1.119 2010-01-13 23:48:59 tbox Exp
+ * Id: dnssec.c,v 1.124 2011-05-06 21:08:33 each Exp
*/
/*! \file */
@@ -545,9 +545,9 @@ dns_dnssec_verify(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
}
static isc_boolean_t
-key_active(dst_key_t *key) {
+key_active(dst_key_t *key, isc_stdtime_t now) {
isc_result_t result;
- isc_stdtime_t now, publish, active, revoke, inactive, delete;
+ isc_stdtime_t publish, active, revoke, inactive, delete;
isc_boolean_t pubset = ISC_FALSE, actset = ISC_FALSE;
isc_boolean_t revset = ISC_FALSE, inactset = ISC_FALSE;
isc_boolean_t delset = ISC_FALSE;
@@ -555,6 +555,7 @@ key_active(dst_key_t *key) {
/* Is this an old-style key? */
result = dst_key_getprivateformat(key, &major, &minor);
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
/*
* Smart signing started with key format 1.3; prior to that, all
@@ -563,8 +564,6 @@ key_active(dst_key_t *key) {
if (major == 1 && minor <= 2)
return (ISC_TRUE);
- isc_stdtime_get(&now);
-
result = dst_key_gettime(key, DST_TIME_PUBLISH, &publish);
if (result == ISC_R_SUCCESS)
pubset = ISC_TRUE;
@@ -612,10 +611,13 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
isc_result_t result;
dst_key_t *pubkey = NULL;
unsigned int count = 0;
+ isc_stdtime_t now;
REQUIRE(nkeys != NULL);
REQUIRE(keys != NULL);
+ isc_stdtime_get(&now);
+
*nkeys = 0;
dns_rdataset_init(&rdataset);
RETERR(dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey, 0, 0,
@@ -625,6 +627,8 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
pubkey = NULL;
dns_rdataset_current(&rdataset, &rdata);
RETERR(dns_dnssec_keyfromrdata(name, &rdata, mctx, &pubkey));
+ dst_key_setttl(pubkey, rdataset.ttl);
+
if (!is_zone_key(pubkey) ||
(dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
goto next;
@@ -694,7 +698,7 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
/*
* If a key is marked inactive, skip it
*/
- if (!key_active(keys[count])) {
+ if (!key_active(keys[count], now)) {
dst_key_free(&keys[count]);
keys[count] = pubkey;
pubkey = NULL;
@@ -702,6 +706,12 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
goto next;
}
+ /*
+ * Whatever the key's default TTL may have
+ * been, the rdataset TTL takes priority.
+ */
+ dst_key_setttl(keys[count], rdataset.ttl);
+
if ((dst_key_flags(keys[count]) & DNS_KEYTYPE_NOAUTH) != 0) {
/* We should never get here. */
dst_key_free(&keys[count]);
@@ -1018,13 +1028,6 @@ dns_dnssec_selfsigns(dns_rdata_t *rdata, dns_name_t *name,
dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
isc_boolean_t ignoretime, isc_mem_t *mctx)
{
- dst_key_t *dstkey = NULL;
- dns_keytag_t keytag;
- dns_rdata_dnskey_t key;
- dns_rdata_rrsig_t sig;
- dns_rdata_t sigrdata = DNS_RDATA_INIT;
- isc_result_t result;
-
INSIST(rdataset->type == dns_rdatatype_key ||
rdataset->type == dns_rdatatype_dnskey);
if (rdataset->type == dns_rdatatype_key) {
@@ -1035,6 +1038,27 @@ dns_dnssec_selfsigns(dns_rdata_t *rdata, dns_name_t *name,
INSIST(sigrdataset->covers == dns_rdatatype_dnskey);
}
+ return (dns_dnssec_signs(rdata, name, rdataset, sigrdataset,
+ ignoretime, mctx));
+
+}
+
+isc_boolean_t
+dns_dnssec_signs(dns_rdata_t *rdata, dns_name_t *name,
+ dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
+ isc_boolean_t ignoretime, isc_mem_t *mctx)
+{
+ dst_key_t *dstkey = NULL;
+ dns_keytag_t keytag;
+ dns_rdata_dnskey_t key;
+ dns_rdata_rrsig_t sig;
+ dns_rdata_t sigrdata = DNS_RDATA_INIT;
+ isc_result_t result;
+
+ INSIST(sigrdataset->type == dns_rdatatype_rrsig);
+ if (sigrdataset->covers != rdataset->type)
+ return (ISC_FALSE);
+
result = dns_dnssec_keyfromrdata(name, rdata, mctx, &dstkey);
if (result != ISC_R_SUCCESS)
return (ISC_FALSE);
@@ -1097,6 +1121,7 @@ dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
/* Is this an old-style key? */
result = dst_key_getprivateformat(dk->key, &major, &minor);
+ INSIST(result == ISC_R_SUCCESS);
/* Smart signing started with key format 1.3 */
dk->legacy = ISC_TF(major == 1 && minor <= 2);
@@ -1431,6 +1456,7 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin,
dns_rdata_reset(&rdata);
dns_rdataset_current(&keys, &rdata);
RETERR(dns_dnssec_keyfromrdata(origin, &rdata, mctx, &pubkey));
+ dst_key_setttl(pubkey, keys.ttl);
if (!is_zone_key(pubkey) ||
(dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
@@ -1503,6 +1529,12 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin,
if ((dst_key_flags(privkey) & DNS_KEYTYPE_NOAUTH) != 0)
goto skip;
+ /*
+ * Whatever the key's default TTL may have
+ * been, the rdataset TTL takes priority.
+ */
+ dst_key_setttl(privkey, dst_key_getttl(pubkey));
+
addkey(keylist, &privkey, savekeys, mctx);
skip:
if (pubkey != NULL)
@@ -1628,16 +1660,22 @@ remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin,
isc_result_t
dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
dns_dnsseckeylist_t *removed, dns_name_t *origin,
- dns_ttl_t ttl, dns_diff_t *diff, isc_boolean_t allzsk,
- isc_mem_t *mctx, void (*report)(const char *, ...))
+ dns_ttl_t hint_ttl, dns_diff_t *diff,
+ isc_boolean_t allzsk, isc_mem_t *mctx,
+ void (*report)(const char *, ...))
{
isc_result_t result;
dns_dnsseckey_t *key, *key1, *key2, *next;
+ isc_boolean_t found_ttl = ISC_FALSE;
+ dns_ttl_t ttl = hint_ttl;
/*
* First, look through the existing key list to find keys
* supplied from the command line which are not in the zone.
* Update the zone to include them.
+ *
+ * Also, if there are keys published in the zone already,
+ * use their TTL for all subsequent published keys.
*/
for (key = ISC_LIST_HEAD(*keys);
key != NULL;
@@ -1647,6 +1685,32 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
RETERR(publish_key(diff, key, origin, ttl,
mctx, allzsk, report));
}
+ if (key->source == dns_keysource_zoneapex) {
+ ttl = dst_key_getttl(key->key);
+ found_ttl = ISC_TRUE;
+ }
+ }
+
+ /*
+ * If there were no existing keys, use the smallest nonzero
+ * TTL of the keys found in the repository.
+ */
+ if (!found_ttl && !ISC_LIST_EMPTY(*newkeys)) {
+ dns_ttl_t shortest = 0;
+
+ for (key = ISC_LIST_HEAD(*newkeys);
+ key != NULL;
+ key = ISC_LIST_NEXT(key, link)) {
+ dns_ttl_t thisttl = dst_key_getttl(key->key);
+ if (thisttl != 0 &&
+ (shortest == 0 || thisttl < shortest))
+ shortest = thisttl;
+ }
+
+ if (shortest != 0) {
+ found_ttl = ISC_TRUE;
+ ttl = shortest;
+ }
}
/*
@@ -1675,9 +1739,6 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
/* No match found in keys; add the new key. */
if (key2 == NULL) {
- dns_dnsseckey_t *next;
-
- next = ISC_LIST_NEXT(key1, link);
ISC_LIST_UNLINK(*newkeys, key1, link);
ISC_LIST_APPEND(*keys, key1, link);
diff --git a/external/bsd/bind/dist/lib/dns/dst_api.c b/external/bsd/bind/dist/lib/dns/dst_api.c
index ad0e7e0f714..2c365851182 100644
--- a/external/bsd/bind/dist/lib/dns/dst_api.c
+++ b/external/bsd/bind/dist/lib/dns/dst_api.c
@@ -1,4 +1,4 @@
-/* $NetBSD: dst_api.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: dst_api.c,v 1.3 2011/09/11 18:55:34 christos Exp $ */
/*
* Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -33,7 +33,7 @@
/*
* Principal Author: Brian Wellington
- * Id: dst_api.c,v 1.57 2011-01-11 23:47:13 tbox Exp
+ * Id: dst_api.c,v 1.63 2011-08-18 23:46:34 tbox Exp
*/
/*! \file */
@@ -93,6 +93,7 @@ static dst_key_t * get_key_struct(dns_name_t *name,
unsigned int protocol,
unsigned int bits,
dns_rdataclass_t rdclass,
+ dns_ttl_t ttl,
isc_mem_t *mctx);
static isc_result_t write_public_key(const dst_key_t *key, int type,
const char *directory);
@@ -516,7 +517,7 @@ dst_key_fromnamedfile(const char *filename, const char *dirname,
key = get_key_struct(pubkey->key_name, pubkey->key_alg,
pubkey->key_flags, pubkey->key_proto, 0,
- pubkey->key_class, mctx);
+ pubkey->key_class, pubkey->key_ttl, mctx);
if (key == NULL) {
dst_key_free(&pubkey);
return (ISC_R_NOMEMORY);
@@ -714,7 +715,7 @@ dst_key_fromgssapi(dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx,
REQUIRE(keyp != NULL && *keyp == NULL);
key = get_key_struct(name, DST_ALG_GSSAPI, 0, DNS_KEYPROTO_DNSSEC,
- 0, dns_rdataclass_in, mctx);
+ 0, dns_rdataclass_in, 0, mctx);
if (key == NULL)
return (ISC_R_NOMEMORY);
@@ -752,7 +753,7 @@ dst_key_fromlabel(dns_name_t *name, int alg, unsigned int flags,
CHECKALG(alg);
- key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx);
+ key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
if (key == NULL)
return (ISC_R_NOMEMORY);
@@ -806,7 +807,8 @@ dst_key_generate2(dns_name_t *name, unsigned int alg,
CHECKALG(alg);
- key = get_key_struct(name, alg, flags, protocol, bits, rdclass, mctx);
+ key = get_key_struct(name, alg, flags, protocol, bits,
+ rdclass, 0, mctx);
if (key == NULL)
return (ISC_R_NOMEMORY);
@@ -1212,7 +1214,7 @@ dst_key_restore(dns_name_t *name, unsigned int alg, unsigned int flags,
if (dst_t_func[alg]->restore == NULL)
return (ISC_R_NOTIMPLEMENTED);
- key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx);
+ key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
if (key == NULL)
return (ISC_R_NOMEMORY);
@@ -1236,7 +1238,7 @@ static dst_key_t *
get_key_struct(dns_name_t *name, unsigned int alg,
unsigned int flags, unsigned int protocol,
unsigned int bits, dns_rdataclass_t rdclass,
- isc_mem_t *mctx)
+ dns_ttl_t ttl, isc_mem_t *mctx)
{
dst_key_t *key;
isc_result_t result;
@@ -1276,6 +1278,7 @@ get_key_struct(dns_name_t *name, unsigned int alg,
key->keydata.generic = NULL;
key->key_size = bits;
key->key_class = rdclass;
+ key->key_ttl = ttl;
key->func = dst_t_func[alg];
key->fmt_major = 0;
key->fmt_minor = 0;
@@ -1303,7 +1306,7 @@ dst_key_read_public(const char *filename, int type,
unsigned int opt = ISC_LEXOPT_DNSMULTILINE;
dns_rdataclass_t rdclass = dns_rdataclass_in;
isc_lexspecials_t specials;
- isc_uint32_t ttl;
+ isc_uint32_t ttl = 0;
isc_result_t result;
dns_rdatatype_t keytype;
@@ -1404,6 +1407,8 @@ dst_key_read_public(const char *filename, int type,
if (ret != ISC_R_SUCCESS)
goto cleanup;
+ dst_key_setttl(*keyp, ttl);
+
cleanup:
if (lex != NULL)
isc_lex_destroy(&lex);
@@ -1570,11 +1575,14 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
/* Now print the actual key */
ret = dns_name_print(key->key_name, fp);
-
fprintf(fp, " ");
+ if (key->key_ttl != 0)
+ fprintf(fp, "%d ", key->key_ttl);
+
isc_buffer_usedregion(&classb, &r);
- isc_util_fwrite(r.base, 1, r.length, fp);
+ if ((unsigned)isc_util_fwrite(r.base, 1, r.length, fp) != r.length)
+ ret = DST_R_WRITEERROR;
if ((type & DST_TYPE_KEY) != 0)
fprintf(fp, " KEY ");
@@ -1582,7 +1590,8 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
fprintf(fp, " DNSKEY ");
isc_buffer_usedregion(&textb, &r);
- isc_util_fwrite(r.base, 1, r.length, fp);
+ if ((unsigned)isc_util_fwrite(r.base, 1, r.length, fp) != r.length)
+ ret = DST_R_WRITEERROR;
fputc('\n', fp);
fflush(fp);
@@ -1661,7 +1670,7 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
REQUIRE(mctx != NULL);
REQUIRE(keyp != NULL && *keyp == NULL);
- key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx);
+ key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
if (key == NULL)
return (ISC_R_NOMEMORY);
@@ -1780,5 +1789,6 @@ dst__entropy_status(void) {
isc_buffer_t *
dst_key_tkeytoken(const dst_key_t *key) {
+ REQUIRE(VALID_KEY(key));
return (key->key_tkeytoken);
}
diff --git a/external/bsd/bind/dist/lib/dns/dst_internal.h b/external/bsd/bind/dist/lib/dns/dst_internal.h
index eeab6fab873..a18e1e5720a 100644
--- a/external/bsd/bind/dist/lib/dns/dst_internal.h
+++ b/external/bsd/bind/dist/lib/dns/dst_internal.h
@@ -1,4 +1,4 @@
-/* $NetBSD: dst_internal.h,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: dst_internal.h,v 1.3 2011/09/11 18:55:34 christos Exp $ */
/*
* Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -31,7 +31,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dst_internal.h,v 1.29 2011-01-11 23:47:13 tbox Exp */
+/* Id: dst_internal.h,v 1.30 2011-03-17 01:40:39 each Exp */
#ifndef DST_DST_INTERNAL_H
#define DST_DST_INTERNAL_H 1
@@ -98,6 +98,7 @@ struct dst_key {
isc_uint16_t key_id; /*%< identifier of the key */
isc_uint16_t key_bits; /*%< hmac digest bits */
dns_rdataclass_t key_class; /*%< class of the key record */
+ dns_ttl_t key_ttl; /*%< default/initial dnskey ttl */
isc_mem_t *mctx; /*%< memory context */
char *engine; /*%< engine name (HSM) */
char *label; /*%< engine label (HSM) */
diff --git a/external/bsd/bind/dist/lib/dns/dst_openssl.h b/external/bsd/bind/dist/lib/dns/dst_openssl.h
index fdfc2f68640..5abe5c82d79 100644
--- a/external/bsd/bind/dist/lib/dns/dst_openssl.h
+++ b/external/bsd/bind/dist/lib/dns/dst_openssl.h
@@ -1,7 +1,7 @@
-/* $NetBSD: dst_openssl.h,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: dst_openssl.h,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dst_openssl.h,v 1.9 2009-10-06 04:40:14 tbox Exp */
+/* Id: dst_openssl.h,v 1.11 2011-03-12 04:59:48 tbox Exp */
#ifndef DST_OPENSSL_H
#define DST_OPENSSL_H 1
@@ -25,13 +25,28 @@
#include <isc/lang.h>
#include <isc/result.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+#include <openssl/evp.h>
+#include <openssl/conf.h>
+#include <openssl/crypto.h>
+
+#if !defined(OPENSSL_NO_ENGINE) && defined(CRYPTO_LOCK_ENGINE) && \
+ (OPENSSL_VERSION_NUMBER >= 0x0090707f)
+#define USE_ENGINE 1
+#endif
+
ISC_LANG_BEGINDECLS
isc_result_t
dst__openssl_toresult(isc_result_t fallback);
+#ifdef USE_ENGINE
ENGINE *
dst__openssl_getengine(const char *engine);
+#else
+#define dst__openssl_getengine(x) NULL
+#endif
ISC_LANG_ENDDECLS
diff --git a/external/bsd/bind/dist/lib/dns/dst_parse.c b/external/bsd/bind/dist/lib/dns/dst_parse.c
index fd56b17748e..9bef5fc4236 100644
--- a/external/bsd/bind/dist/lib/dns/dst_parse.c
+++ b/external/bsd/bind/dist/lib/dns/dst_parse.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dst_parse.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: dst_parse.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
- * Portions Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -33,7 +33,7 @@
/*%
* Principal Author: Brian Wellington
- * Id: dst_parse.c,v 1.27 2010-12-23 04:07:58 marka Exp
+ * Id: dst_parse.c,v 1.29 2011-08-18 23:46:35 tbox Exp
*/
#include <config.h>
@@ -643,9 +643,7 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
}
isc_buffer_usedregion(&b, &r);
- fprintf(fp, "%s ", s);
- isc_util_fwrite(r.base, 1, r.length, fp);
- fprintf(fp, "\n");
+ fprintf(fp, "%s %.*s\n", s, (int)r.length, r.base);
}
/* Add the metadata tags */
@@ -663,14 +661,15 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
isc_buffer_init(&b, buffer, sizeof(buffer));
result = dns_time32_totext(when, &b);
- if (result != ISC_R_SUCCESS)
- continue;
+ if (result != ISC_R_SUCCESS) {
+ fclose(fp);
+ return (DST_R_INVALIDPRIVATEKEY);
+ }
isc_buffer_usedregion(&b, &r);
- fprintf(fp, "%s ", timetags[i]);
- isc_util_fwrite(r.base, 1, r.length, fp);
- fprintf(fp, "\n");
+ fprintf(fp, "%s %.*s\n", timetags[i], (int)r.length,
+ r.base);
}
}
diff --git a/external/bsd/bind/dist/lib/dns/gssapi_link.c b/external/bsd/bind/dist/lib/dns/gssapi_link.c
index 70f33245dd2..67e6fa44ee7 100644
--- a/external/bsd/bind/dist/lib/dns/gssapi_link.c
+++ b/external/bsd/bind/dist/lib/dns/gssapi_link.c
@@ -1,4 +1,4 @@
-/* $NetBSD: gssapi_link.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: gssapi_link.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
* Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -18,7 +18,7 @@
*/
/*
- * Id: gssapi_link.c,v 1.16 2011-01-11 23:47:13 tbox Exp
+ * Id: gssapi_link.c,v 1.17 2011-03-28 05:32:16 marka Exp
*/
#include <config.h>
@@ -183,7 +183,7 @@ gssapi_sign(dst_context_t *dctx, isc_buffer_t *sig) {
* allocated space.
*/
isc_buffer_putmem(sig, gsig.value, gsig.length);
- if (gsig.length != 0)
+ if (gsig.length != 0U)
gss_release_buffer(&minor, &gsig);
return (ISC_R_SUCCESS);
@@ -295,7 +295,7 @@ gssapi_restore(dst_key_t *key, const char *keystr) {
isc_result_t result;
len = strlen(keystr);
- if ((len % 4) != 0)
+ if ((len % 4) != 0U)
return (ISC_R_BADBASE64);
len = (len / 4) * 3;
@@ -340,7 +340,7 @@ gssapi_dump(dst_key_t *key, isc_mem_t *mctx, char **buffer, int *length) {
major, minor);
return (ISC_R_FAILURE);
}
- if (gssbuffer.length == 0)
+ if (gssbuffer.length == 0U)
return (ISC_R_FAILURE);
len = ((gssbuffer.length + 2)/3) * 4;
buf = isc_mem_get(mctx, len);
diff --git a/external/bsd/bind/dist/lib/dns/gssapictx.c b/external/bsd/bind/dist/lib/dns/gssapictx.c
index 82e779300ab..d0b28ca90f0 100644
--- a/external/bsd/bind/dist/lib/dns/gssapictx.c
+++ b/external/bsd/bind/dist/lib/dns/gssapictx.c
@@ -1,4 +1,4 @@
-/* $NetBSD: gssapictx.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: gssapictx.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: gssapictx.c,v 1.26 2011-01-10 03:49:49 marka Exp */
+/* Id: gssapictx.c,v 1.28 2011-04-07 23:03:22 marka Exp */
#include <config.h>
@@ -181,7 +181,7 @@ log_cred(const gss_cred_id_t cred) {
}
if (gret == GSS_S_COMPLETE) {
- if (gbuffer.length != 0) {
+ if (gbuffer.length != 0U) {
gret = gss_release_buffer(&minor, &gbuffer);
if (gret != GSS_S_COMPLETE)
gss_log(3, "failed gss_release_buffer: %s",
@@ -606,7 +606,7 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
/*
* RFC 2744 states the a valid output token has a non-zero length.
*/
- if (gouttoken.length != 0) {
+ if (gouttoken.length != 0U) {
GBUFFER_TO_REGION(gouttoken, r);
RETERR(isc_buffer_copyregion(outtoken, &r));
(void)gss_release_buffer(&minor, &gouttoken);
@@ -652,8 +652,6 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
REQUIRE(outtoken != NULL && *outtoken == NULL);
- log_cred(cred);
-
REGION_TO_GBUFFER(*intoken, gintoken);
if (*ctxout == NULL)
@@ -689,6 +687,8 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
#endif
}
+ log_cred(cred);
+
gret = gss_accept_sec_context(&minor, &context, cred, &gintoken,
GSS_C_NO_CHANNEL_BINDINGS, &gname,
NULL, &gouttoken, NULL, NULL, NULL);
@@ -721,7 +721,7 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
return (result);
}
- if (gouttoken.length > 0) {
+ if (gouttoken.length > 0U) {
RETERR(isc_buffer_allocate(mctx, outtoken, gouttoken.length));
GBUFFER_TO_REGION(gouttoken, r);
RETERR(isc_buffer_copyregion(*outtoken, &r));
@@ -743,7 +743,7 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
* case, since principal names really should not
* contain null characters.
*/
- if (gnamebuf.length > 0 &&
+ if (gnamebuf.length > 0U &&
((char *)gnamebuf.value)[gnamebuf.length - 1] == '\0')
gnamebuf.length--;
@@ -757,7 +757,7 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
RETERR(dns_name_fromtext(principal, &namebuf, dns_rootname,
0, NULL));
- if (gnamebuf.length != 0) {
+ if (gnamebuf.length != 0U) {
gret = gss_release_buffer(&minor, &gnamebuf);
if (gret != GSS_S_COMPLETE)
gss_log(3, "failed gss_release_buffer: %s",
@@ -838,9 +838,9 @@ gss_error_tostring(isc_uint32_t major, isc_uint32_t minor,
snprintf(buf, buflen, "GSSAPI error: Major = %s, Minor = %s.",
(char *)msg_major.value, (char *)msg_minor.value);
- if (msg_major.length != 0)
+ if (msg_major.length != 0U)
(void)gss_release_buffer(&minor_stat, &msg_major);
- if (msg_minor.length != 0)
+ if (msg_minor.length != 0U)
(void)gss_release_buffer(&minor_stat, &msg_minor);
return(buf);
#else
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/acl.h b/external/bsd/bind/dist/lib/dns/include/dns/acl.h
index 832c24d9636..e5bc074cac7 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/acl.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/acl.h
@@ -1,7 +1,7 @@
-/* $NetBSD: acl.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: acl.h,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: acl.h,v 1.33 2009-01-17 23:47:43 tbox Exp */
+/* Id: acl.h,v 1.35 2011-06-17 23:47:49 tbox Exp */
#ifndef DNS_ACL_H
#define DNS_ACL_H 1
@@ -147,9 +147,26 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, isc_boolean_t pos);
void
dns_acl_attach(dns_acl_t *source, dns_acl_t **target);
+/*%<
+ * Attach to acl 'source'.
+ *
+ * Requires:
+ *\li 'source' to be a valid acl.
+ *\li 'target' to be non NULL and '*target' to be NULL.
+ */
void
dns_acl_detach(dns_acl_t **aclp);
+/*%<
+ * Detach the acl. On final detach the acl must not be linked on any
+ * list.
+ *
+ * Requires:
+ *\li '*aclp' to be a valid acl.
+ *
+ * Insists:
+ *\li '*aclp' is not linked on final detach.
+ */
isc_boolean_t
dns_acl_isinsecure(const dns_acl_t *a);
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/cache.h b/external/bsd/bind/dist/lib/dns/include/dns/cache.h
index c4489b91be1..29b92f56bd3 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/cache.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/cache.h
@@ -1,7 +1,7 @@
-/* $NetBSD: cache.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: cache.h,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: cache.h,v 1.28 2009-01-09 23:47:46 tbox Exp */
+/* Id: cache.h,v 1.32 2011-08-02 23:47:52 tbox Exp */
#ifndef DNS_CACHE_H
#define DNS_CACHE_H 1
@@ -63,23 +63,36 @@ ISC_LANG_BEGINDECLS
***/
isc_result_t
-dns_cache_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
+dns_cache_create(isc_mem_t *cmctx, isc_taskmgr_t *taskmgr,
isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
const char *db_type, unsigned int db_argc, char **db_argv,
dns_cache_t **cachep);
isc_result_t
-dns_cache_create2(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
+dns_cache_create2(isc_mem_t *cmctx, isc_taskmgr_t *taskmgr,
+ isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
+ const char *cachename, const char *db_type,
+ unsigned int db_argc, char **db_argv, dns_cache_t **cachep);
+isc_result_t
+dns_cache_create3(isc_mem_t *cmctx, isc_mem_t *hmctx, isc_taskmgr_t *taskmgr,
isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
const char *cachename, const char *db_type,
unsigned int db_argc, char **db_argv, dns_cache_t **cachep);
/*%<
- * Create a new DNS cache. dns_cache_create2() will create a named cache.
- * dns_cache_create() is a backward compatible version that internally specifies
- * an empty name.
+ * Create a new DNS cache.
+ *
+ * dns_cache_create2() will create a named cache.
+ *
+ * dns_cache_create3() will create a named cache using two separate memory
+ * contexts, one for cache data which can be cleaned and a separate one for
+ * memory allocated for the heap (which can grow without an upper limit and
+ * has no mechanism for shrinking).
+ *
+ * dns_cache_create() is a backward compatible version that internally
+ * specifies an empty cache name and a single memory context.
*
* Requires:
*
- *\li 'mctx' is a valid memory context
+ *\li 'cmctx' (and 'hmctx' if applicable) is a valid memory context.
*
*\li 'taskmgr' is a valid task manager and 'timermgr' is a valid timer
* manager, or both are NULL. If NULL, no periodic cleaning of the
@@ -269,9 +282,27 @@ dns_cache_flush(dns_cache_t *cache);
*/
isc_result_t
+dns_cache_flushnode(dns_cache_t *cache, dns_name_t *name,
+ isc_boolean_t tree);
+/*
+ * Flush a given name from the cache. If 'tree' is true, then
+ * also flush all names under 'name'.
+ *
+ * Requires:
+ *\li 'cache' to be valid.
+ *\li 'name' to be valid.
+ *
+ * Returns:
+ *\li #ISC_R_SUCCESS
+ *\li #ISC_R_NOMEMORY
+ *\li other error returns.
+ */
+
+isc_result_t
dns_cache_flushname(dns_cache_t *cache, dns_name_t *name);
/*
- * Flushes a given name from the cache.
+ * Flush a given name from the cache. Equivalent to
+ * dns_cache_flushpartial(cache, name, ISC_FALSE).
*
* Requires:
*\li 'cache' to be valid.
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/db.h b/external/bsd/bind/dist/lib/dns/include/dns/db.h
index 415f352111e..a7e18beac47 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/db.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/db.h
@@ -1,4 +1,4 @@
-/* $NetBSD: db.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: db.h,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
* Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: db.h,v 1.104 2011-01-13 04:59:25 tbox Exp */
+/* Id: db.h,v 1.105 2011-05-19 00:31:57 smann Exp */
#ifndef DNS_DB_H
#define DNS_DB_H 1
@@ -1443,7 +1443,9 @@ dns_db_setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
*
* Requires:
* \li 'db' is a valid zone database.
- * \li 'rdataset' to be associated with 'db'.
+ * \li 'rdataset' is or is to be associated with 'db'.
+ * \li 'rdataset' is not pending removed from the heap via an
+ * uncommitted call to dns_db_resigned().
*
* Returns:
* \li #ISC_R_SUCCESS
@@ -1474,7 +1476,9 @@ dns_db_resigned(dns_db_t *db, dns_rdataset_t *rdataset,
* Mark 'rdataset' as not being available to be returned by
* dns_db_getsigningtime(). If the changes associated with 'version'
* are committed this will be permanent. If the version is not committed
- * this change will be rolled back when the version is closed.
+ * this change will be rolled back when the version is closed. Until
+ * 'version' is either committed or rolled back, 'rdataset' can no longer
+ * be acted upon by dns_db_setsigningtime().
*
* Requires:
* \li 'db' is a valid zone database.
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/dispatch.h b/external/bsd/bind/dist/lib/dns/include/dns/dispatch.h
index ca580aa7dda..a2932f1270f 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/dispatch.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/dispatch.h
@@ -1,7 +1,7 @@
-/* $NetBSD: dispatch.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: dispatch.h,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dispatch.h,v 1.62 2009-01-27 23:47:54 tbox Exp */
+/* Id: dispatch.h,v 1.64 2011-07-28 23:47:58 tbox Exp */
#ifndef DNS_DISPATCH_H
#define DNS_DISPATCH_H 1
@@ -247,6 +247,15 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
unsigned int buckets, unsigned int increment,
unsigned int attributes, unsigned int mask,
dns_dispatch_t **dispp);
+
+isc_result_t
+dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
+ isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr,
+ unsigned int buffersize,
+ unsigned int maxbuffers, unsigned int maxrequests,
+ unsigned int buckets, unsigned int increment,
+ unsigned int attributes, unsigned int mask,
+ dns_dispatch_t **dispp, dns_dispatch_t *dup);
/*%<
* Attach to existing dns_dispatch_t if one is found with dns_dispatchmgr_find,
* otherwise create a new UDP dispatch.
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/dlz.h b/external/bsd/bind/dist/lib/dns/include/dns/dlz.h
index cb005560e18..03c44b2d816 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/dlz.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/dlz.h
@@ -1,7 +1,7 @@
-/* $NetBSD: dlz.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: dlz.h,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
- * Portions Copyright (C) 2005-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2005-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -52,7 +52,7 @@
* USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dlz.h,v 1.12 2010-12-20 23:47:21 tbox Exp */
+/* Id: dlz.h,v 1.14 2011-03-17 23:47:30 tbox Exp */
/*! \file dns/dlz.h */
@@ -320,9 +320,9 @@ dns_dlzunregister(dns_dlzimplementation_t **dlzimp);
*/
-isc_result_t
-dns_dlz_writeablezone(dns_view_t *view, const char *zone_name);
-
+typedef isc_result_t dns_dlz_writeablezone_t(dns_view_t *view,
+ const char *zone_name);
+dns_dlz_writeablezone_t dns_dlz_writeablezone;
/*%<
* creates a writeable DLZ zone. Must be called from within the
* configure() method of a DLZ driver.
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/dnssec.h b/external/bsd/bind/dist/lib/dns/include/dns/dnssec.h
index 4eecd9c4c8d..c07011180c8 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/dnssec.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/dnssec.h
@@ -1,7 +1,7 @@
-/* $NetBSD: dnssec.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: dnssec.h,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dnssec.h,v 1.42 2010-01-09 23:48:45 tbox Exp */
+/* Id: dnssec.h,v 1.46 2011-05-06 23:47:29 tbox Exp */
#ifndef DNS_DNSSEC_H
#define DNS_DNSSEC_H 1
@@ -222,6 +222,19 @@ dns_dnssec_selfsigns(dns_rdata_t *rdata, dns_name_t *name,
isc_boolean_t ignoretime, isc_mem_t *mctx);
+isc_boolean_t
+dns_dnssec_signs(dns_rdata_t *rdata, dns_name_t *name,
+ dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
+ isc_boolean_t ignoretime, isc_mem_t *mctx);
+/*%<
+ * Verify that 'rdataset' is validly signed in 'sigrdataset' by
+ * the key in 'rdata'.
+ *
+ * dns_dnssec_selfsigns() requires that rdataset be a DNSKEY or KEY
+ * rrset. dns_dnssec_signs() works on any rrset.
+ */
+
+
isc_result_t
dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
dns_dnsseckey_t **dkp);
@@ -292,7 +305,7 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin,
isc_result_t
dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
dns_dnsseckeylist_t *removed, dns_name_t *origin,
- dns_ttl_t ttl, dns_diff_t *diff, isc_boolean_t allzsk,
+ dns_ttl_t hint_ttl, dns_diff_t *diff, isc_boolean_t allzsk,
isc_mem_t *mctx, void (*report)(const char *, ...));
/*%<
* Update the list of keys in 'keys' with new key information in 'newkeys'.
@@ -311,9 +324,11 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
* If 'allzsk' is true, we are allowing KSK-flagged keys to be used as
* ZSKs.
*
- * 'ttl' is the TTL of the DNSKEY RRset; if it is longer than the
- * time until a new key will be activated, then we have to delay the
- * key's activation.
+ * 'hint_ttl' is the TTL to use for the DNSKEY RRset if there is no
+ * existing RRset, and if none of the keys to be added has a default TTL
+ * (in which case we would use the shortest one). If the TTL is longer
+ * than the time until a new key will be activated, then we have to delay
+ * the key's activation.
*
* 'report' points to a function for reporting status.
*
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/masterdump.h b/external/bsd/bind/dist/lib/dns/include/dns/masterdump.h
index 91e4e5786e6..af23149c0c9 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/masterdump.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/masterdump.h
@@ -1,4 +1,4 @@
-/* $NetBSD: masterdump.h,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: masterdump.h,v 1.4 2011/09/11 18:55:38 christos Exp $ */
/*
* Copyright (C) 2004-2008, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: masterdump.h,v 1.42.596.2 2011-06-02 23:47:35 tbox Exp */
+/* Id: masterdump.h,v 1.45 2011-05-26 07:56:39 marka Exp */
#ifndef DNS_MASTERDUMP_H
#define DNS_MASTERDUMP_H 1
@@ -331,6 +331,12 @@ dns_master_stylecreate(dns_master_style_t **style, unsigned int flags,
unsigned int line_length, unsigned int tab_width,
isc_mem_t *mctx);
+isc_result_t
+dns_master_stylecreate2(dns_master_style_t **style, unsigned int flags,
+ unsigned int ttl_column, unsigned int class_column,
+ unsigned int type_column, unsigned int rdata_column,
+ unsigned int line_length, unsigned int tab_width,
+ unsigned int split_width, isc_mem_t *mctx);
void
dns_master_styledestroy(dns_master_style_t **style, isc_mem_t *mctx);
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/nsec.h b/external/bsd/bind/dist/lib/dns/include/dns/nsec.h
index a680667fcc5..79f8fec0f88 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/nsec.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/nsec.h
@@ -1,7 +1,7 @@
-/* $NetBSD: nsec.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: nsec.h,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
- * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: nsec.h,v 1.12 2008-09-25 04:02:39 tbox Exp */
+/* Id: nsec.h,v 1.14 2011-06-10 23:47:32 tbox Exp */
#ifndef DNS_NSEC_H
#define DNS_NSEC_H 1
@@ -71,7 +71,8 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version,
isc_boolean_t *answer);
/*
* Report whether the DNSKEY RRset has a NSEC only algorithm. Unknown
- * algorithms are assumed to support NSEC3.
+ * algorithms are assumed to support NSEC3. If DNSKEY is not found,
+ * *answer is set to ISC_FALSE, and ISC_R_NOTFOUND is returned.
*
* Requires:
* 'answer' to be non NULL.
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/rdata.h b/external/bsd/bind/dist/lib/dns/include/dns/rdata.h
index ca10ae82739..1ecafff324f 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/rdata.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/rdata.h
@@ -1,7 +1,7 @@
-/* $NetBSD: rdata.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: rdata.h,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rdata.h,v 1.77 2009-12-04 21:09:33 marka Exp */
+/* Id: rdata.h,v 1.80 2011-03-20 02:31:53 marka Exp */
#ifndef DNS_RDATA_H
#define DNS_RDATA_H 1
@@ -160,6 +160,7 @@ struct dns_rdata {
/*% Output explanatory comments. */
#define DNS_STYLEFLAG_COMMENT 0x00000002U
+#define DNS_STYLEFLAG_RRCOMMENT 0x00000004U
#define DNS_RDATA_DOWNCASE DNS_NAME_DOWNCASE
#define DNS_RDATA_CHECKNAMES DNS_NAME_CHECKNAMES
@@ -425,8 +426,8 @@ dns_rdata_totext(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target);
isc_result_t
dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags,
- unsigned int width, const char *linebreak,
- isc_buffer_t *target);
+ unsigned int width, unsigned int split_width,
+ const char *linebreak, isc_buffer_t *target);
/*%<
* Like dns_rdata_totext, but do formatted output suitable for
* database dumps. This is intended for use by dns_db_dump();
@@ -448,6 +449,11 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags,
* comments next to things like the SOA timer fields. Some
* comments (e.g., the SOA ones) are only printed when multiline
* output is selected.
+ *
+ * base64 rdata text (e.g., DNSKEY records) will be split into chunks
+ * of 'split_width' characters. If split_width == 0, the text will
+ * not be split at all. If split_width == UINT_MAX (0xffffffff), then
+ * it is undefined and falls back to the default value of 'width'
*/
isc_result_t
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/rdataset.h b/external/bsd/bind/dist/lib/dns/include/dns/rdataset.h
index 1faf37325d1..d46fa90d780 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/rdataset.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/rdataset.h
@@ -1,4 +1,4 @@
-/* $NetBSD: rdataset.h,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: rdataset.h,v 1.4 2011/09/11 18:55:38 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rdataset.h,v 1.69.270.3 2011-06-21 20:15:54 each Exp */
+/* Id: rdataset.h,v 1.72 2011-06-08 22:13:51 each Exp */
#ifndef DNS_RDATASET_H
#define DNS_RDATASET_H 1
@@ -655,7 +655,7 @@ dns_rdataset_expire(dns_rdataset_t *rdataset);
const char *
dns_trust_totext(dns_trust_t trust);
-/*%<
+/*
* Display trust in textual form.
*/
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/resolver.h b/external/bsd/bind/dist/lib/dns/include/dns/resolver.h
index 978782902fc..4a73956a55a 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/resolver.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/resolver.h
@@ -1,4 +1,4 @@
-/* $NetBSD: resolver.h,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: resolver.h,v 1.4 2011/09/11 18:55:39 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: resolver.h,v 1.67.86.1.2.1 2011-06-02 23:47:36 tbox Exp */
+/* Id: resolver.h,v 1.69 2011-02-03 12:18:11 tbox Exp */
#ifndef DNS_RESOLVER_H
#define DNS_RESOLVER_H 1
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/result.h b/external/bsd/bind/dist/lib/dns/include/dns/result.h
index 86a6bffc325..6738a15cca9 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/result.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/result.h
@@ -1,4 +1,4 @@
-/* $NetBSD: result.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: result.h,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: result.h,v 1.122 2011-01-11 23:47:13 tbox Exp */
+/* Id: result.h,v 1.123 2011-03-21 07:22:14 each Exp */
#ifndef DNS_RESULT_H
#define DNS_RESULT_H 1
@@ -153,8 +153,9 @@
#define DNS_R_NOTMASTER (ISC_RESULTCLASS_DNS + 105)
#define DNS_R_BROKENCHAIN (ISC_RESULTCLASS_DNS + 106)
#define DNS_R_EXPIRED (ISC_RESULTCLASS_DNS + 107)
+#define DNS_R_NOTDYNAMIC (ISC_RESULTCLASS_DNS + 108)
-#define DNS_R_NRESULTS 108 /*%< Number of results */
+#define DNS_R_NRESULTS 109 /*%< Number of results */
/*
* DNS wire format rcodes.
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/sdlz.h b/external/bsd/bind/dist/lib/dns/include/dns/sdlz.h
index 829cf643109..6d17395004b 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/sdlz.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/sdlz.h
@@ -1,4 +1,4 @@
-/* $NetBSD: sdlz.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: sdlz.h,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
* Portions Copyright (C) 2005-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -52,7 +52,7 @@
* USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sdlz.h,v 1.14 2011-01-13 08:50:29 tbox Exp */
+/* Id: sdlz.h,v 1.16 2011-03-17 23:47:30 tbox Exp */
/*! \file dns/sdlz.h */
@@ -319,25 +319,33 @@ dns_sdlzunregister(dns_sdlzimplementation_t **sdlzimp);
* function is called.
*/
-isc_result_t
-dns_sdlz_putnamedrr(dns_sdlzallnodes_t *allnodes, const char *name,
- const char *type, dns_ttl_t ttl, const char *data);
+typedef isc_result_t dns_sdlz_putnamedrr_t(dns_sdlzallnodes_t *allnodes,
+ const char *name,
+ const char *type,
+ dns_ttl_t ttl,
+ const char *data);
+dns_sdlz_putnamedrr_t dns_sdlz_putnamedrr;
+
/*%<
* Add a single resource record to the allnodes structure to be later
* parsed into a zone transfer response.
*/
-isc_result_t
-dns_sdlz_putrr(dns_sdlzlookup_t *lookup, const char *type, dns_ttl_t ttl,
- const char *data);
+typedef isc_result_t dns_sdlz_putrr_t(dns_sdlzlookup_t *lookup,
+ const char *type,
+ dns_ttl_t ttl,
+ const char *data);
+dns_sdlz_putrr_t dns_sdlz_putrr;
/*%<
* Add a single resource record to the lookup structure to be later
* parsed into a query response.
*/
-isc_result_t
-dns_sdlz_putsoa(dns_sdlzlookup_t *lookup, const char *mname, const char *rname,
- isc_uint32_t serial);
+typedef isc_result_t dns_sdlz_putsoa_t(dns_sdlzlookup_t *lookup,
+ const char *mname,
+ const char *rname,
+ isc_uint32_t serial);
+dns_sdlz_putsoa_t dns_sdlz_putsoa;
/*%<
* This function may optionally be called from the 'authority'
* callback to simplify construction of the SOA record for 'zone'. It
@@ -349,9 +357,11 @@ dns_sdlz_putsoa(dns_sdlzlookup_t *lookup, const char *mname, const char *rname,
*/
-isc_result_t
-dns_sdlz_setdb(dns_dlzdb_t *dlzdatabase, dns_rdataclass_t rdclass,
- dns_name_t *name, dns_db_t **dbp);
+typedef isc_result_t dns_sdlz_setdb_t(dns_dlzdb_t *dlzdatabase,
+ dns_rdataclass_t rdclass,
+ dns_name_t *name,
+ dns_db_t **dbp);
+dns_sdlz_setdb_t dns_sdlz_setdb;
/*%<
* Create the database pointers for a writeable SDLZ zone
*/
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/types.h b/external/bsd/bind/dist/lib/dns/include/dns/types.h
index b333ffc902e..d6aa3df4da3 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/types.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/types.h
@@ -1,7 +1,7 @@
-/* $NetBSD: types.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: types.h,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: types.h,v 1.143 2010-12-08 02:46:16 marka Exp */
+/* Id: types.h,v 1.145 2011-07-01 23:47:44 tbox Exp */
#ifndef DNS_TYPES_H
#define DNS_TYPES_H 1
@@ -334,6 +334,20 @@ typedef enum {
dns_severity_fail
} dns_severity_t;
+/*%
+ * DNS Serial Number Update Method.
+ *
+ * \li _increment: Add one to the current serial, skipping 0.
+ * \li _unixtime: Set to the seconds since 00:00 Jan 1, 1970,
+ * if possible.
+ * \li _yyyymmvv: Set to Year, Month, Version, if possible.
+ * (Not yet implemented)
+ */
+typedef enum {
+ dns_updatemethod_increment = 0,
+ dns_updatemethod_unixtime
+} dns_updatemethod_t;
+
/*
* Functions.
*/
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/view.h b/external/bsd/bind/dist/lib/dns/include/dns/view.h
index 304aaec3cc1..725e3495319 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/view.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/view.h
@@ -1,4 +1,4 @@
-/* $NetBSD: view.h,v 1.2 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: view.h,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: view.h,v 1.132 2011-01-13 01:59:28 marka Exp */
+/* Id: view.h,v 1.134 2011-08-02 20:36:13 each Exp */
#ifndef DNS_VIEW_H
#define DNS_VIEW_H 1
@@ -184,6 +184,7 @@ struct dns_view {
dns_viewlist_t * viewlist;
dns_zone_t * managed_keys;
+ dns_zone_t * redirect;
#ifdef BIND9
/* File in which to store configuration for newly added zones */
@@ -840,9 +841,31 @@ dns_view_flushcache2(dns_view_t *view, isc_boolean_t fixuponly);
*/
isc_result_t
-dns_view_flushname(dns_view_t *view, dns_name_t *);
+dns_view_flushnode(dns_view_t *view, dns_name_t *name, isc_boolean_t tree);
/*%<
- * Flush the given name from the view's cache (and ADB).
+ * Flush the given name from the view's cache (and optionally ADB/badcache).
+ *
+ * If 'tree' is true, flush 'name' and all names below it
+ * from the cache, but do not flush ADB.
+ *
+ * If 'tree' is false, flush 'name' frmo both the cache and ADB,
+ * but do not touch any other nodes.
+ *
+ * Requires:
+ *\li 'view' is valid.
+ *\li 'name' is valid.
+ *
+ * Returns:
+ *\li #ISC_R_SUCCESS
+ * other returns are failures.
+ */
+
+isc_result_t
+dns_view_flushname(dns_view_t *view, dns_name_t *name);
+/*%<
+ * Flush the given name from the view's cache, ADB and badcache.
+ * Equivalent to dns_view_flushnode(view, name, ISC_FALSE).
+ *
*
* Requires:
*\li 'view' is valid.
@@ -858,7 +881,6 @@ dns_view_adddelegationonly(dns_view_t *view, dns_name_t *name);
/*%<
* Add the given name to the delegation only table.
*
- *
* Requires:
*\li 'view' is valid.
*\li 'name' is valid.
diff --git a/external/bsd/bind/dist/lib/dns/include/dns/zone.h b/external/bsd/bind/dist/lib/dns/include/dns/zone.h
index cbc5947de36..80140181d18 100644
--- a/external/bsd/bind/dist/lib/dns/include/dns/zone.h
+++ b/external/bsd/bind/dist/lib/dns/include/dns/zone.h
@@ -1,7 +1,7 @@
-/* $NetBSD: zone.h,v 1.7 2011/02/16 03:47:06 christos Exp $ */
+/* $NetBSD: zone.h,v 1.8 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: zone.h,v 1.182 2010-12-18 01:56:22 each Exp */
+/* Id: zone.h,v 1.191 2011-07-06 01:36:32 each Exp */
#ifndef DNS_ZONE_H
#define DNS_ZONE_H 1
@@ -45,7 +45,8 @@ typedef enum {
dns_zone_stub,
dns_zone_staticstub,
dns_zone_key,
- dns_zone_dlz
+ dns_zone_dlz,
+ dns_zone_redirect,
} dns_zonetype_t;
#define DNS_ZONEOPT_SERVERS 0x00000001U /*%< perform server checks */
@@ -94,6 +95,7 @@ typedef enum {
#define DNS_ZONEKEY_MAINTAIN 0x00000002U /*%< publish/sign on schedule */
#define DNS_ZONEKEY_CREATE 0x00000004U /*%< make keys when needed */
#define DNS_ZONEKEY_FULLSIGN 0x00000008U /*%< roll to new keys immediately */
+#define DNS_ZONEKEY_NORESIGN 0x00000010U /*%< no automatic resigning */
#ifndef DNS_ZONE_MINREFRESH
#define DNS_ZONE_MINREFRESH 300 /*%< 5 minutes */
@@ -558,10 +560,16 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
isc_result_t
dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
isc_uint32_t count);
+isc_result_t
+dns_zone_setalsonotifywithkeys(dns_zone_t *zone, const isc_sockaddr_t *notify,
+ dns_name_t **keynames, isc_uint32_t count);
/*%<
* Set the list of additional servers to be notified when
* a zone changes. To clear the list use 'count = 0'.
*
+ * dns_zone_alsonotifywithkeys() allows each notify address to
+ * be associated with a TSIG key.
+ *
* Require:
*\li 'zone' to be a valid zone.
*\li 'notify' to be non-NULL if count != 0.
@@ -1382,7 +1390,8 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
isc_timermgr_t *timermgr, isc_socketmgr_t *socketmgr,
dns_zonemgr_t **zmgrp);
/*%<
- * Create a zone manager.
+ * Create a zone manager. Note: the zone manager will not be able to
+ * manage any zones until dns_zonemgr_setsize() has been run.
*
* Requires:
*\li 'mctx' to be a valid memory context.
@@ -1392,6 +1401,18 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
*/
isc_result_t
+dns_zonemgr_setsize(dns_zonemgr_t *zmgr, int num_zones);
+/*%<
+ * Set the size of the zone manager task pool. This must be run
+ * before zmgr can be used for managing zones. Currently, it can only
+ * be run once; the task pool cannot be resized.
+ *
+ * Requires:
+ *\li zmgr is a valid zone manager.
+ *\li zmgr->zonetasks has been initialized.
+ */
+
+isc_result_t
dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone);
/*%<
* Bring the zone under control of a zone manager.
@@ -1854,6 +1875,56 @@ dns_zone_dlzpostload(dns_zone_t *zone, dns_db_t *db);
* Load the origin names for a writeable DLZ database.
*/
+isc_boolean_t
+dns_zone_isdynamic(dns_zone_t *zone, isc_boolean_t ignore_freeze);
+/*%
+ * Return true iff the zone is "dynamic", in the sense that the zone's
+ * master file (if any) is written by the server, rather than being
+ * updated manually and read by the server.
+ *
+ * This is true for slave zones, stub zones, key zones, and zones that
+ * allow dynamic updates either by having an update policy ("ssutable")
+ * or an "allow-update" ACL with a value other than exactly "{ none; }".
+ *
+ * If 'ignore_freeze' is true, then the zone which has had updates disabled
+ * will still report itself to be dynamic.
+ *
+ * Requires:
+ * \li 'zone' to be valid.
+ */
+
+isc_result_t
+dns_zone_setrefreshkeyinterval(dns_zone_t *zone, isc_uint32_t interval);
+/*%
+ * Sets the frequency, in minutes, with which the key repository will be
+ * checked to see if the keys for this zone have been updated. Any value
+ * higher than 1440 minutes (24 hours) will be silently reduced. A
+ * value of zero will return an out-of-range error.
+ *
+ * Requires:
+ * \li 'zone' to be valid.
+ */
+
+void
+dns_zone_setserialupdatemethod(dns_zone_t *zone, dns_updatemethod_t method);
+/*%
+ * Sets the update method to use when incrementing the zone serial number
+ * due to a DDNS update. Valid options are dns_updatemethod_increment
+ * and dns_updatemethod_unixtime.
+ *
+ * Requires:
+ * \li 'zone' to be valid.
+ */
+
+dns_updatemethod_t
+dns_zone_getserialupdatemethod(dns_zone_t *zone);
+/*%
+ * Returns the update method to be used when incrementing the zone serial
+ * number due to a DDNS update.
+ *
+ * Requires:
+ * \li 'zone' to be valid.
+ */
ISC_LANG_ENDDECLS
#endif /* DNS_ZONE_H */
diff --git a/external/bsd/bind/dist/lib/dns/include/dst/dst.h b/external/bsd/bind/dist/lib/dns/include/dst/dst.h
index a402fb53196..991183ab7b9 100644
--- a/external/bsd/bind/dist/lib/dns/include/dst/dst.h
+++ b/external/bsd/bind/dist/lib/dns/include/dst/dst.h
@@ -1,4 +1,4 @@
-/* $NetBSD: dst.h,v 1.2 2011/02/16 03:47:07 christos Exp $ */
+/* $NetBSD: dst.h,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dst.h,v 1.31 2011-01-11 23:47:14 tbox Exp */
+/* Id: dst.h,v 1.33 2011-03-21 19:54:03 each Exp */
#ifndef DST_DST_H
#define DST_DST_H 1
@@ -737,6 +737,26 @@ dst_key_setbits(dst_key_t *key, isc_uint16_t bits);
* "key" is a valid key.
*/
+void
+dst_key_setttl(dst_key_t *key, dns_ttl_t ttl);
+/*%<
+ * Set the default TTL to use when converting the key
+ * to a KEY or DNSKEY RR.
+ *
+ * Requires:
+ * "key" is a valid key.
+ */
+
+dns_ttl_t
+dst_key_getttl(const dst_key_t *key);
+/*%<
+ * Get the default TTL to use when converting the key
+ * to a KEY or DNSKEY RR.
+ *
+ * Requires:
+ * "key" is a valid key.
+ */
+
isc_result_t
dst_key_setflags(dst_key_t *key, isc_uint32_t flags);
/*
@@ -846,6 +866,9 @@ dst_key_tkeytoken(const dst_key_t *key);
/*%<
* Return the token from the TKEY request, if any. If this key was
* not negotiated via TKEY, return NULL.
+ *
+ * Requires:
+ * "key" is a valid key.
*/
diff --git a/external/bsd/bind/dist/lib/dns/journal.c b/external/bsd/bind/dist/lib/dns/journal.c
index b39ff763a09..3409de9d57d 100644
--- a/external/bsd/bind/dist/lib/dns/journal.c
+++ b/external/bsd/bind/dist/lib/dns/journal.c
@@ -1,7 +1,7 @@
-/* $NetBSD: journal.c,v 1.2 2011/02/16 03:47:03 christos Exp $ */
+/* $NetBSD: journal.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: journal.c,v 1.112 2010-11-17 23:47:08 tbox Exp */
+/* Id: journal.c,v 1.114 2011-03-12 04:59:48 tbox Exp */
#include <config.h>
@@ -165,7 +165,7 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
dns_rdataset_disassociate(&rdataset);
dns_db_detachnode(db, &node);
- return (ISC_R_SUCCESS);
+ return (result);
freenode:
dns_db_detachnode(db, &node);
@@ -2172,6 +2172,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
CHECK(journal_fsync(new));
indexend = new->header.end.offset;
+ POST(indexend);
}
/*
diff --git a/external/bsd/bind/dist/lib/dns/key.c b/external/bsd/bind/dist/lib/dns/key.c
index d7c4ff10ef7..11a5bc3384a 100644
--- a/external/bsd/bind/dist/lib/dns/key.c
+++ b/external/bsd/bind/dist/lib/dns/key.c
@@ -1,7 +1,7 @@
-/* $NetBSD: key.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: key.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
- * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: key.c,v 1.8 2007-06-19 23:47:16 tbox Exp */
+/* Id: key.c,v 1.10 2011-03-17 23:47:30 tbox Exp */
#include <config.h>
@@ -146,4 +146,16 @@ dst_key_getbits(const dst_key_t *key) {
return (key->key_bits);
}
+void
+dst_key_setttl(dst_key_t *key, dns_ttl_t ttl) {
+ REQUIRE(VALID_KEY(key));
+ key->key_ttl = ttl;
+}
+
+dns_ttl_t
+dst_key_getttl(const dst_key_t *key) {
+ REQUIRE(VALID_KEY(key));
+ return (key->key_ttl);
+}
+
/*! \file */
diff --git a/external/bsd/bind/dist/lib/dns/master.c b/external/bsd/bind/dist/lib/dns/master.c
index b1526a1ad2a..85a862ebb7f 100644
--- a/external/bsd/bind/dist/lib/dns/master.c
+++ b/external/bsd/bind/dist/lib/dns/master.c
@@ -1,7 +1,7 @@
-/* $NetBSD: master.c,v 1.4 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: master.c,v 1.5 2011/09/11 18:55:35 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: master.c,v 1.178 2009-09-01 00:22:26 jinmei Exp */
+/* Id: master.c,v 1.180 2011-03-12 04:59:48 tbox Exp */
/*! \file */
@@ -1206,9 +1206,10 @@ load_text(dns_loadctx_t *lctx) {
goto insist_and_cleanup;
}
ictx = lctx->inc;
- line = isc_lex_getsourceline(lctx->lex);
source =
isc_lex_getsourcename(lctx->lex);
+ line = isc_lex_getsourceline(lctx->lex);
+ POST(line);
continue;
}
/*
@@ -1418,8 +1419,9 @@ load_text(dns_loadctx_t *lctx) {
goto insist_and_cleanup;
}
ictx = lctx->inc;
- line = isc_lex_getsourceline(lctx->lex);
source = isc_lex_getsourcename(lctx->lex);
+ line = isc_lex_getsourceline(lctx->lex);
+ POST(line);
continue;
}
@@ -2124,6 +2126,7 @@ load_raw(dns_loadctx_t *lctx) {
/* Empty read: currently, we do not use dumptime */
dumptime = isc_buffer_getuint32(&target);
+ POST(dumptime);
lctx->first = ISC_FALSE;
}
@@ -2296,7 +2299,6 @@ load_raw(dns_loadctx_t *lctx) {
isc_buffer_forward(&target, consumed_name);
rdcount -= i;
- i = 0;
goto continue_read;
}
@@ -2680,7 +2682,6 @@ grow_rdatalist(int new_len, dns_rdatalist_t *old, int old_len,
return (NULL);
ISC_LIST_INIT(save);
- this = ISC_LIST_HEAD(*current);
while ((this = ISC_LIST_HEAD(*current)) != NULL) {
ISC_LIST_UNLINK(*current, this, link);
ISC_LIST_APPEND(save, this, link);
@@ -2693,7 +2694,6 @@ grow_rdatalist(int new_len, dns_rdatalist_t *old, int old_len,
}
ISC_LIST_INIT(save);
- this = ISC_LIST_HEAD(*glue);
while ((this = ISC_LIST_HEAD(*glue)) != NULL) {
ISC_LIST_UNLINK(*glue, this, link);
ISC_LIST_APPEND(save, this, link);
diff --git a/external/bsd/bind/dist/lib/dns/masterdump.c b/external/bsd/bind/dist/lib/dns/masterdump.c
index a3ddd7d21b6..70940a162b4 100644
--- a/external/bsd/bind/dist/lib/dns/masterdump.c
+++ b/external/bsd/bind/dist/lib/dns/masterdump.c
@@ -1,4 +1,4 @@
-/* $NetBSD: masterdump.c,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: masterdump.c,v 1.4 2011/09/11 18:55:35 christos Exp $ */
/*
* Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: masterdump.c,v 1.99.328.3 2011-06-21 20:15:47 each Exp */
+/* Id: masterdump.c,v 1.108 2011-06-08 22:13:50 each Exp */
/*! \file */
@@ -76,6 +76,7 @@ struct dns_master_style {
unsigned int rdata_column;
unsigned int line_length;
unsigned int tab_width;
+ unsigned int split_width;
};
/*%
@@ -110,15 +111,16 @@ dns_master_style_default = {
DNS_STYLEFLAG_OMIT_TTL |
DNS_STYLEFLAG_TTL |
DNS_STYLEFLAG_COMMENT |
+ DNS_STYLEFLAG_RRCOMMENT |
DNS_STYLEFLAG_MULTILINE,
- 24, 24, 24, 32, 80, 8
+ 24, 24, 24, 32, 80, 8, UINT_MAX
};
LIBDNS_EXTERNAL_DATA const dns_master_style_t
dns_master_style_full = {
DNS_STYLEFLAG_COMMENT |
DNS_STYLEFLAG_RESIGN,
- 46, 46, 46, 64, 120, 8
+ 46, 46, 46, 64, 120, 8, UINT_MAX
};
LIBDNS_EXTERNAL_DATA const dns_master_style_t
@@ -128,8 +130,9 @@ dns_master_style_explicitttl = {
DNS_STYLEFLAG_REL_OWNER |
DNS_STYLEFLAG_REL_DATA |
DNS_STYLEFLAG_COMMENT |
+ DNS_STYLEFLAG_RRCOMMENT |
DNS_STYLEFLAG_MULTILINE,
- 24, 32, 32, 40, 80, 8
+ 24, 32, 32, 40, 80, 8, UINT_MAX
};
LIBDNS_EXTERNAL_DATA const dns_master_style_t
@@ -139,13 +142,13 @@ dns_master_style_cache = {
DNS_STYLEFLAG_MULTILINE |
DNS_STYLEFLAG_TRUST |
DNS_STYLEFLAG_NCACHE,
- 24, 32, 32, 40, 80, 8
+ 24, 32, 32, 40, 80, 8, UINT_MAX
};
LIBDNS_EXTERNAL_DATA const dns_master_style_t
dns_master_style_simple = {
0,
- 24, 32, 32, 40, 80, 8
+ 24, 32, 32, 40, 80, 8, UINT_MAX
};
/*%
@@ -154,7 +157,7 @@ dns_master_style_simple = {
LIBDNS_EXTERNAL_DATA const dns_master_style_t
dns_master_style_debug = {
DNS_STYLEFLAG_REL_OWNER,
- 24, 32, 40, 48, 80, 8
+ 24, 32, 40, 48, 80, 8, UINT_MAX
};
@@ -375,7 +378,7 @@ ncache_summary(dns_rdataset_t *rdataset, isc_boolean_t omit_final_dot,
dns_rdataset_current(&rds, &rdata);
CHECK(str_totext(" ", target));
CHECK(dns_rdata_tofmttext(&rdata, dns_rootname,
- 0, 0, " ", target));
+ 0, 0, 0, " ", target));
CHECK(str_totext("\n", target));
}
}
@@ -536,6 +539,7 @@ rdataset_totext(dns_rdataset_t *rdataset,
ctx->style.flags,
ctx->style.line_length -
ctx->style.rdata_column,
+ ctx->style.split_width,
ctx->linebreak,
target));
@@ -873,9 +877,8 @@ dump_rdatasets_text(isc_mem_t *mctx, dns_name_t *name,
for (i = 0; i < n; i++) {
dns_rdataset_t *rds = sorted[i];
- if (ctx->style.flags & DNS_STYLEFLAG_TRUST) {
+ if (ctx->style.flags & DNS_STYLEFLAG_TRUST)
fprintf(f, "; %s\n", dns_trust_totext(rds->trust));
- }
if (((rds->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) &&
(ctx->style.flags & DNS_STYLEFLAG_NCACHE) == 0) {
/* Omit negative cache entries */
@@ -1049,6 +1052,8 @@ dump_rdatasets_raw(isc_mem_t *mctx, dns_name_t *name,
buffer, f);
}
dns_rdataset_disassociate(&rdataset);
+ if (result != ISC_R_SUCCESS)
+ return (result);
}
if (result == ISC_R_NOMORE)
@@ -1358,23 +1363,24 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
isc_buffer_region(&buffer, &r);
isc_buffer_putuint32(&buffer, dns_masterformat_raw);
isc_buffer_putuint32(&buffer, DNS_RAWFORMAT_VERSION);
- if (sizeof(now32) != sizeof(dctx->now)) {
- /*
- * We assume isc_stdtime_t is a 32-bit integer,
- * which should be the case on most cases.
- * If it turns out to be uncommon, we'll need
- * to bump the version number and revise the
- * header format.
- */
- isc_log_write(dns_lctx,
- ISC_LOGCATEGORY_GENERAL,
- DNS_LOGMODULE_MASTERDUMP,
- ISC_LOG_INFO,
- "dumping master file in raw "
- "format: stdtime is not 32bits");
- now32 = 0;
- } else
- now32 = dctx->now;
+#if !defined(STDTIME_ON_32BITS) || (STDTIME_ON_32BITS + 0) != 1
+ /*
+ * We assume isc_stdtime_t is a 32-bit integer,
+ * which should be the case on most cases.
+ * If it turns out to be uncommon, we'll need
+ * to bump the version number and revise the
+ * header format.
+ */
+ isc_log_write(dns_lctx,
+ ISC_LOGCATEGORY_GENERAL,
+ DNS_LOGMODULE_MASTERDUMP,
+ ISC_LOG_INFO,
+ "dumping master file in raw "
+ "format: stdtime is not 32bits");
+ now32 = 0;
+#else
+ now32 = dctx->now;
+#endif
isc_buffer_putuint32(&buffer, now32);
INSIST(isc_buffer_usedlength(&buffer) <=
sizeof(rawheader));
@@ -1744,6 +1750,14 @@ dns_master_dumpnode(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
result = dns_master_dumpnodetostream(mctx, db, version, node, name,
style, f);
+ if (result != ISC_R_SUCCESS) {
+ isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL,
+ DNS_LOGMODULE_MASTERDUMP, ISC_LOG_ERROR,
+ "dumping master file: %s: dump: %s", filename,
+ isc_result_totext(result));
+ (void)isc_stdio_close(f);
+ return (ISC_R_UNEXPECTED);
+ }
result = isc_stdio_close(f);
if (result != ISC_R_SUCCESS) {
@@ -1765,6 +1779,19 @@ dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags,
unsigned int line_length, unsigned int tab_width,
isc_mem_t *mctx)
{
+ return (dns_master_stylecreate2(stylep, flags, ttl_column,
+ class_column, type_column,
+ rdata_column, line_length,
+ tab_width, 0xffffffff, mctx));
+}
+
+isc_result_t
+dns_master_stylecreate2(dns_master_style_t **stylep, unsigned int flags,
+ unsigned int ttl_column, unsigned int class_column,
+ unsigned int type_column, unsigned int rdata_column,
+ unsigned int line_length, unsigned int tab_width,
+ unsigned int split_width, isc_mem_t *mctx)
+{
dns_master_style_t *style;
REQUIRE(stylep != NULL && *stylep == NULL);
@@ -1779,6 +1806,7 @@ dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags,
style->rdata_column = rdata_column;
style->line_length = line_length;
style->tab_width = tab_width;
+ style->split_width = split_width;
*stylep = style;
return (ISC_R_SUCCESS);
diff --git a/external/bsd/bind/dist/lib/dns/message.c b/external/bsd/bind/dist/lib/dns/message.c
index 88c91fcf0d6..57b0ef9247d 100644
--- a/external/bsd/bind/dist/lib/dns/message.c
+++ b/external/bsd/bind/dist/lib/dns/message.c
@@ -1,4 +1,4 @@
-/* $NetBSD: message.c,v 1.7 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: message.c,v 1.8 2011/09/11 18:55:35 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: message.c,v 1.254.186.3 2011-06-21 20:15:47 each Exp */
+/* Id: message.c,v 1.257 2011-06-08 22:13:50 each Exp */
/*! \file */
@@ -1196,7 +1196,6 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
skip_name_search = ISC_FALSE;
skip_type_search = ISC_FALSE;
- free_name = ISC_FALSE;
free_rdataset = ISC_FALSE;
name = isc_mempool_get(msg->namepool);
@@ -2932,6 +2931,7 @@ dns_message_signer(dns_message_t *msg, dns_name_t *signer) {
dns_rdataset_current(msg->tsig, &rdata);
result = dns_rdata_tostruct(&rdata, &tsig, NULL);
+ INSIST(result == ISC_R_SUCCESS);
if (msg->tsigstatus != dns_rcode_noerror)
result = DNS_R_TSIGVERIFYFAILURE;
else if (tsig.error != dns_rcode_noerror)
diff --git a/external/bsd/bind/dist/lib/dns/name.c b/external/bsd/bind/dist/lib/dns/name.c
index d6433e18462..95aacae25d4 100644
--- a/external/bsd/bind/dist/lib/dns/name.c
+++ b/external/bsd/bind/dist/lib/dns/name.c
@@ -1,4 +1,4 @@
-/* $NetBSD: name.c,v 1.3 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: name.c,v 1.4 2011/09/11 18:55:35 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: name.c,v 1.174 2011-01-13 04:59:25 tbox Exp */
+/* Id: name.c,v 1.175 2011-03-11 06:11:23 marka Exp */
/*! \file */
@@ -1026,12 +1026,13 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
const dns_name_t *origin, unsigned int options,
isc_buffer_t *target)
{
- unsigned char *ndata, *label;
+ unsigned char *ndata, *label = NULL;
char *tdata;
char c;
ft_state state;
- unsigned int value, count;
- unsigned int n1, n2, tlen, nrem, nused, digits, labels, tused;
+ unsigned int value = 0, count = 0;
+ unsigned int n1 = 0, n2 = 0;
+ unsigned int tlen, nrem, nused, digits = 0, labels, tused;
isc_boolean_t done;
unsigned char *offsets;
dns_offsets_t odata;
@@ -1065,16 +1066,6 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
offsets[0] = 0;
/*
- * Initialize things to make the compiler happy; they're not required.
- */
- n1 = 0;
- n2 = 0;
- label = NULL;
- digits = 0;
- value = 0;
- count = 0;
-
- /*
* Make 'name' empty in case of failure.
*/
MAKE_EMPTY(name);
@@ -1173,6 +1164,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
return (DNS_R_BADLABELTYPE);
}
state = ft_escape;
+ POST(state);
/* FALLTHROUGH */
case ft_escape:
if (!isdigit(c & 0xff)) {
@@ -1238,6 +1230,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
label = origin->ndata;
n1 = origin->length;
nrem -= n1;
+ POST(nrem);
while (n1 > 0) {
n2 = *label++;
INSIST(n2 <= 63); /* no bitstring support */
diff --git a/external/bsd/bind/dist/lib/dns/ncache.c b/external/bsd/bind/dist/lib/dns/ncache.c
index d158df8b309..59e118c7633 100644
--- a/external/bsd/bind/dist/lib/dns/ncache.c
+++ b/external/bsd/bind/dist/lib/dns/ncache.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ncache.c,v 1.4 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: ncache.c,v 1.5 2011/09/11 18:55:35 christos Exp $ */
/*
* Copyright (C) 2004, 2005, 2007, 2008, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: ncache.c,v 1.50.124.1.2.3 2011-06-21 20:15:47 each Exp */
+/* Id: ncache.c,v 1.54 2011-06-08 22:13:50 each Exp */
/*! \file */
diff --git a/external/bsd/bind/dist/lib/dns/nsec.c b/external/bsd/bind/dist/lib/dns/nsec.c
index eaf6417d8d8..c588609d1a9 100644
--- a/external/bsd/bind/dist/lib/dns/nsec.c
+++ b/external/bsd/bind/dist/lib/dns/nsec.c
@@ -1,7 +1,7 @@
-/* $NetBSD: nsec.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: nsec.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: nsec.c,v 1.13 2009-01-06 23:47:57 tbox Exp */
+/* Id: nsec.c,v 1.16 2011-06-10 01:51:09 each Exp */
/*! \file */
@@ -184,7 +184,7 @@ dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
0, NULL);
if (result == DNS_R_UNCHANGED)
result = ISC_R_SUCCESS;
- RETERR(result);
+
failure:
if (dns_rdataset_isassociated(&rdataset))
dns_rdataset_disassociate(&rdataset);
@@ -247,10 +247,8 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version,
0, 0, &rdataset, NULL);
dns_db_detachnode(db, &node);
- if (result == ISC_R_NOTFOUND) {
+ if (result == ISC_R_NOTFOUND)
*answer = ISC_FALSE;
- return (ISC_R_SUCCESS);
- }
if (result != ISC_R_SUCCESS)
return (result);
for (result = dns_rdataset_first(&rdataset);
diff --git a/external/bsd/bind/dist/lib/dns/nsec3.c b/external/bsd/bind/dist/lib/dns/nsec3.c
index b3552e406b4..2cb7c6cc83b 100644
--- a/external/bsd/bind/dist/lib/dns/nsec3.c
+++ b/external/bsd/bind/dist/lib/dns/nsec3.c
@@ -1,7 +1,7 @@
-/* $NetBSD: nsec3.c,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: nsec3.c,v 1.4 2011/09/11 18:55:35 christos Exp $ */
/*
- * Copyright (C) 2006, 2008-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006, 2008-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: nsec3.c,v 1.19.96.1 2011-06-21 20:15:48 each Exp */
+/* Id: nsec3.c,v 1.23 2011-06-10 01:51:09 each Exp */
#include <config.h>
@@ -51,6 +51,7 @@
#define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
#define CREATE(x) (((x) & DNS_NSEC3FLAG_CREATE) != 0)
+#define INITIAL(x) (((x) & DNS_NSEC3FLAG_INITIAL) != 0)
#define REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0)
static void
@@ -559,7 +560,7 @@ dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_rdataset_t rdataset;
int pass;
- isc_boolean_t exists;
+ isc_boolean_t exists = ISC_FALSE;
isc_boolean_t maybe_remove_unsecure = ISC_FALSE;
isc_uint8_t flags;
isc_buffer_t buffer;
diff --git a/external/bsd/bind/dist/lib/dns/openssl_link.c b/external/bsd/bind/dist/lib/dns/openssl_link.c
index d87101fb2bb..f19b58a5e2f 100644
--- a/external/bsd/bind/dist/lib/dns/openssl_link.c
+++ b/external/bsd/bind/dist/lib/dns/openssl_link.c
@@ -1,7 +1,7 @@
-/* $NetBSD: openssl_link.c,v 1.5 2011/06/06 05:40:34 spz Exp $ */
+/* $NetBSD: openssl_link.c,v 1.6 2011/09/11 18:55:35 christos Exp $ */
/*
- * Portions Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -33,7 +33,7 @@
/*
* Principal Author: Brian Wellington
- * Id: openssl_link.c,v 1.29 2010-09-15 12:38:36 tbox Exp
+ * Id: openssl_link.c,v 1.31 2011-03-12 04:59:48 tbox Exp
*/
#ifdef OPENSSL
@@ -52,16 +52,6 @@
#include "dst_internal.h"
#include "dst_openssl.h"
-#include <openssl/err.h>
-#include <openssl/rand.h>
-#include <openssl/evp.h>
-#include <openssl/conf.h>
-#include <openssl/crypto.h>
-
-#if defined(CRYPTO_LOCK_ENGINE) && (OPENSSL_VERSION_NUMBER >= 0x0090707f)
-#define USE_ENGINE 1
-#endif
-
#ifdef USE_ENGINE
#include <openssl/engine.h>
#endif
@@ -317,19 +307,19 @@ dst__openssl_toresult(isc_result_t fallback) {
return (result);
}
+#if defined(USE_ENGINE)
ENGINE *
dst__openssl_getengine(const char *engine) {
if (engine == NULL)
return (NULL);
-#if defined(USE_ENGINE)
if (e == NULL)
return (NULL);
if (strcmp(engine, ENGINE_get_id(e)) == 0)
return (e);
-#endif
return (NULL);
}
+#endif
#else /* OPENSSL */
diff --git a/external/bsd/bind/dist/lib/dns/openssldsa_link.c b/external/bsd/bind/dist/lib/dns/openssldsa_link.c
index 97e91c31335..b4981cad091 100644
--- a/external/bsd/bind/dist/lib/dns/openssldsa_link.c
+++ b/external/bsd/bind/dist/lib/dns/openssldsa_link.c
@@ -1,4 +1,4 @@
-/* $NetBSD: openssldsa_link.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: openssldsa_link.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
* Portions Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -31,7 +31,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: openssldsa_link.c,v 1.20 2011-01-11 23:47:13 tbox Exp */
+/* Id: openssldsa_link.c,v 1.21 2011-03-11 06:11:24 marka Exp */
#ifdef OPENSSL
#ifndef USE_EVP
@@ -254,7 +254,6 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
dsasig->r = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL);
cp += ISC_SHA1_DIGESTLENGTH;
dsasig->s = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL);
- cp += ISC_SHA1_DIGESTLENGTH;
#if 0
pkey = EVP_PKEY_new();
diff --git a/external/bsd/bind/dist/lib/dns/opensslrsa_link.c b/external/bsd/bind/dist/lib/dns/opensslrsa_link.c
index b570563d39d..0275c5d748e 100644
--- a/external/bsd/bind/dist/lib/dns/opensslrsa_link.c
+++ b/external/bsd/bind/dist/lib/dns/opensslrsa_link.c
@@ -1,4 +1,4 @@
-/* $NetBSD: opensslrsa_link.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: opensslrsa_link.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
* Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -19,7 +19,7 @@
/*
* Principal Author: Brian Wellington
- * Id: opensslrsa_link.c,v 1.39 2011-01-11 23:47:13 tbox Exp
+ * Id: opensslrsa_link.c,v 1.41 2011-03-11 02:59:37 marka Exp
*/
#ifdef OPENSSL
#include <config.h>
@@ -53,7 +53,9 @@
#if OPENSSL_VERSION_NUMBER > 0x00908000L
#include <openssl/bn.h>
#endif
+#ifdef USE_ENGINE
#include <openssl/engine.h>
+#endif
/*
* We don't use configure for windows so enforce the OpenSSL version
@@ -1140,10 +1142,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
isc_result_t ret;
int i;
RSA *rsa = NULL, *pubrsa = NULL;
+#ifdef USE_ENGINE
ENGINE *e = NULL;
+#endif
isc_mem_t *mctx = key->mctx;
const char *engine = NULL, *label = NULL;
+#if defined(USE_ENGINE) || USE_EVP
EVP_PKEY *pkey = NULL;
+#endif
#if USE_EVP
if (pub != NULL && pub->keydata.pkey != NULL)
@@ -1177,6 +1183,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
* See if we can fetch it.
*/
if (label != NULL) {
+#ifdef USE_ENGINE
if (engine == NULL)
DST_RET(DST_R_NOENGINE);
e = dst__openssl_getengine(engine);
@@ -1211,6 +1218,9 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
dst__privstruct_free(&priv, mctx);
memset(&priv, 0, sizeof(priv));
return (ISC_R_SUCCESS);
+#else
+ DST_RET(DST_R_NOENGINE);
+#endif
}
rsa = RSA_new();
@@ -1305,6 +1315,7 @@ static isc_result_t
opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
const char *pin)
{
+#ifdef USE_ENGINE
ENGINE *e = NULL;
isc_result_t ret;
EVP_PKEY *pkey = NULL;
@@ -1368,6 +1379,13 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
if (pkey != NULL)
EVP_PKEY_free(pkey);
return (ret);
+#else
+ UNUSED(key);
+ UNUSED(engine);
+ UNUSED(label);
+ UNUSED(pin);
+ return(DST_R_NOENGINE);
+#endif
}
static dst_func_t opensslrsa_functions = {
diff --git a/external/bsd/bind/dist/lib/dns/private.c b/external/bsd/bind/dist/lib/dns/private.c
index 530ac9246fe..9f11ecebb5b 100644
--- a/external/bsd/bind/dist/lib/dns/private.c
+++ b/external/bsd/bind/dist/lib/dns/private.c
@@ -1,7 +1,7 @@
-/* $NetBSD: private.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: private.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
- * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: private.c,v 1.3 2009-10-09 23:48:09 tbox Exp */
+/* Id: private.c,v 1.6 2011-06-10 01:51:09 each Exp */
#include "config.h"
@@ -46,6 +46,7 @@
#define REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0)
#define CREATE(x) (((x) & DNS_NSEC3FLAG_CREATE) != 0)
+#define INITIAL(x) (((x) & DNS_NSEC3FLAG_INITIAL) != 0)
#define NONSEC(x) (((x) & DNS_NSEC3FLAG_NONSEC) != 0)
#define CHECK(x) do { \
@@ -151,7 +152,7 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
}
/*
- * Look to see if we also need to be creating a NSEC3 chains.
+ * Look to see if we also need to be creating a NSEC3 chain.
*/
if (dns_rdataset_isassociated(&nsecset)) {
if (build_nsec != NULL)
diff --git a/external/bsd/bind/dist/lib/dns/rbt.c b/external/bsd/bind/dist/lib/dns/rbt.c
index cc9c9d9a770..114f32479db 100644
--- a/external/bsd/bind/dist/lib/dns/rbt.c
+++ b/external/bsd/bind/dist/lib/dns/rbt.c
@@ -1,7 +1,7 @@
-/* $NetBSD: rbt.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: rbt.c,v 1.3 2011/09/11 18:55:35 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rbt.c,v 1.146 2009-10-27 04:46:58 marka Exp */
+/* Id: rbt.c,v 1.148 2011-03-12 04:59:48 tbox Exp */
/*! \file */
@@ -720,6 +720,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
*/
compared = dns_namereln_none;
last_compared = NULL;
+ order = 0;
}
dns_fixedname_init(&fixedcallbackname);
@@ -1086,6 +1087,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
&current_name,
&order,
&common_labels);
+ POST(compared);
last_compared = current;
@@ -1528,7 +1530,7 @@ rehash(dns_rbt_t *rbt) {
oldsize = rbt->hashsize;
oldtable = rbt->hashtable;
- rbt->hashsize *= 2 + 1;
+ rbt->hashsize = rbt->hashsize * 2 + 1;
rbt->hashtable = isc_mem_get(rbt->mctx,
rbt->hashsize * sizeof(dns_rbtnode_t *));
if (rbt->hashtable == NULL) {
@@ -1685,6 +1687,7 @@ dns_rbt_addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order,
}
child = root;
+ POST(child);
dns_name_init(&add_name, add_offsets);
NODENAME(node, &add_name);
diff --git a/external/bsd/bind/dist/lib/dns/rbtdb.c b/external/bsd/bind/dist/lib/dns/rbtdb.c
index 8aaf9ab62a3..a3a6d2414b9 100644
--- a/external/bsd/bind/dist/lib/dns/rbtdb.c
+++ b/external/bsd/bind/dist/lib/dns/rbtdb.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rbtdb.c,v 1.9 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: rbtdb.c,v 1.10 2011/09/11 18:55:36 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rbtdb.c,v 1.310.8.1.2.1 2011-06-21 20:15:48 each Exp */
+/* Id: rbtdb.c,v 1.316 2011-08-23 00:59:23 each Exp */
/*! \file */
@@ -438,8 +438,12 @@ typedef struct {
rbtnodelist_t *deadnodes;
/*
- * Heaps. Each of these is used for TTL based expiry.
+ * Heaps. These are used for TTL based expiry in a cache,
+ * or for zone resigning in a zone DB. hmctx is the memory
+ * context to use for the heap (which differs from the main
+ * database memory context in the case of a cache).
*/
+ isc_mem_t * hmctx;
isc_heap_t **heaps;
/* Locked by tree_lock. */
@@ -957,9 +961,8 @@ free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t log, isc_event_t *event) {
if (rbtdb->heaps != NULL) {
for (i = 0; i < rbtdb->node_lock_count; i++)
isc_heap_destroy(&rbtdb->heaps[i]);
- isc_mem_put(rbtdb->common.mctx, rbtdb->heaps,
- rbtdb->node_lock_count *
- sizeof(isc_heap_t *));
+ isc_mem_put(rbtdb->hmctx, rbtdb->heaps,
+ rbtdb->node_lock_count * sizeof(isc_heap_t *));
}
if (rbtdb->rrsetstats != NULL)
@@ -981,6 +984,7 @@ free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t log, isc_event_t *event) {
rbtdb->common.magic = 0;
rbtdb->common.impmagic = 0;
ondest = rbtdb->common.ondest;
+ isc_mem_detach(&rbtdb->hmctx);
isc_mem_putanddetach(&rbtdb->common.mctx, rbtdb, sizeof(*rbtdb));
isc_ondestroy_notify(&ondest, rbtdb);
}
@@ -2693,10 +2697,15 @@ zone_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
/*
* Did we find anything?
*/
- if (dname_header != NULL) {
+ if (!IS_CACHE(search->rbtdb) && !IS_STUB(search->rbtdb) &&
+ ns_header != NULL) {
/*
- * Note that DNAME has precedence over NS if both exist.
+ * Note that NS has precedence over DNAME if both exist
+ * in a zone. Otherwise DNAME take precedence over NS.
*/
+ found = ns_header;
+ search->zonecut_sigrdataset = NULL;
+ } else if (dname_header != NULL) {
found = dname_header;
search->zonecut_sigrdataset = sigdname_header;
} else if (ns_header != NULL) {
@@ -4105,6 +4114,7 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
*/
if (search.need_cleanup) {
node = search.zonecut;
+ INSIST(node != NULL);
lock = &(search.rbtdb->node_locks[node->locknum].lock);
NODE_LOCK(lock, isc_rwlocktype_read);
@@ -4406,6 +4416,7 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
NODE_UNLOCK(lock, locktype);
NODE_LOCK(lock, isc_rwlocktype_write);
locktype = isc_rwlocktype_write;
+ POST(locktype);
}
if (need_headerupdate(found, search->now))
update_header(search->rbtdb, found,
@@ -4910,15 +4921,9 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
cname_ok &&
cnamesig != NULL) {
/*
- * If we've already got the CNAME RRSIG,
- * use it, otherwise change sigtype
- * so that we find it.
+ * If we've already got the
+ * CNAME RRSIG, use it.
*/
- if (cnamesig != NULL)
- foundsig = cnamesig;
- else
- sigtype =
- RBTDB_RDATATYPE_SIGCNAME;
foundsig = cnamesig;
}
} else if (header->type == sigtype) {
@@ -5064,6 +5069,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
NODE_UNLOCK(lock, locktype);
NODE_LOCK(lock, isc_rwlocktype_write);
locktype = isc_rwlocktype_write;
+ POST(locktype);
}
if (update != NULL && need_headerupdate(update, search.now))
update_header(search.rbtdb, update, search.now);
@@ -5081,6 +5087,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
*/
if (search.need_cleanup) {
node = search.zonecut;
+ INSIST(node != NULL);
lock = &(search.rbtdb->node_locks[node->locknum].lock);
NODE_LOCK(lock, isc_rwlocktype_read);
@@ -5246,6 +5253,7 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
NODE_UNLOCK(lock, locktype);
NODE_LOCK(lock, isc_rwlocktype_write);
locktype = isc_rwlocktype_write;
+ POST(locktype);
}
if (need_headerupdate(found, search.now))
update_header(search.rbtdb, found, search.now);
@@ -7465,16 +7473,21 @@ dns_rbtdb_create
int i;
dns_name_t name;
isc_boolean_t (*sooner)(void *, void *);
+ isc_mem_t *hmctx = mctx;
/* Keep the compiler happy. */
- UNUSED(argc);
- UNUSED(argv);
UNUSED(driverarg);
rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
if (rbtdb == NULL)
return (ISC_R_NOMEMORY);
+ /*
+ * If argv[0] exists, it points to a memory context to use for heap
+ */
+ if (argc != 0)
+ hmctx = (isc_mem_t *) argv[0];
+
memset(rbtdb, '\0', sizeof(*rbtdb));
dns_name_init(&rbtdb->common.origin, NULL);
rbtdb->common.attributes = 0;
@@ -7539,7 +7552,7 @@ dns_rbtdb_create
/*
* Create the heaps.
*/
- rbtdb->heaps = isc_mem_get(mctx, rbtdb->node_lock_count *
+ rbtdb->heaps = isc_mem_get(hmctx, rbtdb->node_lock_count *
sizeof(isc_heap_t *));
if (rbtdb->heaps == NULL) {
result = ISC_R_NOMEMORY;
@@ -7549,7 +7562,7 @@ dns_rbtdb_create
rbtdb->heaps[i] = NULL;
sooner = IS_CACHE(rbtdb) ? ttl_sooner : resign_sooner;
for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
- result = isc_heap_create(mctx, sooner, set_index, 0,
+ result = isc_heap_create(hmctx, sooner, set_index, 0,
&rbtdb->heaps[i]);
if (result != ISC_R_SUCCESS)
goto cleanup_heaps;
@@ -7593,6 +7606,7 @@ dns_rbtdb_create
* mctx won't disappear out from under us.
*/
isc_mem_attach(mctx, &rbtdb->common.mctx);
+ isc_mem_attach(hmctx, &rbtdb->hmctx);
/*
* Must be initialized before free_rbtdb() is called.
@@ -8468,7 +8482,7 @@ dbiterator_last(dns_dbiterator_t *iterator) {
static isc_result_t
dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) {
- isc_result_t result;
+ isc_result_t result, tresult;
rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
dns_name_t *iname, *origin;
@@ -8511,13 +8525,14 @@ dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) {
DNS_RBTFIND_EMPTYDATA, NULL, NULL);
if (result == DNS_R_PARTIALMATCH) {
dns_rbtnode_t *node = NULL;
- result = dns_rbt_findnode(rbtdb->nsec3, name, NULL,
+ tresult = dns_rbt_findnode(rbtdb->nsec3, name, NULL,
&node, &rbtdbiter->nsec3chain,
DNS_RBTFIND_EMPTYDATA,
NULL, NULL);
- if (result == ISC_R_SUCCESS) {
+ if (tresult == ISC_R_SUCCESS) {
rbtdbiter->node = node;
rbtdbiter->current = &rbtdbiter->nsec3chain;
+ result = tresult;
}
}
}
diff --git a/external/bsd/bind/dist/lib/dns/rbtdb.h b/external/bsd/bind/dist/lib/dns/rbtdb.h
index 4efc53997cc..c2c6353a3f1 100644
--- a/external/bsd/bind/dist/lib/dns/rbtdb.h
+++ b/external/bsd/bind/dist/lib/dns/rbtdb.h
@@ -1,7 +1,7 @@
-/* $NetBSD: rbtdb.h,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: rbtdb.h,v 1.3 2011/09/11 18:55:36 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rbtdb.h,v 1.18 2007-06-19 23:47:16 tbox Exp */
+/* Id: rbtdb.h,v 1.20 2011-03-03 23:47:32 tbox Exp */
#ifndef DNS_RBTDB_H
#define DNS_RBTDB_H 1
@@ -41,6 +41,19 @@ dns_rbtdb_create(isc_mem_t *mctx, dns_name_t *base, dns_dbtype_t type,
dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
void *driverarg, dns_db_t **dbp);
+/*%<
+ * Create a new database of type "rbt" (or "rbt64"). Called via
+ * dns_db_create(); see documentation for that function for more details.
+ *
+ * If argv[0] is set, it points to a valid memory context to be used for
+ * allocation of heap memory. Generally this is used for cache databases
+ * only.
+ *
+ * Requires:
+ *
+ * \li argc == 0 or argv[0] is a valid memory context.
+ */
+
ISC_LANG_ENDDECLS
#endif /* DNS_RBTDB_H */
diff --git a/external/bsd/bind/dist/lib/dns/rcode.c b/external/bsd/bind/dist/lib/dns/rcode.c
index 0de44e589ff..b6cbddaffba 100644
--- a/external/bsd/bind/dist/lib/dns/rcode.c
+++ b/external/bsd/bind/dist/lib/dns/rcode.c
@@ -1,7 +1,7 @@
-/* $NetBSD: rcode.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: rcode.c,v 1.3 2011/09/11 18:55:36 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rcode.c,v 1.16 2010-12-23 04:07:58 marka Exp */
+/* Id: rcode.c,v 1.18 2011-02-21 23:47:45 tbox Exp */
#include <config.h>
#include <ctype.h>
@@ -496,6 +496,9 @@ dns_rdataclass_format(dns_rdataclass_t rdclass,
isc_result_t result;
isc_buffer_t buf;
+ if (size == 0U)
+ return;
+
isc_buffer_init(&buf, array, size);
result = dns_rdataclass_totext(rdclass, &buf);
/*
@@ -507,8 +510,6 @@ dns_rdataclass_format(dns_rdataclass_t rdclass,
else
result = ISC_R_NOSPACE;
}
- if (result != ISC_R_SUCCESS) {
- snprintf(array, size, "<unknown>");
- array[size - 1] = '\0';
- }
+ if (result != ISC_R_SUCCESS)
+ strlcpy(array, "<unknown>", size);
}
diff --git a/external/bsd/bind/dist/lib/dns/rdata.c b/external/bsd/bind/dist/lib/dns/rdata.c
index a6f07ef1150..4a07cd3f257 100644
--- a/external/bsd/bind/dist/lib/dns/rdata.c
+++ b/external/bsd/bind/dist/lib/dns/rdata.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rdata.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: rdata.c,v 1.3 2011/09/11 18:55:36 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rdata.c,v 1.209 2011-01-13 04:59:25 tbox Exp */
+/* Id: rdata.c,v 1.213 2011-03-11 06:11:24 marka Exp */
/*! \file */
@@ -126,6 +126,15 @@ txt_fromtext(isc_textregion_t *source, isc_buffer_t *target);
static isc_result_t
txt_fromwire(isc_buffer_t *source, isc_buffer_t *target);
+static isc_result_t
+multitxt_totext(isc_region_t *source, isc_buffer_t *target);
+
+static isc_result_t
+multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target);
+
+static isc_result_t
+multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target);
+
static isc_boolean_t
name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target);
@@ -710,6 +719,7 @@ rdata_totext(dns_rdata_t *rdata, dns_rdata_textctx_t *tctx,
if (use_default) {
strlcpy(buf, "\\# ", sizeof(buf));
result = str_totext(buf, target);
+ INSIST(result == ISC_R_SUCCESS);
dns_rdata_toregion(rdata, &sr);
INSIST(sr.length < 65536);
snprintf(buf, sizeof(buf), "%u", sr.length);
@@ -719,7 +729,13 @@ rdata_totext(dns_rdata_t *rdata, dns_rdata_textctx_t *tctx,
result = str_totext(" ( ", target);
else
result = str_totext(" ", target);
- if (result == ISC_R_SUCCESS)
+
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
+ if (tctx->width == 0) /* No splitting */
+ result = isc_hex_totext(&sr, 0, "", target);
+ else
result = isc_hex_totext(&sr, tctx->width - 2,
tctx->linebreak,
target);
@@ -752,7 +768,8 @@ dns_rdata_totext(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target)
isc_result_t
dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin,
unsigned int flags, unsigned int width,
- const char *linebreak, isc_buffer_t *target)
+ unsigned int split_width, const char *linebreak,
+ isc_buffer_t *target)
{
dns_rdata_textctx_t tctx;
@@ -763,11 +780,16 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin,
*/
tctx.origin = origin;
tctx.flags = flags;
- if ((flags & DNS_STYLEFLAG_MULTILINE) != 0) {
+ if (split_width == 0xffffffff)
tctx.width = width;
+ else
+ tctx.width = split_width;
+
+ if ((flags & DNS_STYLEFLAG_MULTILINE) != 0)
tctx.linebreak = linebreak;
- } else {
- tctx.width = 60; /* Used for hex word length only. */
+ else {
+ if (split_width == 0xffffffff)
+ tctx.width = 60; /* Used for hex word length only. */
tctx.linebreak = " ";
}
return (rdata_totext(rdata, &tctx, target));
@@ -965,6 +987,9 @@ dns_rdatatype_format(dns_rdatatype_t rdtype,
isc_result_t result;
isc_buffer_t buf;
+ if (size == 0U)
+ return;
+
isc_buffer_init(&buf, array, size);
result = dns_rdatatype_totext(rdtype, &buf);
/*
@@ -976,10 +1001,8 @@ dns_rdatatype_format(dns_rdatatype_t rdtype,
else
result = ISC_R_NOSPACE;
}
- if (result != ISC_R_SUCCESS) {
- snprintf(array, size, "<unknown>");
- array[size - 1] = '\0';
- }
+ if (result != ISC_R_SUCCESS)
+ strlcpy(array, "<unknown>", size);
}
/*
@@ -1133,6 +1156,157 @@ txt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
return (ISC_R_SUCCESS);
}
+static isc_result_t
+multitxt_totext(isc_region_t *source, isc_buffer_t *target) {
+ unsigned int tl;
+ unsigned int n0, n;
+ unsigned char *sp;
+ char *tp;
+ isc_region_t region;
+
+ isc_buffer_availableregion(target, &region);
+ sp = source->base;
+ tp = (char *)region.base;
+ tl = region.length;
+
+ if (tl < 1)
+ return (ISC_R_NOSPACE);
+ *tp++ = '"';
+ tl--;
+ do {
+ n0 = n = *sp++;
+
+ REQUIRE(n0 + 1 <= source->length);
+
+ while (n--) {
+ if (*sp < 0x20 || *sp >= 0x7f) {
+ if (tl < 4)
+ return (ISC_R_NOSPACE);
+ *tp++ = 0x5c;
+ *tp++ = 0x30 + ((*sp / 100) % 10);
+ *tp++ = 0x30 + ((*sp / 10) % 10);
+ *tp++ = 0x30 + (*sp % 10);
+ sp++;
+ tl -= 4;
+ continue;
+ }
+ /* double quote, semi-colon, backslash */
+ if (*sp == 0x22 || *sp == 0x3b || *sp == 0x5c) {
+ if (tl < 2)
+ return (ISC_R_NOSPACE);
+ *tp++ = '\\';
+ tl--;
+ }
+ if (tl < 1)
+ return (ISC_R_NOSPACE);
+ *tp++ = *sp++;
+ tl--;
+ }
+ isc_region_consume(source, n0 + 1);
+ } while (source->length != 0);
+ if (tl < 1)
+ return (ISC_R_NOSPACE);
+ *tp++ = '"';
+ tl--;
+ isc_buffer_add(target, tp - (char *)region.base);
+ return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
+ isc_region_t tregion;
+ isc_boolean_t escape;
+ unsigned int n, nrem;
+ char *s;
+ unsigned char *t0, *t;
+ int d;
+ int c;
+
+ s = source->base;
+ n = source->length;
+ escape = ISC_FALSE;
+
+ do {
+ isc_buffer_availableregion(target, &tregion);
+ t0 = tregion.base;
+ nrem = tregion.length;
+ if (nrem < 1)
+ return (ISC_R_NOSPACE);
+ /* length byte */
+ t = t0;
+ nrem--;
+ t++;
+ /* 255 byte character-string slice */
+ if (nrem > 255)
+ nrem = 255;
+ while (n != 0) {
+ --n;
+ c = (*s++) & 0xff;
+ if (escape && (d = decvalue((char)c)) != -1) {
+ c = d;
+ if (n == 0)
+ return (DNS_R_SYNTAX);
+ n--;
+ if ((d = decvalue(*s++)) != -1)
+ c = c * 10 + d;
+ else
+ return (DNS_R_SYNTAX);
+ if (n == 0)
+ return (DNS_R_SYNTAX);
+ n--;
+ if ((d = decvalue(*s++)) != -1)
+ c = c * 10 + d;
+ else
+ return (DNS_R_SYNTAX);
+ if (c > 255)
+ return (DNS_R_SYNTAX);
+ } else if (!escape && c == '\\') {
+ escape = ISC_TRUE;
+ continue;
+ }
+ escape = ISC_FALSE;
+ *t++ = c;
+ nrem--;
+ if (nrem == 0)
+ break;
+ }
+ if (escape)
+ return (DNS_R_SYNTAX);
+ *t0 = t - t0 - 1;
+ isc_buffer_add(target, *t0 + 1);
+ } while (n != 0);
+ return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
+ unsigned int n;
+ isc_region_t sregion;
+ isc_region_t tregion;
+
+ isc_buffer_activeregion(source, &sregion);
+ if (sregion.length == 0)
+ return(ISC_R_UNEXPECTEDEND);
+ n = 256U;
+ do {
+ if (n != 256U)
+ return (DNS_R_SYNTAX);
+ n = *sregion.base + 1;
+ if (n > sregion.length)
+ return (ISC_R_UNEXPECTEDEND);
+
+ isc_buffer_availableregion(target, &tregion);
+ if (n > tregion.length)
+ return (ISC_R_NOSPACE);
+
+ memcpy(tregion.base, sregion.base, n);
+ isc_buffer_forward(source, n);
+ isc_buffer_add(target, n);
+ isc_buffer_activeregion(source, &sregion);
+ } while (sregion.length != 0);
+ return (ISC_R_SUCCESS);
+}
+
static isc_boolean_t
name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target) {
int l1, l2;
diff --git a/external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c b/external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c
index 636cfd97a4a..9ba55cbb5c1 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c
@@ -1,7 +1,7 @@
-/* $NetBSD: tsig_250.c,v 1.2 2011/02/16 03:47:08 christos Exp $ */
+/* $NetBSD: tsig_250.c,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: tsig_250.c,v 1.65 2009-12-04 22:06:37 tbox Exp */
+/* Id: tsig_250.c,v 1.67 2011-03-05 23:52:30 tbox Exp */
/* Reviewed: Thu Mar 16 13:39:43 PST 2000 by gson */
@@ -204,8 +204,11 @@ totext_any_tsig(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&sigr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&sigr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&sigr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ) ", target));
else
@@ -243,7 +246,10 @@ totext_any_tsig(ARGS_TOTEXT) {
/*
* Other.
*/
- return (isc_base64_totext(&sr, 60, " ", target));
+ if (tctx->width == 0) /* No splitting */
+ return (isc_base64_totext(&sr, 60, "", target));
+ else
+ return (isc_base64_totext(&sr, 60, " ", target));
}
static inline isc_result_t
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c b/external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c
index 4ba6517f7d0..a9d0a43567e 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c
@@ -1,7 +1,7 @@
-/* $NetBSD: cert_37.c,v 1.2 2011/02/16 03:47:08 christos Exp $ */
+/* $NetBSD: cert_37.c,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: cert_37.c,v 1.52 2009-12-04 22:06:37 tbox Exp */
+/* Id: cert_37.c,v 1.54 2011-03-05 23:52:30 tbox Exp */
/* Reviewed: Wed Mar 15 21:14:32 EST 2000 by tale */
@@ -111,8 +111,11 @@ totext_cert(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&sr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&sr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c b/external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c
index e0b3e9bf41a..1ab228cd3b9 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dlv_32769.c,v 1.2 2011/02/16 03:47:08 christos Exp $ */
+/* $NetBSD: dlv_32769.c,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2004, 2006, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dlv_32769.c,v 1.10 2010-12-23 23:47:08 tbox Exp */
+/* Id: dlv_32769.c,v 1.12 2011-03-05 23:52:31 tbox Exp */
/* draft-ietf-dnsext-delegation-signer-05.txt */
@@ -136,7 +136,11 @@ totext_dlv(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_hex_totext(&sr, 0, "", target));
+ else
+ RETERR(isc_hex_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c b/external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c
index 0671d5aea83..8a4651ab315 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dnskey_48.c,v 1.2 2011/02/16 03:47:08 christos Exp $ */
+/* $NetBSD: dnskey_48.c,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dnskey_48.c,v 1.10 2009-12-04 22:06:37 tbox Exp */
+/* Id: dnskey_48.c,v 1.12 2011-03-05 23:52:31 tbox Exp */
/*
* Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
@@ -78,7 +78,8 @@ totext_dnskey(ARGS_TOTEXT) {
char buf[sizeof("64000")];
unsigned int flags;
unsigned char algorithm;
- char namebuf[DNS_NAME_FORMATSIZE];
+ char algbuf[DNS_NAME_FORMATSIZE];
+ const char *keyinfo;
REQUIRE(rdata->type == 48);
REQUIRE(rdata->length != 0);
@@ -91,6 +92,13 @@ totext_dnskey(ARGS_TOTEXT) {
sprintf(buf, "%u", flags);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
+ if ((flags & DNS_KEYFLAG_KSK) != 0) {
+ if (flags & DNS_KEYFLAG_REVOKE)
+ keyinfo = "revoked KSK";
+ else
+ keyinfo = "KSK";
+ } else
+ keyinfo = "ZSK";
/* protocol */
sprintf(buf, "%u", sr.base[0]);
@@ -108,23 +116,28 @@ totext_dnskey(ARGS_TOTEXT) {
if ((flags & 0xc000) == 0xc000)
return (ISC_R_SUCCESS);
- if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0 &&
+ if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 &&
algorithm == DNS_KEYALG_PRIVATEDNS) {
dns_name_t name;
dns_name_init(&name, NULL);
dns_name_fromregion(&name, &sr);
- dns_name_format(&name, namebuf, sizeof(namebuf));
- } else
- namebuf[0] = 0;
+ dns_name_format(&name, algbuf, sizeof(algbuf));
+ } else {
+ dns_secalg_format((dns_secalg_t) algorithm, algbuf,
+ sizeof(algbuf));
+ }
/* key */
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&sr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&sr, 0, "", target));
+ else
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
- if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0)
+ if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
RETERR(str_totext(tctx->linebreak, target));
else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ", target));
@@ -132,18 +145,17 @@ totext_dnskey(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(")", target));
- if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) {
+ if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
isc_region_t tmpr;
- RETERR(str_totext(" ; key id = ", target));
+ RETERR(str_totext(" ; ", target));
+ RETERR(str_totext(keyinfo, target));
+ RETERR(str_totext("; alg = ", target));
+ RETERR(str_totext(algbuf, target));
+ RETERR(str_totext("; key id = ", target));
dns_rdata_toregion(rdata, &tmpr);
sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm));
RETERR(str_totext(buf, target));
- if (algorithm == DNS_KEYALG_PRIVATEDNS) {
- RETERR(str_totext(tctx->linebreak, target));
- RETERR(str_totext("; alg = ", target));
- RETERR(str_totext(namebuf, target));
- }
}
return (ISC_R_SUCCESS);
}
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c b/external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c
index 474f1fb5802..4e152cc1860 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c
@@ -1,7 +1,7 @@
-/* $NetBSD: ds_43.c,v 1.2 2011/02/16 03:47:08 christos Exp $ */
+/* $NetBSD: ds_43.c,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: ds_43.c,v 1.16 2010-12-23 23:47:08 tbox Exp */
+/* Id: ds_43.c,v 1.18 2011-03-05 23:52:31 tbox Exp */
/* draft-ietf-dnsext-delegation-signer-05.txt */
@@ -136,7 +136,11 @@ totext_ds(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_hex_totext(&sr, 0, "", target));
+ else
+ RETERR(isc_hex_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c b/external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c
index 65f98d676a4..5a67cf6d011 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ipseckey_45.c,v 1.2 2011/02/16 03:47:08 christos Exp $ */
+/* $NetBSD: ipseckey_45.c,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
* Copyright (C) 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: ipseckey_45.c,v 1.11 2011-01-13 04:59:26 tbox Exp */
+/* Id: ipseckey_45.c,v 1.12 2011-03-05 19:39:07 each Exp */
#ifndef RDATA_GENERIC_IPSECKEY_45_C
#define RDATA_GENERIC_IPSECKEY_45_C
@@ -192,8 +192,11 @@ totext_ipseckey(ARGS_TOTEXT) {
*/
if (region.length > 0U) {
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&region, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&region, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&region, tctx->width - 2,
+ tctx->linebreak, target));
}
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c b/external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c
index 0861f37dafb..0e7fd8202f8 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c
@@ -1,7 +1,7 @@
-/* $NetBSD: key_25.c,v 1.2 2011/02/16 03:47:08 christos Exp $ */
+/* $NetBSD: key_25.c,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: key_25.c,v 1.53 2009-12-04 22:06:37 tbox Exp */
+/* Id: key_25.c,v 1.55 2011-03-05 23:52:31 tbox Exp */
/*
* Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
@@ -108,7 +108,7 @@ totext_key(ARGS_TOTEXT) {
if ((flags & 0xc000) == 0xc000)
return (ISC_R_SUCCESS);
- if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0 &&
+ if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 &&
algorithm == DNS_KEYALG_PRIVATEDNS) {
dns_name_t name;
dns_name_init(&name, NULL);
@@ -121,10 +121,13 @@ totext_key(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&sr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&sr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
- if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0)
+ if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
RETERR(str_totext(tctx->linebreak, target));
else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ", target));
@@ -132,7 +135,7 @@ totext_key(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(")", target));
- if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) {
+ if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
isc_region_t tmpr;
RETERR(str_totext(" ; key id = ", target));
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c b/external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c
index fd998a63ecb..4775f41770a 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c
@@ -1,7 +1,7 @@
-/* $NetBSD: keydata_65533.c,v 1.2 2011/02/16 03:47:08 christos Exp $ */
+/* $NetBSD: keydata_65533.c,v 1.3 2011/09/11 18:55:39 christos Exp $ */
/*
- * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: keydata_65533.c,v 1.3 2009-12-04 21:09:33 marka Exp */
+/* Id: keydata_65533.c,v 1.5 2011-03-05 23:52:31 tbox Exp */
#ifndef GENERIC_KEYDATA_65533_C
#define GENERIC_KEYDATA_65533_C 1
@@ -91,6 +91,8 @@ totext_keydata(ARGS_TOTEXT) {
unsigned int flags;
unsigned char algorithm;
unsigned long when;
+ char algbuf[DNS_NAME_FORMATSIZE];
+ const char *keyinfo;
REQUIRE(rdata->type == 65533);
REQUIRE(rdata->length != 0);
@@ -121,6 +123,13 @@ totext_keydata(ARGS_TOTEXT) {
sprintf(buf, "%u", flags);
RETERR(str_totext(buf, target));
RETERR(str_totext(" ", target));
+ if ((flags & DNS_KEYFLAG_KSK) != 0) {
+ if (flags & DNS_KEYFLAG_REVOKE)
+ keyinfo = "revoked KSK";
+ else
+ keyinfo = "KSK";
+ } else
+ keyinfo = "ZSK";
/* protocol */
sprintf(buf, "%u", sr.base[0]);
@@ -142,10 +151,13 @@ totext_keydata(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&sr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&sr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
- if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0)
+ if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
RETERR(str_totext(tctx->linebreak, target));
else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ", target));
@@ -153,10 +165,16 @@ totext_keydata(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(")", target));
- if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) {
+ if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
isc_region_t tmpr;
- RETERR(str_totext(" ; key id = ", target));
+ RETERR(str_totext(" ; ", target));
+ RETERR(str_totext(keyinfo, target));
+ dns_secalg_format((dns_secalg_t) algorithm, algbuf,
+ sizeof(algbuf));
+ RETERR(str_totext("; alg = ", target));
+ RETERR(str_totext(algbuf, target));
+ RETERR(str_totext("; key id = ", target));
dns_rdata_toregion(rdata, &tmpr);
/* Skip over refresh, addhd, and removehd */
isc_region_consume(&tmpr, 12);
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c b/external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c
index 1c8f6565605..14733cf65a8 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c
@@ -1,7 +1,7 @@
-/* $NetBSD: nsec3_50.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: nsec3_50.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2008, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: nsec3_50.c,v 1.7 2009-12-04 21:09:34 marka Exp */
+/* Id: nsec3_50.c,v 1.10 2011-03-07 13:42:11 marka Exp */
/*
* Copyright (C) 2004 Nominet, Ltd.
@@ -144,32 +144,32 @@ totext_nsec3(ARGS_TOTEXT) {
unsigned char flags;
char buf[sizeof("65535 ")];
isc_uint32_t iterations;
+ isc_boolean_t first;
REQUIRE(rdata->type == 50);
REQUIRE(rdata->length != 0);
- UNUSED(tctx);
-
dns_rdata_toregion(rdata, &sr);
+ /* Hash */
hash = uint8_fromregion(&sr);
isc_region_consume(&sr, 1);
-
- flags = uint8_fromregion(&sr);
- isc_region_consume(&sr, 1);
-
- iterations = uint16_fromregion(&sr);
- isc_region_consume(&sr, 2);
-
sprintf(buf, "%u ", hash);
RETERR(str_totext(buf, target));
+ /* Flags */
+ flags = uint8_fromregion(&sr);
+ isc_region_consume(&sr, 1);
sprintf(buf, "%u ", flags);
RETERR(str_totext(buf, target));
+ /* Iterations */
+ iterations = uint16_fromregion(&sr);
+ isc_region_consume(&sr, 2);
sprintf(buf, "%u ", iterations);
RETERR(str_totext(buf, target));
+ /* Salt */
j = uint8_fromregion(&sr);
isc_region_consume(&sr, 1);
INSIST(j <= sr.length);
@@ -179,10 +179,14 @@ totext_nsec3(ARGS_TOTEXT) {
sr.length = j;
RETERR(isc_hex_totext(&sr, 1, "", target));
sr.length = i - j;
- RETERR(str_totext(" ", target));
} else
- RETERR(str_totext("- ", target));
+ RETERR(str_totext("-", target));
+
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(" (", target));
+ RETERR(str_totext(tctx->linebreak, target));
+ /* Next hash */
j = uint8_fromregion(&sr);
isc_region_consume(&sr, 1);
INSIST(j <= sr.length);
@@ -192,7 +196,16 @@ totext_nsec3(ARGS_TOTEXT) {
RETERR(isc_base32hex_totext(&sr, 1, "", target));
sr.length = i - j;
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(tctx->linebreak, target));
+ else
+ RETERR(str_totext(" ", target));
+
+ /* Types covered */
+ first = ISC_TRUE;
for (i = 0; i < sr.length; i += len) {
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ first = ISC_TRUE;
INSIST(i + 2 <= sr.length);
window = sr.base[i];
len = sr.base[i + 1];
@@ -207,7 +220,9 @@ totext_nsec3(ARGS_TOTEXT) {
if ((sr.base[i + j] & (0x80 >> k)) == 0)
continue;
t = window * 256 + j * 8 + k;
- RETERR(str_totext(" ", target));
+ if (!first)
+ RETERR(str_totext(" ", target));
+ first = ISC_FALSE;
if (dns_rdatatype_isknown(t)) {
RETERR(dns_rdatatype_totext(t, target));
} else {
@@ -218,6 +233,10 @@ totext_nsec3(ARGS_TOTEXT) {
}
}
}
+
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(" )", target));
+
return (ISC_R_SUCCESS);
}
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.h b/external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.h
index f3efbe7c300..377de7d8bf3 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.h
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.h
@@ -1,7 +1,7 @@
-/* $NetBSD: nsec3_50.h,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: nsec3_50.h,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -20,7 +20,7 @@
#ifndef GENERIC_NSEC3_50_H
#define GENERIC_NSEC3_50_H 1
-/* Id: nsec3_50.h,v 1.4 2008-09-25 04:02:39 tbox Exp */
+/* Id: nsec3_50.h,v 1.6 2011-06-10 23:47:32 tbox Exp */
/*!
* \brief Per RFC 5155 */
@@ -48,7 +48,16 @@ typedef struct dns_rdata_nsec3 {
#define DNS_NSEC3FLAG_OPTOUT 0x01U
/*%
- * Non-standard, NSEC3PARAM only.
+ * The following flags are used in the private-type record (implemented in
+ * lib/dns/private.c) which is used to store NSEC3PARAM data during the
+ * time when it is not legal to have an actual NSEC3PARAM record in the
+ * zone. They are defined here because the private-type record uses the
+ * same flags field for the OPTOUT flag above and for the private flags
+ * below. XXX: This should be considered for refactoring.
+ */
+
+/*%
+ * Non-standard, private type only.
*
* Create a corresponding NSEC3 chain.
* Once the NSEC3 chain is complete this flag will be removed to signal
@@ -57,13 +66,14 @@ typedef struct dns_rdata_nsec3 {
* This flag is automatically set when a NSEC3PARAM record is added to
* the zone via UPDATE.
*
- * NSEC3PARAM records with this flag set are supposed to be ignored by
- * RFC 5155 compliant nameservers.
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
*/
#define DNS_NSEC3FLAG_CREATE 0x80U
/*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
*
* The corresponding NSEC3 set is to be removed once the NSEC chain
* has been generated.
@@ -71,24 +81,39 @@ typedef struct dns_rdata_nsec3 {
* This flag is automatically set when the last active NSEC3PARAM record
* is removed from the zone via UPDATE.
*
- * NSEC3PARAM records with this flag set are supposed to be ignored by
- * RFC 5155 compliant nameservers.
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
*/
#define DNS_NSEC3FLAG_REMOVE 0x40U
/*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
*
- * Used to identify NSEC3PARAM records added in this UPDATE request.
+ * When set with the CREATE flag, a corresponding NSEC3 chain will be
+ * created when the zone becomes capable of supporting one (i.e., when it
+ * has a DNSKEY RRset containing at least one NSEC3-capable algorithm).
+ * Without this flag, NSEC3 chain creation would be attempted immediately,
+ * fail, and the private type record would be removed. With it, the NSEC3
+ * parameters are stored until they can be used. When the zone has the
+ * necessary prerequisites for NSEC3, then the INITIAL flag can be cleared,
+ * and the record will be cleaned up normally.
+ *
+ * NSEC3PARAM records containing this flag should never be published, but
+ * if they are, they should be ignored by RFC 5155 compliant nameservers.
*/
-#define DNS_NSEC3FLAG_UPDATE 0x20U
+#define DNS_NSEC3FLAG_INITIAL 0x20U
/*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
*
* Prevent the creation of a NSEC chain before the last NSEC3 chain
* is removed. This will normally only be set when the zone is
* transitioning from secure with NSEC3 chains to insecure.
+ *
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
*/
#define DNS_NSEC3FLAG_NONSEC 0x10U
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c b/external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c
index e0ed103b93f..1ab5b4c5499 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c
@@ -1,7 +1,7 @@
-/* $NetBSD: opt_41.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: opt_41.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: opt_41.c,v 1.35 2009-12-04 22:06:37 tbox Exp */
+/* Id: opt_41.c,v 1.37 2011-03-05 23:52:31 tbox Exp */
/* Reviewed: Thu Mar 16 14:06:44 PST 2000 by gson */
@@ -78,8 +78,12 @@ totext_opt(ARGS_TOTEXT) {
RETERR(str_totext(tctx->linebreak, target));
or = r;
or.length = length;
- RETERR(isc_base64_totext(&or, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&or, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&or, tctx->width - 2,
+ tctx->linebreak,
+ target));
isc_region_consume(&r, length);
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c b/external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c
index da8294260b6..8102391701d 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rrsig_46.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: rrsig_46.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
* Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rrsig_46.c,v 1.14 2011-01-13 04:59:26 tbox Exp */
+/* Id: rrsig_46.c,v 1.15 2011-03-05 19:39:07 each Exp */
/* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
@@ -183,7 +183,10 @@ totext_rrsig(ARGS_TOTEXT) {
isc_region_consume(&sr, 4);
sprintf(buf, "%lu", ttl);
RETERR(str_totext(buf, target));
- RETERR(str_totext(" ", target));
+
+ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+ RETERR(str_totext(" (", target));
+ RETERR(str_totext(tctx->linebreak, target));
/*
* Sig exp.
@@ -191,10 +194,7 @@ totext_rrsig(ARGS_TOTEXT) {
exp = uint32_fromregion(&sr);
isc_region_consume(&sr, 4);
RETERR(dns_time32_totext(exp, target));
-
- if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
- RETERR(str_totext(" (", target));
- RETERR(str_totext(tctx->linebreak, target));
+ RETERR(str_totext(" ", target));
/*
* Time signed.
@@ -225,8 +225,11 @@ totext_rrsig(ARGS_TOTEXT) {
* Sig.
*/
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&sr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&sr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c b/external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c
index c6e438e557e..e32a1a4435a 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c
@@ -1,7 +1,7 @@
-/* $NetBSD: sig_24.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: sig_24.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sig_24.c,v 1.68 2009-12-04 22:06:37 tbox Exp */
+/* Id: sig_24.c,v 1.70 2011-03-05 23:52:31 tbox Exp */
/* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
@@ -229,8 +229,11 @@ totext_sig(ARGS_TOTEXT) {
* Sig.
*/
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&sr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&sr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c b/external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c
index 0be3e41cbf3..3faa4e89bb3 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c
@@ -1,7 +1,7 @@
-/* $NetBSD: soa_6.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: soa_6.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2004, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: soa_6.c,v 1.64 2009-12-04 21:09:34 marka Exp */
+/* Id: soa_6.c,v 1.66 2011-03-05 23:52:31 tbox Exp */
/* Reviewed: Thu Mar 16 15:18:32 PST 2000 by explorer */
@@ -104,7 +104,7 @@ totext_soa(ARGS_TOTEXT) {
multiline = ISC_TF((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0);
if (multiline)
- comment = ISC_TF((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0);
+ comment = ISC_TF((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0);
else
comment = ISC_FALSE;
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c b/external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c
index da0ea659593..587f57c0e00 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c
@@ -1,7 +1,7 @@
-/* $NetBSD: sshfp_44.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: sshfp_44.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2004, 2006, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sshfp_44.c,v 1.9 2009-12-04 22:06:37 tbox Exp */
+/* Id: sshfp_44.c,v 1.11 2011-03-05 23:52:31 tbox Exp */
/* RFC 4255 */
@@ -98,7 +98,11 @@ totext_sshfp(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_hex_totext(&sr, 0, "", target));
+ else
+ RETERR(isc_hex_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
return (ISC_R_SUCCESS);
diff --git a/external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c b/external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c
index 1444e60b610..fb0755d6f40 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c
@@ -1,7 +1,7 @@
-/* $NetBSD: tkey_249.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: tkey_249.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2004, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: tkey_249.c,v 1.59 2009-12-04 22:06:37 tbox Exp */
+/* Id: tkey_249.c,v 1.61 2011-03-05 23:52:31 tbox Exp */
/*
* Reviewed: Thu Mar 16 17:35:30 PST 2000 by halley.
@@ -203,8 +203,11 @@ totext_tkey(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&dr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&dr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&dr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" ) ", target));
else
@@ -229,8 +232,11 @@ totext_tkey(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" (", target));
RETERR(str_totext(tctx->linebreak, target));
- RETERR(isc_base64_totext(&dr, tctx->width - 2,
- tctx->linebreak, target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&dr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&dr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext(" )", target));
}
diff --git a/external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c b/external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c
index 5638f924e70..17011f4ddab 100644
--- a/external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c
+++ b/external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dhcid_49.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
+/* $NetBSD: dhcid_49.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2006, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dhcid_49.c,v 1.7 2009-12-04 22:06:37 tbox Exp */
+/* Id: dhcid_49.c,v 1.9 2011-03-05 23:52:31 tbox Exp */
/* RFC 4701 */
@@ -54,8 +54,11 @@ totext_in_dhcid(ARGS_TOTEXT) {
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext("( " /*)*/, target));
- RETERR(isc_base64_totext(&sr, tctx->width - 2, tctx->linebreak,
- target));
+ if (tctx->width == 0) /* No splitting */
+ RETERR(isc_base64_totext(&sr, 60, "", target));
+ else
+ RETERR(isc_base64_totext(&sr, tctx->width - 2,
+ tctx->linebreak, target));
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
RETERR(str_totext(/* ( */ " )", target));
if (rdata->length > 2) {
diff --git a/external/bsd/bind/dist/lib/dns/rdata/in_1/naptr_35.c b/external/bsd/bind/dist/lib/dns/rdata/in_1/naptr_35.c
deleted file mode 100644
index 353f0f4b648..00000000000
--- a/external/bsd/bind/dist/lib/dns/rdata/in_1/naptr_35.c
+++ /dev/null
@@ -1,712 +0,0 @@
-/* $NetBSD: naptr_35.c,v 1.2 2011/02/16 03:47:09 christos Exp $ */
-
-/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
- * Copyright (C) 1999-2001, 2003 Internet Software Consortium.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* Id: naptr_35.c,v 1.56 2009-12-04 21:09:34 marka Exp */
-
-/* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
-
-/* RFC2915 */
-
-#ifndef RDATA_IN_1_NAPTR_35_C
-#define RDATA_IN_1_NAPTR_35_C
-
-#define RRTYPE_NAPTR_ATTRIBUTES (0)
-#ifdef HAVE_REGEX_H
-#include <regex.h>
-#endif
-
-/*
- * Check the wire format of the Regexp field.
- * Don't allow embeded NUL's.
- */
-static inline isc_result_t
-txt_valid_regex(const unsigned char *txt) {
-#ifdef HAVE_REGEX_H
- regex_t preg;
- unsigned int regflags = REG_EXTENDED;
- unsigned int nsub = 0;
- char regex[256];
- char *cp;
-#endif
- isc_boolean_t flags = ISC_FALSE;
- isc_boolean_t replace = ISC_FALSE;
- unsigned char c;
- unsigned char delim;
- unsigned int len;
-
- len = *txt++;
- if (len == 0U)
- return (ISC_R_SUCCESS);
-
- delim = *txt++;
- len--;
-
- /*
- * Digits, backslash and flags can't be delimiters.
- */
- switch (delim) {
- case '0': case '1': case '2': case '3': case '4':
- case '5': case '6': case '7': case '8': case '9':
- case '\\': case 'i': case 0:
- return (DNS_R_SYNTAX);
- }
-
-#ifdef HAVE_REGEX_H
- memset(&preg, 0, sizeof(preg));
- cp = regex;
-#endif
-
- while (len-- > 0) {
- c = *txt++;
- if (c == 0)
- return (DNS_R_SYNTAX);
- if (c == delim && !replace) {
- replace = ISC_TRUE;
- continue;
- } else if (c == delim && !flags) {
- flags = ISC_TRUE;
- continue;
- } else if (c == delim)
- return (DNS_R_SYNTAX);
- /*
- * Flags are not escaped.
- */
- if (flags) {
- switch (c) {
- case 'i':
-#ifdef HAVE_REGEX_H
- regflags |= REG_ICASE;
-#endif
- continue;
- default:
- return (DNS_R_SYNTAX);
- }
- }
-#ifdef HAVE_REGEX_H
- if (!replace)
- *cp++ = c;
-#endif
- if (c == '\\') {
- if (len == 0)
- return (DNS_R_SYNTAX);
- c = *txt++;
- if (c == 0)
- return (DNS_R_SYNTAX);
- len--;
- if (replace)
- switch (c) {
- case '0': return (DNS_R_SYNTAX);
-#ifdef HAVE_REGEX_H
- case '1': if (nsub < 1) nsub = 1; break;
- case '2': if (nsub < 2) nsub = 2; break;
- case '3': if (nsub < 3) nsub = 3; break;
- case '4': if (nsub < 4) nsub = 4; break;
- case '5': if (nsub < 5) nsub = 5; break;
- case '6': if (nsub < 6) nsub = 6; break;
- case '7': if (nsub < 7) nsub = 7; break;
- case '8': if (nsub < 8) nsub = 8; break;
- case '9': if (nsub < 9) nsub = 9; break;
-#endif
- }
-#ifdef HAVE_REGEX_H
- if (!replace)
- *cp++ = c;
-#endif
- }
- }
- if (!flags)
- return (DNS_R_SYNTAX);
-#ifdef HAVE_REGEX_H
- *cp = '\0';
- if (regcomp(&preg, regex, regflags))
- return (DNS_R_SYNTAX);
- /*
- * Check that substitutions in the replacement string are consistant
- * with the regular expression.
- */
- if (preg.re_nsub < nsub) {
- regfree(&preg);
- return (DNS_R_SYNTAX);
- }
- regfree(&preg);
-#endif
- return (ISC_R_SUCCESS);
-}
-
-static inline isc_result_t
-fromtext_in_naptr(ARGS_FROMTEXT) {
- isc_token_t token;
- dns_name_t name;
- isc_buffer_t buffer;
- unsigned char *regex;
-
- REQUIRE(type == 35);
- REQUIRE(rdclass == 1);
-
- UNUSED(type);
- UNUSED(rdclass);
- UNUSED(callbacks);
-
- /*
- * Order.
- */
- RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
- ISC_FALSE));
- if (token.value.as_ulong > 0xffffU)
- RETTOK(ISC_R_RANGE);
- RETERR(uint16_tobuffer(token.value.as_ulong, target));
-
- /*
- * Preference.
- */
- RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
- ISC_FALSE));
- if (token.value.as_ulong > 0xffffU)
- RETTOK(ISC_R_RANGE);
- RETERR(uint16_tobuffer(token.value.as_ulong, target));
-
- /*
- * Flags.
- */
- RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_qstring,
- ISC_FALSE));
- RETTOK(txt_fromtext(&token.value.as_textregion, target));
-
- /*
- * Service.
- */
- RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_qstring,
- ISC_FALSE));
- RETTOK(txt_fromtext(&token.value.as_textregion, target));
-
- /*
- * Regexp.
- */
- regex = isc_buffer_used(target);
- RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_qstring,
- ISC_FALSE));
- RETTOK(txt_fromtext(&token.value.as_textregion, target));
- RETTOK(txt_valid_regex(regex));
-
- /*
- * Replacement.
- */
- RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
- ISC_FALSE));
- dns_name_init(&name, NULL);
- buffer_fromregion(&buffer, &token.value.as_region);
- origin = (origin != NULL) ? origin : dns_rootname;
- RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
- return (ISC_R_SUCCESS);
-}
-
-static inline isc_result_t
-totext_in_naptr(ARGS_TOTEXT) {
- isc_region_t region;
- dns_name_t name;
- dns_name_t prefix;
- isc_boolean_t sub;
- char buf[sizeof("64000")];
- unsigned short num;
-
- REQUIRE(rdata->type == 35);
- REQUIRE(rdata->rdclass == 1);
- REQUIRE(rdata->length != 0);
-
- dns_name_init(&name, NULL);
- dns_name_init(&prefix, NULL);
-
- dns_rdata_toregion(rdata, &region);
-
- /*
- * Order.
- */
- num = uint16_fromregion(&region);
- isc_region_consume(&region, 2);
- sprintf(buf, "%u", num);
- RETERR(str_totext(buf, target));
- RETERR(str_totext(" ", target));
-
- /*
- * Preference.
- */
- num = uint16_fromregion(&region);
- isc_region_consume(&region, 2);
- sprintf(buf, "%u", num);
- RETERR(str_totext(buf, target));
- RETERR(str_totext(" ", target));
-
- /*
- * Flags.
- */
- RETERR(txt_totext(&region, target));
- RETERR(str_totext(" ", target));
-
- /*
- * Service.
- */
- RETERR(txt_totext(&region, target));
- RETERR(str_totext(" ", target));
-
- /*
- * Regexp.
- */
- RETERR(txt_totext(&region, target));
- RETERR(str_totext(" ", target));
-
- /*
- * Replacement.
- */
- dns_name_fromregion(&name, &region);
- sub = name_prefix(&name, tctx->origin, &prefix);
- return (dns_name_totext(&prefix, sub, target));
-}
-
-static inline isc_result_t
-fromwire_in_naptr(ARGS_FROMWIRE) {
- dns_name_t name;
- isc_region_t sr;
- unsigned char *regex;
-
- REQUIRE(type == 35);
- REQUIRE(rdclass == 1);
-
- UNUSED(type);
- UNUSED(rdclass);
-
- dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
-
- dns_name_init(&name, NULL);
-
- /*
- * Order, preference.
- */
- isc_buffer_activeregion(source, &sr);
- if (sr.length < 4)
- return (ISC_R_UNEXPECTEDEND);
- RETERR(mem_tobuffer(target, sr.base, 4));
- isc_buffer_forward(source, 4);
-
- /*
- * Flags.
- */
- RETERR(txt_fromwire(source, target));
-
- /*
- * Service.
- */
- RETERR(txt_fromwire(source, target));
-
- /*
- * Regexp.
- */
- regex = isc_buffer_used(target);
- RETERR(txt_fromwire(source, target));
- RETERR(txt_valid_regex(regex));
-
- /*
- * Replacement.
- */
- return (dns_name_fromwire(&name, source, dctx, options, target));
-}
-
-static inline isc_result_t
-towire_in_naptr(ARGS_TOWIRE) {
- dns_name_t name;
- dns_offsets_t offsets;
- isc_region_t sr;
-
- REQUIRE(rdata->type == 35);
- REQUIRE(rdata->rdclass == 1);
- REQUIRE(rdata->length != 0);
-
- dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
- /*
- * Order, preference.
- */
- dns_rdata_toregion(rdata, &sr);
- RETERR(mem_tobuffer(target, sr.base, 4));
- isc_region_consume(&sr, 4);
-
- /*
- * Flags.
- */
- RETERR(mem_tobuffer(target, sr.base, sr.base[0] + 1));
- isc_region_consume(&sr, sr.base[0] + 1);
-
- /*
- * Service.
- */
- RETERR(mem_tobuffer(target, sr.base, sr.base[0] + 1));
- isc_region_consume(&sr, sr.base[0] + 1);
-
- /*
- * Regexp.
- */
- RETERR(mem_tobuffer(target, sr.base, sr.base[0] + 1));
- isc_region_consume(&sr, sr.base[0] + 1);
-
- /*
- * Replacement.
- */
- dns_name_init(&name, offsets);
- dns_name_fromregion(&name, &sr);
- return (dns_name_towire(&name, cctx, target));
-}
-
-static inline int
-compare_in_naptr(ARGS_COMPARE) {
- dns_name_t name1;
- dns_name_t name2;
- isc_region_t region1;
- isc_region_t region2;
- int order, len;
-
- REQUIRE(rdata1->type == rdata2->type);
- REQUIRE(rdata1->rdclass == rdata2->rdclass);
- REQUIRE(rdata1->type == 35);
- REQUIRE(rdata1->rdclass == 1);
- REQUIRE(rdata1->length != 0);
- REQUIRE(rdata2->length != 0);
-
- dns_rdata_toregion(rdata1, &region1);
- dns_rdata_toregion(rdata2, &region2);
-
- /*
- * Order, preference.
- */
- order = memcmp(region1.base, region2.base, 4);
- if (order != 0)
- return (order < 0 ? -1 : 1);
- isc_region_consume(&region1, 4);
- isc_region_consume(&region2, 4);
-
- /*
- * Flags.
- */
- len = ISC_MIN(region1.base[0], region2.base[0]);
- order = memcmp(region1.base, region2.base, len + 1);
- if (order != 0)
- return (order < 0 ? -1 : 1);
- isc_region_consume(&region1, region1.base[0] + 1);
- isc_region_consume(&region2, region2.base[0] + 1);
-
- /*
- * Service.
- */
- len = ISC_MIN(region1.base[0], region2.base[0]);
- order = memcmp(region1.base, region2.base, len + 1);
- if (order != 0)
- return (order < 0 ? -1 : 1);
- isc_region_consume(&region1, region1.base[0] + 1);
- isc_region_consume(&region2, region2.base[0] + 1);
-
- /*
- * Regexp.
- */
- len = ISC_MIN(region1.base[0], region2.base[0]);
- order = memcmp(region1.base, region2.base, len + 1);
- if (order != 0)
- return (order < 0 ? -1 : 1);
- isc_region_consume(&region1, region1.base[0] + 1);
- isc_region_consume(&region2, region2.base[0] + 1);
-
- /*
- * Replacement.
- */
- dns_name_init(&name1, NULL);
- dns_name_init(&name2, NULL);
-
- dns_name_fromregion(&name1, &region1);
- dns_name_fromregion(&name2, &region2);
-
- return (dns_name_rdatacompare(&name1, &name2));
-}
-
-static inline isc_result_t
-fromstruct_in_naptr(ARGS_FROMSTRUCT) {
- dns_rdata_in_naptr_t *naptr = source;
- isc_region_t region;
-
- REQUIRE(type == 35);
- REQUIRE(rdclass == 1);
- REQUIRE(source != NULL);
- REQUIRE(naptr->common.rdtype == type);
- REQUIRE(naptr->common.rdclass == rdclass);
- REQUIRE(naptr->flags != NULL || naptr->flags_len == 0);
- REQUIRE(naptr->service != NULL || naptr->service_len == 0);
- REQUIRE(naptr->regexp != NULL || naptr->regexp_len == 0);
-
- UNUSED(type);
- UNUSED(rdclass);
-
- RETERR(uint16_tobuffer(naptr->order, target));
- RETERR(uint16_tobuffer(naptr->preference, target));
- RETERR(uint8_tobuffer(naptr->flags_len, target));
- RETERR(mem_tobuffer(target, naptr->flags, naptr->flags_len));
- RETERR(uint8_tobuffer(naptr->service_len, target));
- RETERR(mem_tobuffer(target, naptr->service, naptr->service_len));
- RETERR(uint8_tobuffer(naptr->regexp_len, target));
- RETERR(mem_tobuffer(target, naptr->regexp, naptr->regexp_len));
- dns_name_toregion(&naptr->replacement, &region);
- return (isc_buffer_copyregion(target, &region));
-}
-
-static inline isc_result_t
-tostruct_in_naptr(ARGS_TOSTRUCT) {
- dns_rdata_in_naptr_t *naptr = target;
- isc_region_t r;
- isc_result_t result;
- dns_name_t name;
-
- REQUIRE(rdata->type == 35);
- REQUIRE(rdata->rdclass == 1);
- REQUIRE(target != NULL);
- REQUIRE(rdata->length != 0);
-
- naptr->common.rdclass = rdata->rdclass;
- naptr->common.rdtype = rdata->type;
- ISC_LINK_INIT(&naptr->common, link);
-
- naptr->flags = NULL;
- naptr->service = NULL;
- naptr->regexp = NULL;
-
- dns_rdata_toregion(rdata, &r);
-
- naptr->order = uint16_fromregion(&r);
- isc_region_consume(&r, 2);
-
- naptr->preference = uint16_fromregion(&r);
- isc_region_consume(&r, 2);
-
- naptr->flags_len = uint8_fromregion(&r);
- isc_region_consume(&r, 1);
- INSIST(naptr->flags_len <= r.length);
- naptr->flags = mem_maybedup(mctx, r.base, naptr->flags_len);
- if (naptr->flags == NULL)
- goto cleanup;
- isc_region_consume(&r, naptr->flags_len);
-
- naptr->service_len = uint8_fromregion(&r);
- isc_region_consume(&r, 1);
- INSIST(naptr->service_len <= r.length);
- naptr->service = mem_maybedup(mctx, r.base, naptr->service_len);
- if (naptr->service == NULL)
- goto cleanup;
- isc_region_consume(&r, naptr->service_len);
-
- naptr->regexp_len = uint8_fromregion(&r);
- isc_region_consume(&r, 1);
- INSIST(naptr->regexp_len <= r.length);
- naptr->regexp = mem_maybedup(mctx, r.base, naptr->regexp_len);
- if (naptr->regexp == NULL)
- goto cleanup;
- isc_region_consume(&r, naptr->regexp_len);
-
- dns_name_init(&name, NULL);
- dns_name_fromregion(&name, &r);
- dns_name_init(&naptr->replacement, NULL);
- result = name_duporclone(&name, mctx, &naptr->replacement);
- if (result != ISC_R_SUCCESS)
- goto cleanup;
- naptr->mctx = mctx;
- return (ISC_R_SUCCESS);
-
- cleanup:
- if (mctx != NULL && naptr->flags != NULL)
- isc_mem_free(mctx, naptr->flags);
- if (mctx != NULL && naptr->service != NULL)
- isc_mem_free(mctx, naptr->service);
- if (mctx != NULL && naptr->regexp != NULL)
- isc_mem_free(mctx, naptr->regexp);
- return (ISC_R_NOMEMORY);
-}
-
-static inline void
-freestruct_in_naptr(ARGS_FREESTRUCT) {
- dns_rdata_in_naptr_t *naptr = source;
-
- REQUIRE(source != NULL);
- REQUIRE(naptr->common.rdclass == 1);
- REQUIRE(naptr->common.rdtype == 35);
-
- if (naptr->mctx == NULL)
- return;
-
- if (naptr->flags != NULL)
- isc_mem_free(naptr->mctx, naptr->flags);
- if (naptr->service != NULL)
- isc_mem_free(naptr->mctx, naptr->service);
- if (naptr->regexp != NULL)
- isc_mem_free(naptr->mctx, naptr->regexp);
- dns_name_free(&naptr->replacement, naptr->mctx);
- naptr->mctx = NULL;
-}
-
-static inline isc_result_t
-additionaldata_in_naptr(ARGS_ADDLDATA) {
- dns_name_t name;
- dns_offsets_t offsets;
- isc_region_t sr;
- dns_rdatatype_t atype;
- unsigned int i, flagslen;
- char *cp;
-
- REQUIRE(rdata->type == 35);
- REQUIRE(rdata->rdclass == 1);
-
- /*
- * Order, preference.
- */
- dns_rdata_toregion(rdata, &sr);
- isc_region_consume(&sr, 4);
-
- /*
- * Flags.
- */
- atype = 0;
- flagslen = sr.base[0];
- cp = (char *)&sr.base[1];
- for (i = 0; i < flagslen; i++, cp++) {
- if (*cp == 'S' || *cp == 's') {
- atype = dns_rdatatype_srv;
- break;
- }
- if (*cp == 'A' || *cp == 'a') {
- atype = dns_rdatatype_a;
- break;
- }
- }
- isc_region_consume(&sr, flagslen + 1);
-
- /*
- * Service.
- */
- isc_region_consume(&sr, sr.base[0] + 1);
-
- /*
- * Regexp.
- */
- isc_region_consume(&sr, sr.base[0] + 1);
-
- /*
- * Replacement.
- */
- dns_name_init(&name, offsets);
- dns_name_fromregion(&name, &sr);
-
- if (atype != 0)
- return ((add)(arg, &name, atype));
-
- return (ISC_R_SUCCESS);
-}
-
-static inline isc_result_t
-digest_in_naptr(ARGS_DIGEST) {
- isc_region_t r1, r2;
- unsigned int length, n;
- isc_result_t result;
- dns_name_t name;
-
- REQUIRE(rdata->type == 35);
- REQUIRE(rdata->rdclass == 1);
-
- dns_rdata_toregion(rdata, &r1);
- r2 = r1;
- length = 0;
-
- /*
- * Order, preference.
- */
- length += 4;
- isc_region_consume(&r2, 4);
-
- /*
- * Flags.
- */
- n = r2.base[0] + 1;
- length += n;
- isc_region_consume(&r2, n);
-
- /*
- * Service.
- */
- n = r2.base[0] + 1;
- length += n;
- isc_region_consume(&r2, n);
-
- /*
- * Regexp.
- */
- n = r2.base[0] + 1;
- length += n;
- isc_region_consume(&r2, n);
-
- /*
- * Digest the RR up to the replacement name.
- */
- r1.length = length;
- result = (digest)(arg, &r1);
- if (result != ISC_R_SUCCESS)
- return (result);
-
- /*
- * Replacement.
- */
-
- dns_name_init(&name, NULL);
- dns_name_fromregion(&name, &r2);
-
- return (dns_name_digest(&name, digest, arg));
-}
-
-static inline isc_boolean_t
-checkowner_in_naptr(ARGS_CHECKOWNER) {
-
- REQUIRE(type == 35);
- REQUIRE(rdclass == 1);
-
- UNUSED(name);
- UNUSED(type);
- UNUSED(rdclass);
- UNUSED(wildcard);
-
- return (ISC_TRUE);
-}
-
-static inline isc_boolean_t
-checknames_in_naptr(ARGS_CHECKNAMES) {
-
- REQUIRE(rdata->type == 35);
- REQUIRE(rdata->rdclass == 1);
-
- UNUSED(rdata);
- UNUSED(owner);
- UNUSED(bad);
-
- return (ISC_TRUE);
-}
-
-static inline int
-casecompare_in_naptr(ARGS_COMPARE) {
- return (compare_in_naptr(rdata1, rdata2));
-}
-
-#endif /* RDATA_IN_1_NAPTR_35_C */
diff --git a/external/bsd/bind/dist/lib/dns/rdata/in_1/naptr_35.h b/external/bsd/bind/dist/lib/dns/rdata/in_1/naptr_35.h
deleted file mode 100644
index 55986a7c683..00000000000
--- a/external/bsd/bind/dist/lib/dns/rdata/in_1/naptr_35.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* $NetBSD: naptr_35.h,v 1.2 2011/02/16 03:47:09 christos Exp $ */
-
-/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
- * Copyright (C) 1999-2001 Internet Software Consortium.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef IN_1_NAPTR_35_H
-#define IN_1_NAPTR_35_H 1
-
-/* Id: naptr_35.h,v 1.23 2007-06-19 23:47:17 tbox Exp */
-
-/*!
- * \brief Per RFC2915 */
-
-typedef struct dns_rdata_in_naptr {
- dns_rdatacommon_t common;
- isc_mem_t *mctx;
- isc_uint16_t order;
- isc_uint16_t preference;
- char *flags;
- isc_uint8_t flags_len;
- char *service;
- isc_uint8_t service_len;
- char *regexp;
- isc_uint8_t regexp_len;
- dns_name_t replacement;
-} dns_rdata_in_naptr_t;
-
-#endif /* IN_1_NAPTR_35_H */
diff --git a/external/bsd/bind/dist/lib/dns/rdatalist.c b/external/bsd/bind/dist/lib/dns/rdatalist.c
index 09ce918350b..0f587ef04d4 100644
--- a/external/bsd/bind/dist/lib/dns/rdatalist.c
+++ b/external/bsd/bind/dist/lib/dns/rdatalist.c
@@ -1,7 +1,7 @@
-/* $NetBSD: rdatalist.c,v 1.2 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: rdatalist.c,v 1.3 2011/09/11 18:55:36 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2008, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rdatalist.c,v 1.40 2010-11-16 05:38:31 marka Exp */
+/* Id: rdatalist.c,v 1.42 2011-02-21 23:47:45 tbox Exp */
/*! \file */
@@ -56,6 +56,8 @@ static dns_rdatasetmethods_t methods = {
void
dns_rdatalist_init(dns_rdatalist_t *rdatalist) {
+ REQUIRE(rdatalist != NULL);
+
/*
* Initialize rdatalist.
*/
@@ -127,6 +129,8 @@ isc_result_t
isc__rdatalist_next(dns_rdataset_t *rdataset) {
dns_rdata_t *rdata;
+ REQUIRE(rdataset != NULL);
+
rdata = rdataset->private2;
if (rdata == NULL)
return (ISC_R_NOMORE);
@@ -143,6 +147,8 @@ void
isc__rdatalist_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
dns_rdata_t *list_rdata;
+ REQUIRE(rdataset != NULL);
+
list_rdata = rdataset->private2;
INSIST(list_rdata != NULL);
@@ -151,6 +157,10 @@ isc__rdatalist_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
void
isc__rdatalist_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
+
+ REQUIRE(source != NULL);
+ REQUIRE(target != NULL);
+
*target = *source;
/*
@@ -165,6 +175,8 @@ isc__rdatalist_count(dns_rdataset_t *rdataset) {
dns_rdata_t *rdata;
unsigned int count;
+ REQUIRE(rdataset != NULL);
+
rdatalist = rdataset->private1;
count = 0;
@@ -183,6 +195,8 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
dns_rdataset_t *rdset;
dns_ttl_t ttl;
+ REQUIRE(rdataset != NULL);
+
for (rdset = ISC_LIST_HEAD(name->list);
rdset != NULL;
rdset = ISC_LIST_NEXT(rdset, link))
@@ -230,7 +244,9 @@ isc__rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
dns_rdataset_t *tnegsig = NULL;
dns_name_t *noqname = rdataset->private6;
+ REQUIRE(rdataset != NULL);
REQUIRE((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0);
+
(void)dns_name_dynamic(noqname); /* Sanity Check. */
for (rdataset = ISC_LIST_HEAD(noqname->list);
@@ -270,6 +286,8 @@ isc__rdatalist_addclosest(dns_rdataset_t *rdataset, dns_name_t *name) {
dns_rdataset_t *rdset;
dns_ttl_t ttl;
+ REQUIRE(rdataset != NULL);
+
for (rdset = ISC_LIST_HEAD(name->list);
rdset != NULL;
rdset = ISC_LIST_NEXT(rdset, link))
@@ -317,7 +335,9 @@ isc__rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
dns_rdataset_t *tnegsig = NULL;
dns_name_t *closest = rdataset->private7;
+ REQUIRE(rdataset != NULL);
REQUIRE((rdataset->attributes & DNS_RDATASETATTR_CLOSEST) != 0);
+
(void)dns_name_dynamic(closest); /* Sanity Check. */
for (rdataset = ISC_LIST_HEAD(closest->list);
diff --git a/external/bsd/bind/dist/lib/dns/rdataset.c b/external/bsd/bind/dist/lib/dns/rdataset.c
index 13ed311e1ef..4725e888715 100644
--- a/external/bsd/bind/dist/lib/dns/rdataset.c
+++ b/external/bsd/bind/dist/lib/dns/rdataset.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rdataset.c,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: rdataset.c,v 1.4 2011/09/11 18:55:36 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rdataset.c,v 1.86.220.3 2011-06-21 20:15:53 each Exp */
+/* Id: rdataset.c,v 1.90 2011-06-08 22:13:50 each Exp */
/*! \file */
@@ -321,7 +321,7 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
dns_rdata_t rdata = DNS_RDATA_INIT;
isc_region_t r;
isc_result_t result;
- unsigned int i, count, added, choice;
+ unsigned int i, count = 0, added, choice;
isc_buffer_t savedbuffer, rdlen, rrbuffer;
unsigned int headlen;
isc_boolean_t question = ISC_FALSE;
@@ -341,7 +341,6 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
REQUIRE((order == NULL) == (order_arg == NULL));
REQUIRE(cctx != NULL && cctx->mctx != NULL);
- count = 0;
if ((rdataset->attributes & DNS_RDATASETATTR_QUESTION) != 0) {
question = ISC_TRUE;
count = 1;
diff --git a/external/bsd/bind/dist/lib/dns/rdataslab.c b/external/bsd/bind/dist/lib/dns/rdataslab.c
index 5c022c67557..850f18ca0a5 100644
--- a/external/bsd/bind/dist/lib/dns/rdataslab.c
+++ b/external/bsd/bind/dist/lib/dns/rdataslab.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rdataslab.c,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: rdataslab.c,v 1.4 2011/09/11 18:55:36 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rdataslab.c,v 1.52.148.1.2.1 2011-06-02 23:47:35 tbox Exp */
+/* Id: rdataslab.c,v 1.54 2011-02-03 12:18:11 tbox Exp */
/*! \file */
diff --git a/external/bsd/bind/dist/lib/dns/request.c b/external/bsd/bind/dist/lib/dns/request.c
index 57ede7ba124..3aa1149d0ca 100644
--- a/external/bsd/bind/dist/lib/dns/request.c
+++ b/external/bsd/bind/dist/lib/dns/request.c
@@ -1,7 +1,7 @@
-/* $NetBSD: request.c,v 1.3 2011/02/16 03:47:04 christos Exp $ */
+/* $NetBSD: request.c,v 1.4 2011/09/11 18:55:36 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: request.c,v 1.87 2010-03-04 23:50:34 tbox Exp */
+/* Id: request.c,v 1.89 2011-03-12 04:59:48 tbox Exp */
/*! \file */
@@ -430,12 +430,10 @@ req_send(dns_request_t *request, isc_task_t *task, isc_sockaddr_t *address) {
isc_region_t r;
isc_socket_t *socket;
isc_result_t result;
- unsigned int dispattr;
req_log(ISC_LOG_DEBUG(3), "req_send: request %p", request);
REQUIRE(VALID_REQUEST(request));
- dispattr = dns_dispatch_getattributes(request->dispatch);
socket = req_getsocket(request);
isc_buffer_usedregion(request->query, &r);
/*
diff --git a/external/bsd/bind/dist/lib/dns/resolver.c b/external/bsd/bind/dist/lib/dns/resolver.c
index 6d5f3d8dc41..21c0c67d102 100644
--- a/external/bsd/bind/dist/lib/dns/resolver.c
+++ b/external/bsd/bind/dist/lib/dns/resolver.c
@@ -1,4 +1,4 @@
-/* $NetBSD: resolver.c,v 1.10 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: resolver.c,v 1.11 2011/09/11 18:55:36 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: resolver.c,v 1.428.6.5.2.1 2011-06-21 20:15:53 each Exp */
+/* Id: resolver.c,v 1.434 2011-06-08 22:13:50 each Exp */
/*! \file */
@@ -108,7 +108,7 @@
#endif
#ifndef DEFAULT_QUERY_TIMEOUT
-#define DEFAULT_QUERY_TIMEOUT 30 /* The default time in seconds for the whole query to live. */
+#define DEFAULT_QUERY_TIMEOUT 10 /* The default time in seconds for the whole query to live. */
#endif
#ifndef MAXIMUM_QUERY_TIMEOUT
@@ -2549,7 +2549,7 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) {
isc_result_t result;
dns_resolver_t *res;
isc_stdtime_t now;
- unsigned int stdoptions;
+ unsigned int stdoptions = 0;
isc_sockaddr_t *sa;
dns_adbaddrinfo_t *ai;
isc_boolean_t all_bad;
@@ -2568,7 +2568,6 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) {
}
res = fctx->res;
- stdoptions = 0; /* Keep compiler happy. */
/*
* Forwarders.
@@ -4251,6 +4250,8 @@ validated(isc_task_t *task, isc_event_t *event) {
sigrdataset, 0,
NULL);
dns_db_detachnode(fctx->cache, &nsnode);
+ if (result != ISC_R_SUCCESS)
+ continue;
}
result = dns_message_nextname(fctx->rmessage,
DNS_SECTION_AUTHORITY);
@@ -4313,6 +4314,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
res = fctx->res;
need_validation = ISC_FALSE;
+ POST(need_validation);
secure_domain = ISC_FALSE;
have_answer = ISC_FALSE;
eresult = ISC_R_SUCCESS;
@@ -4780,6 +4782,7 @@ ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
res = fctx->res;
need_validation = ISC_FALSE;
+ POST(need_validation);
secure_domain = ISC_FALSE;
eresult = ISC_R_SUCCESS;
name = &fctx->name;
@@ -5688,6 +5691,7 @@ answer_response(fetchctx_t *fctx) {
chaining = ISC_FALSE;
have_answer = ISC_FALSE;
want_chaining = ISC_FALSE;
+ POST(want_chaining);
if ((message->flags & DNS_MESSAGEFLAG_AA) != 0)
aa = ISC_TRUE;
else
@@ -5911,6 +5915,7 @@ answer_response(fetchctx_t *fctx) {
}
found = ISC_TRUE;
want_chaining = ISC_TRUE;
+ POST(want_chaining);
aflag = DNS_RDATASETATTR_ANSWER;
result = dname_target(fctx, rdataset,
qname, name,
@@ -5922,6 +5927,7 @@ answer_response(fetchctx_t *fctx) {
* try to continue.
*/
want_chaining = ISC_FALSE;
+ POST(want_chaining);
} else if (result != ISC_R_SUCCESS)
return (result);
else
@@ -6786,6 +6792,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
unsigned int version;
resend = ISC_TRUE;
+ INSIST(opt != NULL);
version = (opt->ttl >> 16) & 0xff;
flags = (version << DNS_FETCHOPT_EDNSVERSIONSHIFT) |
DNS_FETCHOPT_EDNSVERSIONSET;
@@ -8280,10 +8287,8 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, dns_name_t *name,
resolver->badcache = isc_mem_get(resolver->mctx,
sizeof(*resolver->badcache) *
DNS_BADCACHE_SIZE);
- if (resolver->badcache == NULL) {
- result = ISC_R_NOMEMORY;
+ if (resolver->badcache == NULL)
goto cleanup;
- }
resolver->badhash = DNS_BADCACHE_SIZE;
memset(resolver->badcache, 0, sizeof(*resolver->badcache) *
resolver->badhash);
@@ -8313,10 +8318,8 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, dns_name_t *name,
if (bad == NULL) {
isc_buffer_t buffer;
bad = isc_mem_get(resolver->mctx, sizeof(*bad) + name->length);
- if (bad == NULL) {
- result = ISC_R_NOMEMORY;
+ if (bad == NULL)
goto cleanup;
- }
bad->type = type;
bad->hashval = hashval;
isc_buffer_init(&buffer, bad + 1, name->length);
diff --git a/external/bsd/bind/dist/lib/dns/result.c b/external/bsd/bind/dist/lib/dns/result.c
index 212bf9b98b1..431db6a25ef 100644
--- a/external/bsd/bind/dist/lib/dns/result.c
+++ b/external/bsd/bind/dist/lib/dns/result.c
@@ -1,4 +1,4 @@
-/* $NetBSD: result.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: result.c,v 1.3 2011/09/11 18:55:36 christos Exp $ */
/*
* Copyright (C) 2004, 2005, 2007-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: result.c,v 1.132 2011-01-11 23:47:13 tbox Exp */
+/* Id: result.c,v 1.133 2011-03-21 07:22:13 each Exp */
/*! \file */
@@ -163,6 +163,7 @@ static const char *text[DNS_R_NRESULTS] = {
"not master", /*%< 105 DNS_R_NOTMASTER */
"broken trust chain", /*%< 106 DNS_R_BROKENCHAIN */
"expired", /*%< 106 DNS_R_EXPIRED */
+ "not dynamic", /*%< 107 DNS_R_NOTDYNAMIC */
};
static const char *rcode_text[DNS_R_NRCODERESULTS] = {
diff --git a/external/bsd/bind/dist/lib/dns/sdb.c b/external/bsd/bind/dist/lib/dns/sdb.c
index b319576a966..1b454e3e4df 100644
--- a/external/bsd/bind/dist/lib/dns/sdb.c
+++ b/external/bsd/bind/dist/lib/dns/sdb.c
@@ -1,4 +1,4 @@
-/* $NetBSD: sdb.c,v 1.3 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: sdb.c,v 1.4 2011/09/11 18:55:36 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sdb.c,v 1.76 2011-01-13 04:59:25 tbox Exp */
+/* Id: sdb.c,v 1.78 2011-03-14 13:40:52 fdupont Exp */
/*! \file */
@@ -1336,7 +1336,7 @@ dns_sdb_create(isc_mem_t *mctx, dns_name_t *origin, dns_dbtype_t type,
cleanup_origin:
dns_name_free(&sdb->common.origin, mctx);
cleanup_lock:
- isc_mutex_destroy(&sdb->lock);
+ (void)isc_mutex_destroy(&sdb->lock);
cleanup_mctx:
isc_mem_put(mctx, sdb, sizeof(dns_sdb_t));
isc_mem_detach(&mctx);
diff --git a/external/bsd/bind/dist/lib/dns/sdlz.c b/external/bsd/bind/dist/lib/dns/sdlz.c
index f7395d02ade..27b99aadfea 100644
--- a/external/bsd/bind/dist/lib/dns/sdlz.c
+++ b/external/bsd/bind/dist/lib/dns/sdlz.c
@@ -1,4 +1,4 @@
-/* $NetBSD: sdlz.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: sdlz.c,v 1.3 2011/09/11 18:55:37 christos Exp $ */
/*
* Portions Copyright (C) 2005-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -52,7 +52,7 @@
* USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sdlz.c,v 1.31 2011-01-13 06:29:16 marka Exp */
+/* Id: sdlz.c,v 1.33 2011-03-21 19:54:03 each Exp */
/*! \file */
@@ -338,7 +338,7 @@ destroy(dns_sdlz_db_t *sdlz) {
sdlz->common.magic = 0;
sdlz->common.impmagic = 0;
- isc_mutex_destroy(&sdlz->refcnt_lock);
+ (void)isc_mutex_destroy(&sdlz->refcnt_lock);
dns_name_free(&sdlz->common.origin, mctx);
@@ -1682,7 +1682,7 @@ dns_sdlzssumatch(dns_name_t *signer, dns_name_t *name, isc_netaddr_t *tcpaddr,
char b_addr[ISC_NETADDR_FORMATSIZE];
char b_type[DNS_RDATATYPE_FORMATSIZE];
char b_key[DST_KEY_FORMATSIZE];
- isc_buffer_t *tkey_token;
+ isc_buffer_t *tkey_token = NULL;
isc_region_t token_region;
isc_uint32_t token_len = 0;
isc_boolean_t ret;
@@ -1697,28 +1697,27 @@ dns_sdlzssumatch(dns_name_t *signer, dns_name_t *name, isc_netaddr_t *tcpaddr,
* Format the request elements. sdlz operates on strings, not
* structures
*/
- if (signer)
+ if (signer != NULL)
dns_name_format(signer, b_signer, sizeof(b_signer));
else
b_signer[0] = 0;
dns_name_format(name, b_name, sizeof(b_name));
- if (tcpaddr)
+ if (tcpaddr != NULL)
isc_netaddr_format(tcpaddr, b_addr, sizeof(b_addr));
else
b_addr[0] = 0;
dns_rdatatype_format(type, b_type, sizeof(b_type));
- if (key)
+ if (key != NULL) {
dst_key_format(key, b_key, sizeof(b_key));
- else
+ tkey_token = dst_key_tkeytoken(key);
+ } else
b_key[0] = 0;
- tkey_token = dst_key_tkeytoken(key);
-
- if (tkey_token) {
+ if (tkey_token != NULL) {
isc_buffer_region(tkey_token, &token_region);
token_len = token_region.length;
}
@@ -1726,7 +1725,7 @@ dns_sdlzssumatch(dns_name_t *signer, dns_name_t *name, isc_netaddr_t *tcpaddr,
MAYBE_LOCK(imp);
ret = imp->methods->ssumatch(b_signer, b_name, b_addr, b_type, b_key,
token_len,
- token_len ? token_region.base : NULL,
+ token_len != 0 ? token_region.base : NULL,
imp->driverarg, dbdata);
MAYBE_UNLOCK(imp);
return (ret);
diff --git a/external/bsd/bind/dist/lib/dns/spnego.c b/external/bsd/bind/dist/lib/dns/spnego.c
index ad710c1d8cc..270d4dbd142 100644
--- a/external/bsd/bind/dist/lib/dns/spnego.c
+++ b/external/bsd/bind/dist/lib/dns/spnego.c
@@ -1,4 +1,4 @@
-/* $NetBSD: spnego.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: spnego.c,v 1.3 2011/09/11 18:55:37 christos Exp $ */
/*
* Copyright (C) 2006-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: spnego.c,v 1.16 2011-01-11 23:47:13 tbox Exp */
+/* Id: spnego.c,v 1.18 2011-04-04 11:09:11 marka Exp */
/*! \file
* \brief
@@ -379,7 +379,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID oid)
unsigned char *p;
size_t len;
- if (token->length == 0)
+ if (token->length == 0U)
return (GSS_S_DEFECTIVE_TOKEN);
p = token->value;
@@ -387,7 +387,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID oid)
return (GSS_S_DEFECTIVE_TOKEN);
len = *p++;
if (len & 0x80) {
- if ((len & 0x7f) > 4)
+ if ((len & 0x7f) > 4U)
return (GSS_S_DEFECTIVE_TOKEN);
p += len & 0x7f;
}
@@ -533,7 +533,7 @@ send_accept(OM_uint32 * minor_status,
*minor_status = ENOMEM;
return (GSS_S_FAILURE);
}
- if (mech_token != NULL && mech_token->length != 0) {
+ if (mech_token != NULL && mech_token->length != 0U) {
resp.responseToken = malloc(sizeof(*resp.responseToken));
if (resp.responseToken == NULL) {
free_NegTokenResp(&resp);
@@ -677,7 +677,7 @@ gss_accept_sec_context_spnego(OM_uint32 *minor_status,
ot = &obuf;
}
ret = send_accept(&minor_status2, output_token, ot, pref);
- if (ot != NULL && ot->length != 0)
+ if (ot != NULL && ot->length != 0U)
gss_release_buffer(&minor_status2, ot);
return (ret);
@@ -694,7 +694,7 @@ gssapi_verify_mech_header(u_char ** str,
int e;
u_char *p = *str;
- if (total_len < 1)
+ if (total_len < 1U)
return (GSS_S_DEFECTIVE_TOKEN);
if (*p++ != 0x60)
return (GSS_S_DEFECTIVE_TOKEN);
@@ -794,7 +794,7 @@ der_get_int(const unsigned char *p, size_t len,
int val = 0;
size_t oldlen = len;
- if (len > 0) {
+ if (len > 0U) {
val = (signed char)*p++;
while (--len)
val = val * 256 + *p++;
@@ -811,11 +811,11 @@ der_get_length(const unsigned char *p, size_t len,
{
size_t v;
- if (len <= 0)
+ if (len <= 0U)
return (ASN1_OVERRUN);
--len;
v = *p++;
- if (v < 128) {
+ if (v < 128U) {
*val = v;
if (size)
*size = 1;
@@ -824,7 +824,7 @@ der_get_length(const unsigned char *p, size_t len,
size_t l;
unsigned tmp;
- if (v == 0x80) {
+ if (v == 0x80U) {
*val = ASN1_INDEFINITE;
if (size)
*size = 1;
@@ -849,7 +849,7 @@ der_get_octet_string(const unsigned char *p, size_t len,
{
data->length = len;
data->data = malloc(len);
- if (data->data == NULL && data->length != 0)
+ if (data->data == NULL && data->length != 0U)
return (ENOMEM);
memcpy(data->data, p, len);
if (size)
@@ -864,23 +864,23 @@ der_get_oid(const unsigned char *p, size_t len,
int n;
size_t oldlen = len;
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERRUN);
data->components = malloc(len * sizeof(*data->components));
- if (data->components == NULL && len != 0)
+ if (data->components == NULL && len != 0U)
return (ENOMEM);
data->components[0] = (*p) / 40;
data->components[1] = (*p) % 40;
--len;
++p;
- for (n = 2; len > 0; ++n) {
+ for (n = 2; len > 0U; ++n) {
unsigned u = 0;
do {
--len;
u = u * 128 + (*p++ % 128);
- } while (len > 0 && p[-1] & 0x80);
+ } while (len > 0U && p[-1] & 0x80);
data->components[n] = u;
}
if (p[-1] & 0x80) {
@@ -898,7 +898,7 @@ der_get_tag(const unsigned char *p, size_t len,
Der_class *class, Der_type *type,
int *tag, size_t *size)
{
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERRUN);
*class = (Der_class) (((*p) >> 6) & 0x03);
*type = (Der_type) (((*p) >> 5) & 0x01);
@@ -1088,7 +1088,7 @@ len_unsigned(unsigned val)
static size_t
length_len(size_t len)
{
- if (len < 128)
+ if (len < 128U)
return (1);
else
return (len_unsigned(len) + 1);
@@ -1110,7 +1110,7 @@ der_put_unsigned(unsigned char *p, size_t len, unsigned val, size_t *size)
unsigned char *base = p;
if (val) {
- while (len > 0 && val) {
+ while (len > 0U && val) {
*p-- = val % 256;
val /= 256;
--len;
@@ -1121,7 +1121,7 @@ der_put_unsigned(unsigned char *p, size_t len, unsigned val, size_t *size)
*size = base - p;
return (0);
}
- } else if (len < 1)
+ } else if (len < 1U)
return (ASN1_OVERFLOW);
else {
*p = 0;
@@ -1137,14 +1137,14 @@ der_put_int(unsigned char *p, size_t len, int val, size_t *size)
if (val >= 0) {
do {
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
*p-- = val % 256;
len--;
val /= 256;
} while (val);
if (p[1] >= 128) {
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
*p-- = 0;
len--;
@@ -1152,14 +1152,14 @@ der_put_int(unsigned char *p, size_t len, int val, size_t *size)
} else {
val = ~val;
do {
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
*p-- = ~(val % 256);
len--;
val /= 256;
} while (val);
if (p[1] < 128) {
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
*p-- = 0xff;
len--;
@@ -1172,9 +1172,9 @@ der_put_int(unsigned char *p, size_t len, int val, size_t *size)
static int
der_put_length(unsigned char *p, size_t len, size_t val, size_t *size)
{
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
- if (val < 128) {
+ if (val < 128U) {
*p = val;
*size = 1;
return (0);
@@ -1215,20 +1215,20 @@ der_put_oid(unsigned char *p, size_t len,
for (n = data->length - 1; n >= 2; --n) {
unsigned u = data->components[n];
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
*p-- = u % 128;
u /= 128;
--len;
while (u > 0) {
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
*p-- = 128 + u % 128;
u /= 128;
--len;
}
}
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
*p-- = 40 * data->components[0] + data->components[1];
*size = base - p;
@@ -1239,7 +1239,7 @@ static int
der_put_tag(unsigned char *p, size_t len, Der_class class, Der_type type,
int tag, size_t *size)
{
- if (len < 1)
+ if (len < 1U)
return (ASN1_OVERFLOW);
*p = (class << 6) | (type << 5) | tag; /* XXX */
*size = 1;
@@ -1405,7 +1405,7 @@ gssapi_spnego_encapsulate(OM_uint32 * minor_status,
}
p = gssapi_mech_make_header(output_token->value, len, mech);
if (p == NULL) {
- if (output_token->length != 0)
+ if (output_token->length != 0U)
gss_release_buffer(minor_status, output_token);
return (GSS_S_FAILURE);
}
@@ -1453,7 +1453,7 @@ gssapi_krb5_get_mech(const u_char *ptr,
const u_char *p = ptr;
int e;
- if (total_len < 1)
+ if (total_len < 1U)
return (-1);
if (*p++ != 0x60)
return (-1);
@@ -1523,7 +1523,7 @@ spnego_initial(OM_uint32 *minor_status,
ret = major_status;
goto end;
}
- if (krb5_output_token.length > 0) {
+ if (krb5_output_token.length > 0U) {
token_init.mechToken = malloc(sizeof(*token_init.mechToken));
if (token_init.mechToken == NULL) {
*minor_status = ENOMEM;
@@ -1590,7 +1590,7 @@ end:
token_init.mechToken = NULL;
}
free_NegTokenInit(&token_init);
- if (krb5_output_token.length != 0)
+ if (krb5_output_token.length != 0U)
gss_release_buffer(&minor_status2, &krb5_output_token);
if (buf)
free(buf);
@@ -1760,7 +1760,7 @@ gss_init_sec_context_spnego(OM_uint32 *minor_status,
/* Figure out whether we're starting over or processing a reply */
- if (input_token == GSS_C_NO_BUFFER || input_token->length == 0)
+ if (input_token == GSS_C_NO_BUFFER || input_token->length == 0U)
return (spnego_initial(minor_status,
initiator_cred_handle,
context_handle,
diff --git a/external/bsd/bind/dist/lib/dns/ssu_external.c b/external/bsd/bind/dist/lib/dns/ssu_external.c
index e0158752e7e..5bb7d8978cd 100644
--- a/external/bsd/bind/dist/lib/dns/ssu_external.c
+++ b/external/bsd/bind/dist/lib/dns/ssu_external.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ssu_external.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: ssu_external.c,v 1.3 2011/09/11 18:55:37 christos Exp $ */
/*
* Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: ssu_external.c,v 1.7 2011-01-13 07:05:57 marka Exp */
+/* Id: ssu_external.c,v 1.8 2011-03-21 19:54:03 each Exp */
/*
* This implements external update-policy rules. This allows permission
@@ -130,7 +130,7 @@ dns_ssu_external_match(dns_name_t *identity,
char b_addr[ISC_NETADDR_FORMATSIZE];
char b_type[DNS_RDATATYPE_FORMATSIZE];
char b_key[DST_KEY_FORMATSIZE];
- isc_buffer_t *tkey_token;
+ isc_buffer_t *tkey_token = NULL;
int fd;
const char *sock_path;
size_t req_len;
@@ -156,33 +156,32 @@ dns_ssu_external_match(dns_name_t *identity,
if (fd == -1)
return (ISC_FALSE);
- tkey_token = dst_key_tkeytoken(key);
+ if (key != NULL) {
+ dst_key_format(key, b_key, sizeof(b_key));
+ tkey_token = dst_key_tkeytoken(key);
+ } else
+ b_key[0] = 0;
+
+ if (tkey_token != NULL) {
+ isc_buffer_region(tkey_token, &token_region);
+ token_len = token_region.length;
+ }
/* Format the request elements */
- if (signer)
+ if (signer != NULL)
dns_name_format(signer, b_signer, sizeof(b_signer));
else
b_signer[0] = 0;
dns_name_format(name, b_name, sizeof(b_name));
- if (tcpaddr)
+ if (tcpaddr != NULL)
isc_netaddr_format(tcpaddr, b_addr, sizeof(b_addr));
else
b_addr[0] = 0;
dns_rdatatype_format(type, b_type, sizeof(b_type));
- if (key)
- dst_key_format(key, b_key, sizeof(b_key));
- else
- b_key[0] = 0;
-
- if (tkey_token) {
- isc_buffer_region(tkey_token, &token_region);
- token_len = token_region.length;
- }
-
/* Work out how big the request will be */
req_len = sizeof(isc_uint32_t) + /* Format version */
sizeof(isc_uint32_t) + /* Length */
diff --git a/external/bsd/bind/dist/lib/dns/time.c b/external/bsd/bind/dist/lib/dns/time.c
index 492a7d51d71..566bef2412b 100644
--- a/external/bsd/bind/dist/lib/dns/time.c
+++ b/external/bsd/bind/dist/lib/dns/time.c
@@ -1,7 +1,7 @@
-/* $NetBSD: time.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: time.c,v 1.3 2011/09/11 18:55:37 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: time.c,v 1.35 2010-04-21 23:51:22 tbox Exp */
+/* Id: time.c,v 1.37 2011-03-09 23:47:17 tbox Exp */
/*! \file */
@@ -30,6 +30,7 @@
#include <isc/print.h>
#include <isc/region.h>
+#include <isc/serial.h>
#include <isc/stdtime.h>
#include <isc/util.h>
@@ -46,13 +47,21 @@ dns_time64_totext(isc_int64_t t, isc_buffer_t *target) {
unsigned int l;
isc_region_t region;
- REQUIRE(t >= 0);
-
+/*
+ * Warning. Do NOT use arguments with side effects with these macros.
+ */
#define is_leap(y) ((((y) % 4) == 0 && ((y) % 100) != 0) || ((y) % 400) == 0)
#define year_secs(y) ((is_leap(y) ? 366 : 365 ) * 86400)
#define month_secs(m,y) ((days[m] + ((m == 1 && is_leap(y)) ? 1 : 0 )) * 86400)
tm.tm_year = 70;
+ while (t < 0) {
+ if (tm.tm_year == 0)
+ return (ISC_R_RANGE);
+ tm.tm_year--;
+ secs = year_secs(tm.tm_year + 1900);
+ t += secs;
+ }
while ((secs = year_secs(tm.tm_year + 1900)) <= t) {
t -= secs;
tm.tm_year++;
@@ -100,7 +109,6 @@ isc_result_t
dns_time32_totext(isc_uint32_t value, isc_buffer_t *target) {
isc_stdtime_t now;
isc_int64_t start;
- isc_int64_t base;
isc_int64_t t;
/*
@@ -111,12 +119,10 @@ dns_time32_totext(isc_uint32_t value, isc_buffer_t *target) {
*/
isc_stdtime_get(&now);
start = (isc_int64_t) now;
- start -= 0x7fffffff;
- base = 0;
- while ((t = (base + value)) < start) {
- base += 0x80000000;
- base += 0x80000000;
- }
+ if (isc_serial_gt(value, now))
+ t = start + (value - now);
+ else
+ t = start - (now - value);
return (dns_time64_totext(t, target));
}
@@ -147,7 +153,7 @@ dns_time64_fromtext(const char *source, isc_int64_t *target) {
&year, &month, &day, &hour, &minute, &second) != 6)
return (DNS_R_SYNTAX);
- RANGE(1970, 9999, year);
+ RANGE(0, 9999, year);
RANGE(1, 12, month);
RANGE(1, days[month - 1] +
((month == 2 && is_leap(year)) ? 1 : 0), day);
@@ -156,16 +162,24 @@ dns_time64_fromtext(const char *source, isc_int64_t *target) {
RANGE(0, 60, second); /* 60 == leap second. */
/*
- * Calculate seconds since epoch.
+ * Calculate seconds from epoch.
+ * Note: this uses a idealized calendar.
*/
value = second + (60 * minute) + (3600 * hour) + ((day - 1) * 86400);
for (i = 0; i < (month - 1); i++)
value += days[i] * 86400;
if (is_leap(year) && month > 2)
value += 86400;
- for (i = 1970; i < year; i++) {
- secs = (is_leap(i) ? 366 : 365) * 86400;
- value += secs;
+ if (year < 1970) {
+ for (i = 1969; i >= year; i--) {
+ secs = (is_leap(i) ? 366 : 365) * 86400;
+ value -= secs;
+ }
+ } else {
+ for (i = 1970; i < year; i++) {
+ secs = (is_leap(i) ? 366 : 365) * 86400;
+ value += secs;
+ }
}
*target = value;
diff --git a/external/bsd/bind/dist/lib/dns/tkey.c b/external/bsd/bind/dist/lib/dns/tkey.c
index cbc6b37405a..b3f8f9c0a7f 100644
--- a/external/bsd/bind/dist/lib/dns/tkey.c
+++ b/external/bsd/bind/dist/lib/dns/tkey.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tkey.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: tkey.c,v 1.3 2011/09/11 18:55:37 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -18,7 +18,7 @@
*/
/*
- * Id: tkey.c,v 1.100 2011-01-08 23:47:01 tbox Exp
+ * Id: tkey.c,v 1.101 2011-03-11 06:11:24 marka Exp
*/
/*! \file */
#include <config.h>
@@ -77,7 +77,9 @@ _dns_tkey_dumpmessage(dns_message_t *msg) {
isc_buffer_init(&outbuf, output, sizeof(output));
result = dns_message_totext(msg, &dns_master_style_debug, 0,
&outbuf);
- /* XXXMLG ignore result */
+ if (result != ISC_R_SUCCESS)
+ fprintf(stderr, "Warning: dns_message_totext returned: %s\n",
+ dns_result_totext(result));
fprintf(stderr, "%.*s\n", (int)isc_buffer_usedlength(&outbuf),
(char *)isc_buffer_base(&outbuf));
}
@@ -181,8 +183,10 @@ add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
failure:
if (newrdata != NULL) {
- if (ISC_LINK_LINKED(newrdata, link))
+ if (ISC_LINK_LINKED(newrdata, link)) {
+ INSIST(newlist != NULL);
ISC_LIST_UNLINK(newlist->rdata, newrdata, link);
+ }
dns_message_puttemprdata(msg, &newrdata);
}
if (newname != NULL)
@@ -520,7 +524,7 @@ process_gsstkey(dns_name_t *name, dns_rdata_tkey_t *tkeyin,
tkeyout->expire = expire;
} else {
tkeyout->inception = tsigkey->inception;
- tkeyout->expire = tkeyout->expire;
+ tkeyout->expire = tsigkey->expire;
dns_tsigkey_detach(&tsigkey);
}
diff --git a/external/bsd/bind/dist/lib/dns/tsig.c b/external/bsd/bind/dist/lib/dns/tsig.c
index 0991c6acaa6..d2a6d019c58 100644
--- a/external/bsd/bind/dist/lib/dns/tsig.c
+++ b/external/bsd/bind/dist/lib/dns/tsig.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tsig.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: tsig.c,v 1.3 2011/09/11 18:55:37 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -18,7 +18,7 @@
*/
/*
- * Id: tsig.c,v 1.147 2011-01-11 23:47:13 tbox Exp
+ * Id: tsig.c,v 1.148 2011-03-21 19:54:03 each Exp
*/
/*! \file */
#include <config.h>
@@ -621,7 +621,7 @@ restore_key(dns_tsig_keyring_t *ring, isc_stdtime_t now, FILE *fp) {
result = dns_tsigkey_createfromkey(name, algorithm, dstkey,
ISC_TRUE, creator, inception,
expire, ring->mctx, ring, NULL);
- if (result != ISC_R_SUCCESS && dstkey != NULL)
+ if (dstkey != NULL)
dst_key_free(&dstkey);
return (result);
}
diff --git a/external/bsd/bind/dist/lib/dns/ttl.c b/external/bsd/bind/dist/lib/dns/ttl.c
index 05607ab9f89..3cea03623cc 100644
--- a/external/bsd/bind/dist/lib/dns/ttl.c
+++ b/external/bsd/bind/dist/lib/dns/ttl.c
@@ -1,7 +1,7 @@
-/* $NetBSD: ttl.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: ttl.c,v 1.3 2011/09/11 18:55:37 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: ttl.c,v 1.29 2007-06-19 23:47:16 tbox Exp */
+/* Id: ttl.c,v 1.31 2011-03-12 04:59:48 tbox Exp */
/*! \file */
@@ -88,6 +88,7 @@ dns_ttl_totext(isc_uint32_t src, isc_boolean_t verbose, isc_buffer_t *target) {
hours = src % 24; src /= 24;
days = src % 7; src /= 7;
weeks = src; src = 0;
+ POST(src);
x = 0;
if (weeks != 0) {
diff --git a/external/bsd/bind/dist/lib/dns/validator.c b/external/bsd/bind/dist/lib/dns/validator.c
index 1c31c134be8..075e135ca6e 100644
--- a/external/bsd/bind/dist/lib/dns/validator.c
+++ b/external/bsd/bind/dist/lib/dns/validator.c
@@ -1,4 +1,4 @@
-/* $NetBSD: validator.c,v 1.5 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: validator.c,v 1.6 2011/09/11 18:55:37 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: validator.c,v 1.197.40.3 2011-06-21 20:15:54 each Exp */
+/* Id: validator.c,v 1.204 2011-06-08 22:13:51 each Exp */
#include <config.h>
@@ -332,7 +332,6 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
dns_fixedname_init(&fixed);
dns_name_downcase(name, dns_fixedname_name(&fixed), NULL);
name = dns_fixedname_name(&fixed);
- result = dns_rdataset_first(rdataset);
for (result = dns_rdataset_first(rdataset);
result == ISC_R_SUCCESS;
result = dns_rdataset_next(rdataset))
@@ -516,7 +515,8 @@ dsfetched(isc_task_t *task, isc_event_t *event) {
result = validatezonekey(val);
if (result != DNS_R_WAIT)
validator_done(val, result);
- } else if (eresult == DNS_R_NXRRSET ||
+ } else if (eresult == DNS_R_CNAME ||
+ eresult == DNS_R_NXRRSET ||
eresult == DNS_R_NCACHENXRRSET ||
eresult == DNS_R_SERVFAIL) /* RFC 1034 parent? */
{
@@ -584,12 +584,16 @@ dsfetched2(isc_task_t *task, isc_event_t *event) {
LOCK(&val->lock);
if (CANCELED(val)) {
validator_done(val, ISC_R_CANCELED);
- } else if (eresult == DNS_R_NXRRSET || eresult == DNS_R_NCACHENXRRSET) {
+ } else if (eresult == DNS_R_CNAME ||
+ eresult == DNS_R_NXRRSET ||
+ eresult == DNS_R_NCACHENXRRSET)
+ {
/*
* There is no DS. If this is a delegation, we're done.
*/
tname = dns_fixedname_name(&devent->foundname);
- if (isdelegation(tname, &val->frdataset, eresult)) {
+ if (eresult != DNS_R_CNAME &&
+ isdelegation(tname, &val->frdataset, eresult)) {
if (val->mustbesecure) {
validator_log(val, ISC_LOG_WARNING,
"must be secure failure, no DS"
@@ -783,6 +787,60 @@ dsvalidated(isc_task_t *task, isc_event_t *event) {
}
/*%
+ * Callback when the CNAME record has been validated.
+ *
+ * Resumes validation of the unsecure zone proof.
+ */
+static void
+cnamevalidated(isc_task_t *task, isc_event_t *event) {
+ dns_validatorevent_t *devent;
+ dns_validator_t *val;
+ isc_boolean_t want_destroy;
+ isc_result_t result;
+ isc_result_t eresult;
+
+ UNUSED(task);
+ INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
+
+ devent = (dns_validatorevent_t *)event;
+ val = devent->ev_arg;
+ eresult = devent->result;
+
+ isc_event_free(&event);
+ dns_validator_destroy(&val->subvalidator);
+
+ INSIST(val->event != NULL);
+ INSIST((val->attributes & VALATTR_INSECURITY) != 0);
+
+ validator_log(val, ISC_LOG_DEBUG(3), "in cnamevalidated");
+ LOCK(&val->lock);
+ if (CANCELED(val)) {
+ validator_done(val, ISC_R_CANCELED);
+ } else if (eresult == ISC_R_SUCCESS) {
+ validator_log(val, ISC_LOG_DEBUG(3), "cname with trust %s",
+ dns_trust_totext(val->frdataset.trust));
+ result = proveunsecure(val, ISC_FALSE, ISC_TRUE);
+ if (result != DNS_R_WAIT)
+ validator_done(val, result);
+ } else {
+ if (eresult != DNS_R_BROKENCHAIN) {
+ if (dns_rdataset_isassociated(&val->frdataset))
+ dns_rdataset_expire(&val->frdataset);
+ if (dns_rdataset_isassociated(&val->fsigrdataset))
+ dns_rdataset_expire(&val->fsigrdataset);
+ }
+ validator_log(val, ISC_LOG_DEBUG(3),
+ "cnamevalidated: got %s",
+ isc_result_totext(eresult));
+ validator_done(val, DNS_R_BROKENCHAIN);
+ }
+ want_destroy = exit_check(val);
+ UNLOCK(&val->lock);
+ if (want_destroy)
+ destroy(val);
+}
+
+/*%
* Return ISC_R_SUCCESS if we can determine that the name doesn't exist
* or we can determine whether there is data or not at the name.
* If the name does not exist return the wildcard name.
@@ -1238,7 +1296,6 @@ authvalidated(isc_task_t *task, isc_event_t *event) {
dns_validatorevent_t *devent;
dns_validator_t *val;
dns_rdataset_t *rdataset;
- dns_rdataset_t *sigrdataset;
isc_boolean_t want_destroy;
isc_result_t result;
isc_boolean_t exists, data;
@@ -1248,7 +1305,6 @@ authvalidated(isc_task_t *task, isc_event_t *event) {
devent = (dns_validatorevent_t *)event;
rdataset = devent->rdataset;
- sigrdataset = devent->sigrdataset;
val = devent->ev_arg;
result = devent->result;
dns_validator_destroy(&val->subvalidator);
@@ -2006,7 +2062,8 @@ validate(dns_validator_t *val, isc_boolean_t resume) {
isc_stdtime_get(&now);
ttl = ISC_MIN(event->rdataset->ttl,
- val->siginfo->timeexpire - now);
+ ISC_MIN(val->siginfo->originalttl,
+ val->siginfo->timeexpire - now));
event->rdataset->ttl = ttl;
event->sigrdataset->ttl = ttl;
}
@@ -2456,8 +2513,10 @@ validatezonekey(dns_validator_t *val) {
validator_log(val, ISC_LOG_DEBUG(2),
"unsigned DS record");
return (DNS_R_NOVALIDSIG);
- } else
+ } else {
result = ISC_R_SUCCESS;
+ POST(result);
+ }
} else if (result == ISC_R_NOTFOUND) {
/*
* We don't have the DS. Find it.
@@ -2468,11 +2527,12 @@ validatezonekey(dns_validator_t *val) {
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
- } else if (result == DNS_R_NCACHENXDOMAIN ||
+ } else if (result == DNS_R_NCACHENXDOMAIN ||
result == DNS_R_NCACHENXRRSET ||
result == DNS_R_EMPTYNAME ||
result == DNS_R_NXDOMAIN ||
- result == DNS_R_NXRRSET)
+ result == DNS_R_NXRRSET ||
+ result == DNS_R_CNAME)
{
/*
* The DS does not exist.
@@ -2857,6 +2917,7 @@ findnsec3proofs(dns_validator_t *val) {
}
if (result != ISC_R_NOMORE)
result = ISC_R_SUCCESS;
+ POST(result);
if (dns_name_countlabels(zonename) == 0)
return (ISC_R_SUCCESS);
@@ -2989,13 +3050,11 @@ validate_authority(dns_validator_t *val, isc_boolean_t resume) {
* infinite loop. Avoid that.
*/
if (val->event->type == dns_rdatatype_dnskey &&
+ rdataset->type == dns_rdatatype_nsec &&
dns_name_equal(name, val->event->name))
{
dns_rdata_t nsec = DNS_RDATA_INIT;
- if (rdataset->type != dns_rdatatype_nsec)
- continue;
-
result = dns_rdataset_first(rdataset);
if (result != ISC_R_SUCCESS)
return (result);
@@ -3069,13 +3128,11 @@ validate_ncache(dns_validator_t *val, isc_boolean_t resume) {
* infinite loop. Avoid that.
*/
if (val->event->type == dns_rdatatype_dnskey &&
+ rdataset->type == dns_rdatatype_nsec &&
dns_name_equal(name, val->event->name))
{
dns_rdata_t nsec = DNS_RDATA_INIT;
- if (rdataset->type != dns_rdatatype_nsec)
- continue;
-
result = dns_rdataset_first(rdataset);
if (result != ISC_R_SUCCESS)
return (result);
@@ -3746,6 +3803,20 @@ proveunsecure(dns_validator_t *val, isc_boolean_t have_ds, isc_boolean_t resume)
return (startfinddlvsep(val, tname));
}
continue;
+ } else if (result == DNS_R_CNAME) {
+ if (DNS_TRUST_PENDING(val->frdataset.trust) ||
+ DNS_TRUST_ANSWER(val->frdataset.trust)) {
+ result = create_validator(val, tname,
+ dns_rdatatype_cname,
+ &val->frdataset,
+ NULL, cnamevalidated,
+ "proveunsecure "
+ "(cname)");
+ if (result != ISC_R_SUCCESS)
+ goto out;
+ return (DNS_R_WAIT);
+ }
+ continue;
} else if (result == ISC_R_SUCCESS) {
/*
* There is a DS here. Verify that it's secure and
@@ -4016,9 +4087,9 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
isc_task_t *task, isc_taskaction_t action, void *arg,
dns_validator_t **validatorp)
{
- isc_result_t result;
+ isc_result_t result = ISC_R_FAILURE;
dns_validator_t *val;
- isc_task_t *tclone;
+ isc_task_t *tclone = NULL;
dns_validatorevent_t *event;
REQUIRE(name != NULL);
@@ -4026,9 +4097,6 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
(rdataset == NULL && sigrdataset == NULL && message != NULL));
REQUIRE(validatorp != NULL && *validatorp == NULL);
- tclone = NULL;
- result = ISC_R_FAILURE;
-
val = isc_mem_get(view->mctx, sizeof(*val));
if (val == NULL)
return (ISC_R_NOMEMORY);
diff --git a/external/bsd/bind/dist/lib/dns/view.c b/external/bsd/bind/dist/lib/dns/view.c
index 7c0f0cd026c..40c2bee5120 100644
--- a/external/bsd/bind/dist/lib/dns/view.c
+++ b/external/bsd/bind/dist/lib/dns/view.c
@@ -1,4 +1,4 @@
-/* $NetBSD: view.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: view.c,v 1.3 2011/09/11 18:55:37 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: view.c,v 1.178 2011-01-13 09:53:04 marka Exp */
+/* Id: view.c,v 1.181 2011-08-02 20:36:12 each Exp */
/*! \file */
@@ -197,6 +197,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
ISC_LIST_INIT(view->rpz_zones);
dns_fixedname_init(&view->dlv_fixed);
view->managed_keys = NULL;
+ view->redirect = NULL;
#ifdef BIND9
view->new_zone_file = NULL;
view->new_zone_config = NULL;
@@ -432,6 +433,8 @@ destroy(dns_view_t *view) {
}
if (view->managed_keys != NULL)
dns_zone_detach(&view->managed_keys);
+ if (view->redirect != NULL)
+ dns_zone_detach(&view->redirect);
dns_view_setnewzones(view, ISC_FALSE, NULL, NULL);
#endif
dns_fwdtable_destroy(&view->fwdtable);
@@ -501,6 +504,11 @@ view_flushanddetach(dns_view_t **viewp, isc_boolean_t flush) {
dns_zone_flush(view->managed_keys);
dns_zone_detach(&view->managed_keys);
}
+ if (view->redirect != NULL) {
+ if (view->flush)
+ dns_zone_flush(view->redirect);
+ dns_zone_detach(&view->redirect);
+ }
#endif
done = all_done(view);
UNLOCK(&view->lock);
@@ -1162,7 +1170,7 @@ dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
{
isc_result_t result;
dns_db_t *db;
- isc_boolean_t is_cache, use_zone, try_hints, is_staticstub_zone;
+ isc_boolean_t is_cache, use_zone, try_hints;
dns_zone_t *zone;
dns_name_t *zfname;
dns_rdataset_t zrdataset, zsigrdataset;
@@ -1174,7 +1182,6 @@ dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
db = NULL;
zone = NULL;
use_zone = ISC_FALSE;
- is_staticstub_zone = ISC_FALSE;
try_hints = ISC_FALSE;
zfname = NULL;
@@ -1190,11 +1197,8 @@ dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
*/
#ifdef BIND9
result = dns_zt_find(view->zonetable, name, 0, NULL, &zone);
- if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+ if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH)
result = dns_zone_getdb(zone, &db);
- if (dns_zone_gettype(zone) == dns_zone_staticstub)
- is_staticstub_zone = ISC_TRUE;
- }
#else
result = ISC_R_NOTFOUND;
#endif
@@ -1393,6 +1397,7 @@ dns_viewlist_findzone(dns_viewlist_t *list, dns_name_t *name,
if (result == DNS_R_PARTIALMATCH) {
dns_zone_detach(zp);
result = ISC_R_NOTFOUND;
+ POST(result);
}
if (zone2 != NULL) {
@@ -1526,16 +1531,23 @@ dns_view_flushcache2(dns_view_t *view, isc_boolean_t fixuponly) {
isc_result_t
dns_view_flushname(dns_view_t *view, dns_name_t *name) {
+ return (dns_view_flushnode(view, name, ISC_FALSE));
+}
+
+isc_result_t
+dns_view_flushnode(dns_view_t *view, dns_name_t *name, isc_boolean_t tree) {
REQUIRE(DNS_VIEW_VALID(view));
- if (view->adb != NULL)
- dns_adb_flushname(view->adb, name);
- if (view->cache == NULL)
- return (ISC_R_SUCCESS);
- if (view->resolver != NULL)
- dns_resolver_flushbadcache(view->resolver, name);
- return (dns_cache_flushname(view->cache, name));
+ if (!tree) {
+ if (view->adb != NULL)
+ dns_adb_flushname(view->adb, name);
+ if (view->cache == NULL)
+ return (ISC_R_SUCCESS);
+ if (view->resolver != NULL)
+ dns_resolver_flushbadcache(view->resolver, name);
+ }
+ return (dns_cache_flushnode(view->cache, name, tree));
}
isc_result_t
diff --git a/external/bsd/bind/dist/lib/dns/xfrin.c b/external/bsd/bind/dist/lib/dns/xfrin.c
index d3cf1b489d6..29eea85bdb3 100644
--- a/external/bsd/bind/dist/lib/dns/xfrin.c
+++ b/external/bsd/bind/dist/lib/dns/xfrin.c
@@ -1,4 +1,4 @@
-/* $NetBSD: xfrin.c,v 1.4 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: xfrin.c,v 1.5 2011/09/11 18:55:37 christos Exp $ */
/*
* Copyright (C) 2004-2008, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: xfrin.c,v 1.166.522.2.2.1 2011-06-02 23:47:35 tbox Exp */
+/* Id: xfrin.c,v 1.170 2011-03-11 06:11:25 marka Exp */
/*! \file */
@@ -1249,7 +1249,7 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) {
result = DNS_R_UNEXPECTEDID;
if (xfr->reqtype == dns_rdatatype_axfr ||
xfr->reqtype == dns_rdatatype_soa)
- FAIL(result);
+ goto failure;
xfrin_log(xfr, ISC_LOG_DEBUG(3), "got %s, retrying with AXFR",
isc_result_totext(result));
try_axfr:
@@ -1285,7 +1285,7 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) {
if (result != ISC_R_SUCCESS) {
xfrin_log(xfr, ISC_LOG_DEBUG(3), "TSIG check failed: %s",
isc_result_totext(result));
- FAIL(result);
+ goto failure;
}
for (result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
diff --git a/external/bsd/bind/dist/lib/dns/zone.c b/external/bsd/bind/dist/lib/dns/zone.c
index 6b634e45a38..da88b8dedbd 100644
--- a/external/bsd/bind/dist/lib/dns/zone.c
+++ b/external/bsd/bind/dist/lib/dns/zone.c
@@ -1,4 +1,4 @@
-/* $NetBSD: zone.c,v 1.3 2011/05/29 15:17:10 spz Exp $ */
+/* $NetBSD: zone.c,v 1.4 2011/09/11 18:55:38 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: zone.c,v 1.582.8.7 2011-02-18 23:23:08 each Exp */
+/* Id: zone.c,v 1.623 2011-08-09 02:24:28 marka Exp */
/*! \file */
@@ -63,6 +63,7 @@
#include <dns/private.h>
#include <dns/rbt.h>
#include <dns/rcode.h>
+#include <dns/rdata.h>
#include <dns/rdataclass.h>
#include <dns/rdatalist.h>
#include <dns/rdataset.h>
@@ -77,6 +78,7 @@
#include <dns/ssu.h>
#include <dns/stats.h>
#include <dns/tsig.h>
+#include <dns/update.h>
#include <dns/xfrin.h>
#include <dns/zone.h>
@@ -111,12 +113,20 @@
#define NSEC3REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0)
+/*%
+ * Key flags
+ */
+#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
+#define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0)
+#define ALG(x) dst_key_alg(x)
+
/*
* Default values.
*/
#define DNS_DEFAULT_IDLEIN 3600 /*%< 1 hour */
#define DNS_DEFAULT_IDLEOUT 3600 /*%< 1 hour */
#define MAX_XFER_TIME (2*3600) /*%< Documented default is 2 hours */
+#define RESIGN_DELAY 3600 /*%< 1 hour */
#ifndef DNS_MAX_EXPIRE
#define DNS_MAX_EXPIRE 14515200 /*%< 24 weeks */
@@ -209,12 +219,14 @@ struct dns_zone {
isc_time_t signingtime;
isc_time_t nsec3chaintime;
isc_time_t refreshkeytime;
+ isc_uint32_t refreshkeyinterval;
isc_uint32_t refreshkeycount;
isc_uint32_t refresh;
isc_uint32_t retry;
isc_uint32_t expire;
isc_uint32_t minimum;
isc_stdtime_t key_expiry;
+ isc_stdtime_t log_key_expired_timer;
char *keydirectory;
isc_uint32_t maxrefresh;
@@ -230,6 +242,7 @@ struct dns_zone {
isc_sockaddr_t masteraddr;
dns_notifytype_t notifytype;
isc_sockaddr_t *notify;
+ dns_name_t **notifykeynames;
unsigned int notifycnt;
isc_sockaddr_t notifyfrom;
isc_task_t *task;
@@ -329,6 +342,11 @@ struct dns_zone {
* whether a rpz radix was needed when last loaded
*/
isc_boolean_t rpz_zone;
+
+ /*%
+ * Serial number update method.
+ */
+ dns_updatemethod_t updatemethod;
};
#define DNS_ZONE_FLAG(z,f) (ISC_TF(((z)->flags & (f)) != 0))
@@ -449,6 +467,7 @@ struct dns_notify {
dns_request_t *request;
dns_name_t ns;
isc_sockaddr_t dst;
+ dns_tsigkey_t *key;
ISC_LINK(dns_notify_t) link;
};
@@ -662,6 +681,8 @@ static isc_result_t delete_nsec(dns_db_t *db, dns_dbversion_t *ver,
dns_dbnode_t *node, dns_name_t *name,
dns_diff_t *diff);
static void zone_rekey(dns_zone_t *zone);
+static isc_boolean_t delsig_ok(dns_rdata_rrsig_t *rrsig_ptr,
+ dst_key_t **keys, unsigned int nkeys);
#define ENTER zone_debuglog(zone, me, 1, "enter")
@@ -772,6 +793,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
isc_time_settoepoch(&zone->signingtime);
isc_time_settoepoch(&zone->nsec3chaintime);
isc_time_settoepoch(&zone->refreshkeytime);
+ zone->refreshkeyinterval = 0;
zone->refreshkeycount = 0;
zone->refresh = DNS_ZONE_DEFAULTREFRESH;
zone->retry = DNS_ZONE_DEFAULTRETRY;
@@ -787,6 +809,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
zone->masterscnt = 0;
zone->curmaster = 0;
zone->notify = NULL;
+ zone->notifykeynames = NULL;
zone->notifytype = dns_notifytype_yes;
zone->notifycnt = 0;
zone->task = NULL;
@@ -807,6 +830,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
zone->timer = NULL;
zone->idlein = DNS_DEFAULT_IDLEIN;
zone->idleout = DNS_DEFAULT_IDLEOUT;
+ zone->log_key_expired_timer = 0;
ISC_LIST_INIT(zone->notifies);
isc_sockaddr_any(&zone->notifysrc4);
isc_sockaddr_any6(&zone->notifysrc6);
@@ -1060,6 +1084,7 @@ dns_zone_getserial(dns_zone_t *zone) {
*/
void
dns_zone_settype(dns_zone_t *zone, dns_zonetype_t type) {
+ char namebuf[1024];
REQUIRE(DNS_ZONE_VALID(zone));
REQUIRE(type != dns_zone_none);
@@ -1070,6 +1095,12 @@ dns_zone_settype(dns_zone_t *zone, dns_zonetype_t type) {
LOCK_ZONE(zone);
REQUIRE(zone->type == dns_zone_none || zone->type == type);
zone->type = type;
+
+ if (zone->strnamerd != NULL)
+ isc_mem_free(zone->mctx, zone->strnamerd);
+
+ zone_namerd_tostr(zone, namebuf, sizeof namebuf);
+ zone->strnamerd = isc_mem_strdup(zone->mctx, namebuf);
UNLOCK_ZONE(zone);
}
@@ -1362,18 +1393,25 @@ dns_zone_getjournal(dns_zone_t *zone) {
* allow dynamic updates either by having an update policy ("ssutable")
* or an "allow-update" ACL with a value other than exactly "{ none; }".
*/
-static isc_boolean_t
-zone_isdynamic(dns_zone_t *zone) {
+isc_boolean_t
+dns_zone_isdynamic(dns_zone_t *zone, isc_boolean_t ignore_freeze) {
REQUIRE(DNS_ZONE_VALID(zone));
- return (ISC_TF(zone->type == dns_zone_slave ||
- zone->type == dns_zone_stub ||
- zone->type == dns_zone_key ||
- (!zone->update_disabled && zone->ssutable != NULL) ||
- (!zone->update_disabled && zone->update_acl != NULL &&
- !dns_acl_isnone(zone->update_acl))));
-}
+ if (zone->type == dns_zone_slave || zone->type == dns_zone_stub ||
+ zone->type == dns_zone_key ||
+ (zone->type == dns_zone_redirect && zone->masters != NULL))
+ return (ISC_TRUE);
+
+ /* If !ignore_freeze, we need check whether updates are disabled. */
+ if (zone->type == dns_zone_master &&
+ (!zone->update_disabled || ignore_freeze) &&
+ ((zone->ssutable != NULL) ||
+ (zone->update_acl != NULL && !dns_acl_isnone(zone->update_acl))))
+ return (ISC_TRUE);
+
+ return (ISC_FALSE);
+}
static isc_result_t
zone_load(dns_zone_t *zone, unsigned int flags) {
@@ -1381,6 +1419,7 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
isc_time_t now;
isc_time_t loadtime, filetime;
dns_db_t *db = NULL;
+ isc_boolean_t rbt;
REQUIRE(DNS_ZONE_VALID(zone));
@@ -1396,20 +1435,21 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
goto cleanup;
}
- if (zone->db != NULL && zone->masterfile == NULL) {
+
+ INSIST(zone->db_argc >= 1);
+
+ rbt = strcmp(zone->db_argv[0], "rbt") == 0 ||
+ strcmp(zone->db_argv[0], "rbt64") == 0;
+
+ if (zone->db != NULL && zone->masterfile == NULL && rbt) {
/*
- * The zone has no master file configured, but it already
- * has a database. It could be the built-in
- * version.bind. CH zone, a zone with a persistent
- * database being reloaded, or maybe a zone that
- * used to have a master file but whose configuration
- * was changed so that it no longer has one. Do nothing.
+ * The zone has no master file configured.
*/
result = ISC_R_SUCCESS;
goto cleanup;
}
- if (zone->db != NULL && zone_isdynamic(zone)) {
+ if (zone->db != NULL && dns_zone_isdynamic(zone, ISC_FALSE)) {
/*
* This is a slave, stub, or dynamically updated
* zone being reloaded. Do nothing - the database
@@ -1422,7 +1462,6 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
goto cleanup;
}
-
/*
* Store the current time before the zone is loaded, so that if the
* file changes between the time of the load and the time that
@@ -1465,21 +1504,21 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
}
}
- INSIST(zone->db_argc >= 1);
-
/*
- * Built in zones don't need to be reloaded.
+ * Built in zones (with the exception of empty zones) don't need
+ * to be reloaded.
*/
if (zone->type == dns_zone_master &&
strcmp(zone->db_argv[0], "_builtin") == 0 &&
+ (zone->db_argc < 2 || strcmp(zone->db_argv[1], "empty") != 0) &&
DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED)) {
result = ISC_R_SUCCESS;
goto cleanup;
}
- if ((zone->type == dns_zone_slave || zone->type == dns_zone_stub) &&
- (strcmp(zone->db_argv[0], "rbt") == 0 ||
- strcmp(zone->db_argv[0], "rbt64") == 0)) {
+ if ((zone->type == dns_zone_slave || zone->type == dns_zone_stub ||
+ (zone->type == dns_zone_redirect && zone->masters != NULL)) &&
+ rbt) {
if (zone->masterfile == NULL ||
!isc_file_exists(zone->masterfile)) {
if (zone->masterfile != NULL) {
@@ -1516,7 +1555,9 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
result = zone_startload(db, zone, loadtime);
} else {
result = DNS_R_NOMASTERFILE;
- if (zone->type == dns_zone_master) {
+ if (zone->type == dns_zone_master ||
+ (zone->type == dns_zone_redirect &&
+ zone->masters == NULL)) {
dns_zone_log(zone, ISC_LOG_ERROR,
"loading zone: "
"no master file configured");
@@ -1562,8 +1603,8 @@ dns_zone_loadandthaw(dns_zone_t *zone) {
case DNS_R_CONTINUE:
/* Deferred thaw. */
break;
- case ISC_R_SUCCESS:
case DNS_R_UPTODATE:
+ case ISC_R_SUCCESS:
case DNS_R_SEENINCLUDE:
zone->update_disabled = ISC_FALSE;
break;
@@ -1582,7 +1623,8 @@ get_master_options(dns_zone_t *zone) {
unsigned int options;
options = DNS_MASTER_ZONE;
- if (zone->type == dns_zone_slave)
+ if (zone->type == dns_zone_slave ||
+ (zone->type == dns_zone_redirect && zone->masters == NULL))
options |= DNS_MASTER_SLAVE;
if (zone->type == dns_zone_key)
options |= DNS_MASTER_KEY;
@@ -1995,8 +2037,7 @@ zone_check_glue(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
dns_rdataset_disassociate(&aaaa);
return (answer);
}
- } else
- tresult = result;
+ }
dns_name_format(owner, ownerbuf, sizeof ownerbuf);
dns_name_format(name, namebuf, sizeof namebuf);
@@ -2396,13 +2437,22 @@ resume_signingwithkey(dns_zone_t *zone) {
static isc_result_t
zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
dns_nsec3chain_t *nsec3chain, *current;
+ dns_dbversion_t *version = NULL;
+ isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;
isc_result_t result;
isc_time_t now;
unsigned int options = 0;
char saltbuf[255*2+1];
- char flags[sizeof("REMOVE|CREATE|NONSEC|OPTOUT")];
+ char flags[sizeof("INITIAL|REMOVE|CREATE|NONSEC|OPTOUT")];
int i;
+ dns_db_currentversion(zone->db, &version);
+ result = dns_nsec_nseconly(zone->db, version, &nseconly);
+ nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
+ dns_db_closeversion(zone->db, &version, ISC_FALSE);
+ if (!nsec3ok && (nsec3param->flags & DNS_NSEC3FLAG_REMOVE) == 0)
+ return (ISC_R_SUCCESS);
+
nsec3chain = isc_mem_get(zone->mctx, sizeof *nsec3chain);
if (nsec3chain == NULL)
return (ISC_R_NOMEMORY);
@@ -2429,6 +2479,12 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
flags[0] = '\0';
if (nsec3param->flags & DNS_NSEC3FLAG_REMOVE)
strlcat(flags, "REMOVE", sizeof(flags));
+ if (nsec3param->flags & DNS_NSEC3FLAG_INITIAL) {
+ if (flags[0] == '\0')
+ strlcpy(flags, "INITIAL", sizeof(flags));
+ else
+ strlcat(flags, "|INITIAL", sizeof(flags));
+ }
if (nsec3param->flags & DNS_NSEC3FLAG_CREATE) {
if (flags[0] == '\0')
strlcpy(flags, "CREATE", sizeof(flags));
@@ -2457,6 +2513,7 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
"zone_addnsec3chain(%u,%s,%u,%s)",
nsec3param->hash, flags, nsec3param->iterations,
saltbuf);
+
for (current = ISC_LIST_HEAD(zone->nsec3chain);
current != NULL;
current = ISC_LIST_NEXT(current, link)) {
@@ -2509,6 +2566,7 @@ resume_addnsec3chain(dns_zone_t *zone) {
dns_rdataset_t rdataset;
isc_result_t result;
dns_rdata_nsec3param_t nsec3param;
+ isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;
if (zone->privatetype == 0)
return;
@@ -2518,6 +2576,10 @@ resume_addnsec3chain(dns_zone_t *zone) {
goto cleanup;
dns_db_currentversion(zone->db, &version);
+
+ result = dns_nsec_nseconly(zone->db, version, &nseconly);
+ nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
+
dns_rdataset_init(&rdataset);
result = dns_db_findrdataset(zone->db, node, version,
zone->privatetype, dns_rdatatype_none,
@@ -2541,8 +2603,9 @@ resume_addnsec3chain(dns_zone_t *zone) {
continue;
result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
- if ((nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0 ||
- (nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) {
+ if (((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) ||
+ ((nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0 && nsec3ok))
+ {
result = zone_addnsec3chain(zone, &nsec3param);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
@@ -2592,7 +2655,7 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
isc_result_t result;
dns_rdata_t rdata = DNS_RDATA_INIT;
isc_boolean_t dynamic = (zone->type == dns_zone_master) ?
- zone_isdynamic(zone) : ISC_FALSE;
+ dns_zone_isdynamic(zone, ISC_FALSE) : ISC_FALSE;
dns_rdataset_init(&rdataset);
result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
@@ -2842,16 +2905,15 @@ compute_tag(dns_name_t *name, dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx,
}
/*
- * Add key to the security roots for all views.
+ * Add key to the security roots.
*/
static void
-trust_key(dns_viewlist_t *viewlist, dns_name_t *keyname,
+trust_key(dns_zone_t *zone, dns_name_t *keyname,
dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx) {
isc_result_t result;
dns_rdata_t rdata = DNS_RDATA_INIT;
unsigned char data[4096];
isc_buffer_t buffer;
- dns_view_t *view;
dns_keytable_t *sr = NULL;
dst_key_t *dstkey = NULL;
@@ -2860,17 +2922,13 @@ trust_key(dns_viewlist_t *viewlist, dns_name_t *keyname,
dns_rdata_fromstruct(&rdata, dnskey->common.rdclass,
dns_rdatatype_dnskey, dnskey, &buffer);
- for (view = ISC_LIST_HEAD(*viewlist); view != NULL;
- view = ISC_LIST_NEXT(view, link)) {
-
- result = dns_view_getsecroots(view, &sr);
- if (result != ISC_R_SUCCESS)
- continue;
+ result = dns_view_getsecroots(zone->view, &sr);
+ if (result != ISC_R_SUCCESS)
+ goto failure;
- CHECK(dns_dnssec_keyfromrdata(keyname, &rdata, mctx, &dstkey));
- CHECK(dns_keytable_add(sr, ISC_TRUE, &dstkey));
- dns_keytable_detach(&sr);
- }
+ CHECK(dns_dnssec_keyfromrdata(keyname, &rdata, mctx, &dstkey));
+ CHECK(dns_keytable_add(sr, ISC_TRUE, &dstkey));
+ dns_keytable_detach(&sr);
failure:
if (dstkey != NULL)
@@ -2881,37 +2939,16 @@ trust_key(dns_viewlist_t *viewlist, dns_name_t *keyname,
}
/*
- * Remove key from the security roots for all views.
- */
-static void
-untrust_key(dns_viewlist_t *viewlist, dns_name_t *keyname, isc_mem_t *mctx,
- dns_rdata_dnskey_t *dnskey)
-{
- dns_view_t *view;
-
- for (view = ISC_LIST_HEAD(*viewlist); view != NULL;
- view = ISC_LIST_NEXT(view, link))
- dns_view_untrust(view, keyname, dnskey, mctx);
-}
-
-/*
- * Add a null key to the security roots for all views, so that all queries
+ * Add a null key to the security roots for so that all queries
* to the zone will fail.
*/
static void
-fail_secure(dns_viewlist_t *viewlist, dns_name_t *keyname) {
+fail_secure(dns_zone_t *zone, dns_name_t *keyname) {
isc_result_t result;
- dns_view_t *view;
-
- for (view = ISC_LIST_HEAD(*viewlist);
- view != NULL;
- view = ISC_LIST_NEXT(view, link)) {
- dns_keytable_t *sr = NULL;
-
- result = dns_view_getsecroots(view, &sr);
- if (result != ISC_R_SUCCESS)
- continue;
+ dns_keytable_t *sr = NULL;
+ result = dns_view_getsecroots(zone->view, &sr);
+ if (result == ISC_R_SUCCESS) {
dns_keytable_marksecure(sr, keyname);
dns_keytable_detach(&sr);
}
@@ -2919,8 +2956,7 @@ fail_secure(dns_viewlist_t *viewlist, dns_name_t *keyname) {
/*
* Scan a set of KEYDATA records from the key zone. The ones that are
- * valid (i.e., the add holddown timer has expired) become trusted keys for
- * all views.
+ * valid (i.e., the add holddown timer has expired) become trusted keys.
*/
static void
load_secroots(dns_zone_t *zone, dns_name_t *name, dns_rdataset_t *rdataset) {
@@ -2929,22 +2965,14 @@ load_secroots(dns_zone_t *zone, dns_name_t *name, dns_rdataset_t *rdataset) {
dns_rdata_keydata_t keydata;
dns_rdata_dnskey_t dnskey;
isc_mem_t *mctx = zone->mctx;
- dns_view_t *view = zone->view;
- dns_viewlist_t *viewlist = view->viewlist;
int trusted = 0, revoked = 0, pending = 0;
isc_stdtime_t now;
+ dns_keytable_t *sr = NULL;
isc_stdtime_get(&now);
- /* For each view, delete references to this key from secroots. */
- for (view = ISC_LIST_HEAD(*viewlist); view != NULL;
- view = ISC_LIST_NEXT(view, link)) {
- dns_keytable_t *sr = NULL;
-
- result = dns_view_getsecroots(view, &sr);
- if (result != ISC_R_SUCCESS)
- continue;
-
+ result = dns_view_getsecroots(zone->view, &sr);
+ if (result == ISC_R_SUCCESS) {
dns_keytable_delete(sr, name);
dns_keytable_detach(&sr);
}
@@ -2982,7 +3010,7 @@ load_secroots(dns_zone_t *zone, dns_name_t *name, dns_rdataset_t *rdataset) {
/* Add to keytables. */
trusted++;
- trust_key(viewlist, name, &dnskey, mctx);
+ trust_key(zone, name, &dnskey, mctx);
}
if (trusted == 0 && pending != 0) {
@@ -2995,7 +3023,7 @@ load_secroots(dns_zone_t *zone, dns_name_t *name, dns_rdataset_t *rdataset) {
revoked, pending);
dns_zone_log(zone, ISC_LOG_ERROR,
"All queries to '%s' will fail", namebuf);
- fail_secure(viewlist, name);
+ fail_secure(zone, name);
}
}
@@ -3049,8 +3077,8 @@ update_one_rr(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,
}
static isc_result_t
-increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver,
- dns_diff_t *diff, isc_mem_t *mctx) {
+update_soa_serial(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,
+ isc_mem_t *mctx, dns_updatemethod_t method) {
dns_difftuple_t *deltuple = NULL;
dns_difftuple_t *addtuple = NULL;
isc_uint32_t serial;
@@ -3061,12 +3089,7 @@ increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver,
addtuple->op = DNS_DIFFOP_ADD;
serial = dns_soa_getserial(&addtuple->rdata);
-
- /* RFC1982 */
- serial = (serial + 1) & 0xFFFFFFFF;
- if (serial == 0)
- serial = 1;
-
+ serial = dns_update_soaserial(serial, method);
dns_soa_setserial(serial, &addtuple->rdata);
CHECK(do_one_tuple(&deltuple, db, ver, diff));
CHECK(do_one_tuple(&addtuple, db, ver, diff));
@@ -3169,6 +3192,7 @@ static isc_result_t
sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
isc_result_t result = ISC_R_SUCCESS;
isc_boolean_t changed = ISC_FALSE;
+ isc_boolean_t commit = ISC_FALSE;
dns_rbtnodechain_t chain;
dns_fixedname_t fn;
dns_name_t foundname, *origin;
@@ -3290,12 +3314,13 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
if (changed) {
/* Write changes to journal file. */
- result = increment_soa_serial(db, ver, &diff, zone->mctx);
- if (result == ISC_R_SUCCESS)
- zone_journal(zone, &diff, "sync_keyzone");
+ CHECK(update_soa_serial(db, ver, &diff, zone->mctx,
+ zone->updatemethod));
+ CHECK(zone_journal(zone, &diff, "sync_keyzone"));
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED);
zone_needdump(zone, 30);
+ commit = ISC_TRUE;
}
failure:
@@ -3304,7 +3329,7 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
if (sr != NULL)
dns_keytable_detach(&sr);
if (ver != NULL)
- dns_db_closeversion(db, &ver, changed);
+ dns_db_closeversion(db, &ver, commit);
dns_diff_clear(&diff);
return (result);
@@ -3333,7 +3358,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
*/
if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
if (zone->type == dns_zone_slave ||
- zone->type == dns_zone_stub) {
+ zone->type == dns_zone_stub ||
+ (zone->type == dns_zone_redirect &&
+ zone->masters == NULL)) {
if (result == ISC_R_FILENOTFOUND)
dns_zone_log(zone, ISC_LOG_DEBUG(1),
"no master file");
@@ -3413,9 +3440,6 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
needdump = ISC_TRUE;
}
- zone->loadtime = loadtime;
-
- dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded");
/*
* Obtain ns, soa and cname counts for top of zone.
*/
@@ -3429,6 +3453,48 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
}
/*
+ * Check to make sure the journal is up to date, and remove the
+ * journal file if it isn't, as we wouldn't be able to apply
+ * updates otherwise.
+ */
+ if (zone->journal != NULL && dns_zone_isdynamic(zone, ISC_TRUE) &&
+ ! DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS)) {
+ isc_uint32_t jserial;
+ dns_journal_t *journal = NULL;
+
+ result = dns_journal_open(zone->mctx, zone->journal,
+ ISC_FALSE, &journal);
+ if (result == ISC_R_SUCCESS) {
+ jserial = dns_journal_last_serial(journal);
+ dns_journal_destroy(&journal);
+ } else {
+ jserial = serial;
+ result = ISC_R_SUCCESS;
+ }
+
+ if (jserial != serial) {
+ dns_zone_log(zone, ISC_LOG_INFO,
+ "journal file is out of date: "
+ "removing journal file");
+ if (remove(zone->journal) < 0 && errno != ENOENT) {
+ char strbuf[ISC_STRERRORSIZE];
+ isc__strerror(errno, strbuf, sizeof(strbuf));
+ isc_log_write(dns_lctx,
+ DNS_LOGCATEGORY_GENERAL,
+ DNS_LOGMODULE_ZONE,
+ ISC_LOG_WARNING,
+ "unable to remove journal "
+ "'%s': '%s'",
+ zone->journal, strbuf);
+ }
+ }
+ }
+
+ zone->loadtime = loadtime;
+
+ dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded");
+
+ /*
* Master / Slave / Stub zones require both NS and SOA records at
* the top of the zone.
*/
@@ -3438,6 +3504,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
case dns_zone_master:
case dns_zone_slave:
case dns_zone_stub:
+ case dns_zone_redirect:
if (soacount != 1) {
dns_zone_log(zone, ISC_LOG_ERROR,
"has %d SOA records", soacount);
@@ -3454,7 +3521,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
result = DNS_R_BADZONE;
goto cleanup;
}
- if (zone->type != dns_zone_stub) {
+ if (zone->type != dns_zone_stub &&
+ zone->type != dns_zone_redirect) {
result = check_nsec3param(zone, db);
if (result != ISC_R_SUCCESS)
goto cleanup;
@@ -3502,7 +3570,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
dns_zone_log(zone, ISC_LOG_ERROR,
"zone serial (%u/%u) has gone "
"backwards", serial, oldserial);
- else if (serial == oldserial && !hasinclude)
+ else if (serial == oldserial && !hasinclude &&
+ strcmp(zone->db_argv[0], "_builtin") != 0)
dns_zone_log(zone, ISC_LOG_ERROR,
"zone serial (%u) unchanged. "
"zone may fail to transfer "
@@ -3529,7 +3598,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HAVETIMERS);
if (zone->type == dns_zone_slave ||
- zone->type == dns_zone_stub) {
+ zone->type == dns_zone_stub ||
+ (zone->type == dns_zone_redirect &&
+ zone->masters != NULL)) {
isc_time_t t;
isc_uint32_t delay;
@@ -3619,6 +3690,40 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
resume_signingwithkey(zone);
resume_addnsec3chain(zone);
}
+
+ if (zone->type == dns_zone_master &&
+ !DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN) &&
+ dns_zone_isdynamic(zone, ISC_FALSE) &&
+ dns_db_issecure(db)) {
+ dns_name_t *name;
+ dns_fixedname_t fixed;
+ dns_rdataset_t next;
+
+ dns_rdataset_init(&next);
+ dns_fixedname_init(&fixed);
+ name = dns_fixedname_name(&fixed);
+
+ result = dns_db_getsigningtime(db, &next, name);
+ if (result == ISC_R_SUCCESS) {
+ isc_stdtime_t timenow;
+ char namebuf[DNS_NAME_FORMATSIZE];
+ char typebuf[DNS_RDATATYPE_FORMATSIZE];
+
+ isc_stdtime_get(&timenow);
+ dns_name_format(name, namebuf, sizeof(namebuf));
+ dns_rdatatype_format(next.covers,
+ typebuf, sizeof(typebuf));
+ dns_zone_log(zone, ISC_LOG_DEBUG(3),
+ "next resign: %s/%s in %d seconds",
+ namebuf, typebuf,
+ next.resign - timenow);
+ dns_rdataset_disassociate(&next);
+ } else
+ dns_zone_log(zone, ISC_LOG_WARNING,
+ "signed dynamic zone has no "
+ "resign event scheduled");
+ }
+
zone_settimer(zone, &now);
}
@@ -3631,7 +3736,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
cleanup:
if (zone->type == dns_zone_slave ||
zone->type == dns_zone_stub ||
- zone->type == dns_zone_key) {
+ zone->type == dns_zone_key ||
+ (zone->type == dns_zone_redirect && zone->masters != NULL)) {
if (zone->journal != NULL)
zone_saveunique(zone, zone->journal, "jn-XXXXXXXX");
if (zone->masterfile != NULL)
@@ -3642,7 +3748,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
if (zone->task != NULL)
zone_settimer(zone, &now);
result = ISC_R_SUCCESS;
- } else if (zone->type == dns_zone_master)
+ } else if (zone->type == dns_zone_master ||
+ zone->type == dns_zone_redirect)
dns_zone_log(zone, ISC_LOG_ERROR, "not loaded due to errors.");
return (result);
}
@@ -4203,48 +4310,8 @@ dns_zone_getnotifysrc6(dns_zone_t *zone) {
return (&zone->notifysrc6);
}
-isc_result_t
-dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
- isc_uint32_t count)
-{
- isc_sockaddr_t *new;
-
- REQUIRE(DNS_ZONE_VALID(zone));
- REQUIRE(count == 0 || notify != NULL);
-
- LOCK_ZONE(zone);
- if (zone->notify != NULL) {
- isc_mem_put(zone->mctx, zone->notify,
- zone->notifycnt * sizeof(*new));
- zone->notify = NULL;
- zone->notifycnt = 0;
- }
- if (count != 0) {
- new = isc_mem_get(zone->mctx, count * sizeof(*new));
- if (new == NULL) {
- UNLOCK_ZONE(zone);
- return (ISC_R_NOMEMORY);
- }
- memcpy(new, notify, count * sizeof(*new));
- zone->notify = new;
- zone->notifycnt = count;
- }
- UNLOCK_ZONE(zone);
- return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_zone_setmasters(dns_zone_t *zone, const isc_sockaddr_t *masters,
- isc_uint32_t count)
-{
- isc_result_t result;
-
- result = dns_zone_setmasterswithkeys(zone, masters, NULL, count);
- return (result);
-}
-
static isc_boolean_t
-same_masters(const isc_sockaddr_t *old, const isc_sockaddr_t *new,
+same_addrs(const isc_sockaddr_t *old, const isc_sockaddr_t *new,
isc_uint32_t count)
{
unsigned int i;
@@ -4274,15 +4341,172 @@ same_keynames(dns_name_t **old, dns_name_t **new, isc_uint32_t count) {
return (ISC_TRUE);
}
+static void
+clear_addresskeylist(isc_sockaddr_t **addrsp, dns_name_t ***keynamesp,
+ unsigned int *countp, isc_mem_t *mctx)
+{
+ unsigned int count;
+ isc_sockaddr_t *addrs;
+ dns_name_t **keynames;
+
+ REQUIRE(countp != NULL && addrsp != NULL && keynamesp != NULL);
+
+ count = *countp;
+ addrs = *addrsp;
+ keynames = *keynamesp;
+
+ if (addrs != NULL) {
+ isc_mem_put(mctx, addrs, count * sizeof(isc_sockaddr_t));
+ addrs = *addrsp = NULL;
+ }
+
+ if (keynames != NULL) {
+ unsigned int i;
+ for (i = 0; i < count; i++) {
+ if (keynames[i] != NULL) {
+ dns_name_free(keynames[i], mctx);
+ isc_mem_put(mctx, keynames[i],
+ sizeof(dns_name_t));
+ keynames[i] = NULL;
+ }
+ }
+ isc_mem_put(mctx, keynames, count * sizeof(dns_name_t *));
+ keynames = *keynamesp = NULL;
+ }
+
+ count = *countp = 0;
+}
+
+static isc_result_t
+set_addrkeylist(unsigned int count,
+ const isc_sockaddr_t *addrs, isc_sockaddr_t **newaddrsp,
+ dns_name_t **names, dns_name_t ***newnamesp,
+ isc_mem_t *mctx)
+{
+ isc_result_t result;
+ isc_sockaddr_t *newaddrs = NULL;
+ dns_name_t **newnames = NULL;
+ unsigned int i;
+
+ REQUIRE(newaddrsp != NULL && *newaddrsp == NULL);
+ REQUIRE(newnamesp != NULL && *newnamesp == NULL);
+
+ newaddrs = isc_mem_get(mctx, count * sizeof(*newaddrs));
+ if (newaddrs == NULL)
+ return (ISC_R_NOMEMORY);
+ memcpy(newaddrs, addrs, count * sizeof(*newaddrs));
+
+ newnames = NULL;
+ if (names != NULL) {
+ newnames = isc_mem_get(mctx, count * sizeof(*newnames));
+ if (newnames == NULL) {
+ isc_mem_put(mctx, newaddrs, count * sizeof(*newaddrs));
+ return (ISC_R_NOMEMORY);
+ }
+ for (i = 0; i < count; i++)
+ newnames[i] = NULL;
+ for (i = 0; i < count; i++) {
+ if (names[i] != NULL) {
+ newnames[i] = isc_mem_get(mctx,
+ sizeof(dns_name_t));
+ if (newnames[i] == NULL)
+ goto allocfail;
+ dns_name_init(newnames[i], NULL);
+ result = dns_name_dup(names[i], mctx,
+ newnames[i]);
+ if (result != ISC_R_SUCCESS) {
+ allocfail:
+ for (i = 0; i < count; i++)
+ if (newnames[i] != NULL)
+ dns_name_free(
+ newnames[i],
+ mctx);
+ isc_mem_put(mctx, newaddrs,
+ count * sizeof(*newaddrs));
+ isc_mem_put(mctx, newnames,
+ count * sizeof(*newnames));
+ return (ISC_R_NOMEMORY);
+ }
+ }
+ }
+ }
+
+ *newaddrsp = newaddrs;
+ *newnamesp = newnames;
+ return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
+ isc_uint32_t count)
+{
+ return (dns_zone_setalsonotifywithkeys(zone, notify, NULL, count));
+}
+
+isc_result_t
+dns_zone_setalsonotifywithkeys(dns_zone_t *zone, const isc_sockaddr_t *notify,
+ dns_name_t **keynames, isc_uint32_t count)
+{
+ isc_result_t result;
+ isc_sockaddr_t *newaddrs = NULL;
+ dns_name_t **newnames = NULL;
+
+ REQUIRE(DNS_ZONE_VALID(zone));
+ REQUIRE(count == 0 || notify != NULL);
+ if (keynames != NULL)
+ REQUIRE(count != 0);
+
+ LOCK_ZONE(zone);
+
+ if (count == zone->notifycnt &&
+ same_addrs(zone->notify, notify, count) &&
+ same_keynames(zone->notifykeynames, keynames, count))
+ goto unlock;
+
+ clear_addresskeylist(&zone->notify, &zone->notifykeynames,
+ &zone->notifycnt, zone->mctx);
+
+ if (count == 0)
+ goto unlock;
+
+ /*
+ * Set up the notify and notifykey lists
+ */
+ result = set_addrkeylist(count, notify, &newaddrs,
+ keynames, &newnames, zone->mctx);
+ if (result != ISC_R_SUCCESS)
+ goto unlock;
+
+ /*
+ * Everything is ok so attach to the zone.
+ */
+ zone->notify = newaddrs;
+ zone->notifykeynames = newnames;
+ zone->notifycnt = count;
+ unlock:
+ UNLOCK_ZONE(zone);
+ return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_zone_setmasters(dns_zone_t *zone, const isc_sockaddr_t *masters,
+ isc_uint32_t count)
+{
+ isc_result_t result;
+
+ result = dns_zone_setmasterswithkeys(zone, masters, NULL, count);
+ return (result);
+}
+
isc_result_t
dns_zone_setmasterswithkeys(dns_zone_t *zone,
const isc_sockaddr_t *masters,
dns_name_t **keynames,
isc_uint32_t count)
{
- isc_sockaddr_t *new;
isc_result_t result = ISC_R_SUCCESS;
- dns_name_t **newname;
+ isc_sockaddr_t *newaddrs = NULL;
+ dns_name_t **newnames = NULL;
isc_boolean_t *newok;
unsigned int i;
@@ -4300,38 +4524,24 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
* unlock and exit.
*/
if (count != zone->masterscnt ||
- !same_masters(zone->masters, masters, count) ||
+ !same_addrs(zone->masters, masters, count) ||
!same_keynames(zone->masterkeynames, keynames, count)) {
if (zone->request != NULL)
dns_request_cancel(zone->request);
} else
goto unlock;
- if (zone->masters != NULL) {
- isc_mem_put(zone->mctx, zone->masters,
- zone->masterscnt * sizeof(*new));
- zone->masters = NULL;
- }
- if (zone->masterkeynames != NULL) {
- for (i = 0; i < zone->masterscnt; i++) {
- if (zone->masterkeynames[i] != NULL) {
- dns_name_free(zone->masterkeynames[i],
- zone->mctx);
- isc_mem_put(zone->mctx,
- zone->masterkeynames[i],
- sizeof(dns_name_t));
- zone->masterkeynames[i] = NULL;
- }
- }
- isc_mem_put(zone->mctx, zone->masterkeynames,
- zone->masterscnt * sizeof(dns_name_t *));
- zone->masterkeynames = NULL;
- }
+
+ /*
+ * This needs to happen before clear_addresskeylist() sets
+ * zone->masterscnt to 0:
+ */
if (zone->mastersok != NULL) {
isc_mem_put(zone->mctx, zone->mastersok,
zone->masterscnt * sizeof(isc_boolean_t));
zone->mastersok = NULL;
}
- zone->masterscnt = 0;
+ clear_addresskeylist(&zone->masters, &zone->masterkeynames,
+ &zone->masterscnt, zone->mctx);
/*
* If count == 0, don't allocate any space for masters, mastersok or
* keynames so internally, those pointers are NULL if count == 0
@@ -4340,75 +4550,33 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
goto unlock;
/*
- * masters must contain count elements!
- */
- new = isc_mem_get(zone->mctx, count * sizeof(*new));
- if (new == NULL) {
- result = ISC_R_NOMEMORY;
- goto unlock;
- }
- memcpy(new, masters, count * sizeof(*new));
-
- /*
- * Similarly for mastersok.
+ * mastersok must contain count elements
*/
newok = isc_mem_get(zone->mctx, count * sizeof(*newok));
if (newok == NULL) {
result = ISC_R_NOMEMORY;
- isc_mem_put(zone->mctx, new, count * sizeof(*new));
+ isc_mem_put(zone->mctx, newaddrs, count * sizeof(*newaddrs));
goto unlock;
};
for (i = 0; i < count; i++)
newok[i] = ISC_FALSE;
/*
- * if keynames is non-NULL, it must contain count elements!
+ * Now set up the masters and masterkey lists
*/
- newname = NULL;
- if (keynames != NULL) {
- newname = isc_mem_get(zone->mctx, count * sizeof(*newname));
- if (newname == NULL) {
- result = ISC_R_NOMEMORY;
- isc_mem_put(zone->mctx, new, count * sizeof(*new));
- isc_mem_put(zone->mctx, newok, count * sizeof(*newok));
- goto unlock;
- }
- for (i = 0; i < count; i++)
- newname[i] = NULL;
- for (i = 0; i < count; i++) {
- if (keynames[i] != NULL) {
- newname[i] = isc_mem_get(zone->mctx,
- sizeof(dns_name_t));
- if (newname[i] == NULL)
- goto allocfail;
- dns_name_init(newname[i], NULL);
- result = dns_name_dup(keynames[i], zone->mctx,
- newname[i]);
- if (result != ISC_R_SUCCESS) {
- allocfail:
- for (i = 0; i < count; i++)
- if (newname[i] != NULL)
- dns_name_free(
- newname[i],
- zone->mctx);
- isc_mem_put(zone->mctx, new,
- count * sizeof(*new));
- isc_mem_put(zone->mctx, newok,
- count * sizeof(*newok));
- isc_mem_put(zone->mctx, newname,
- count * sizeof(*newname));
- goto unlock;
- }
- }
- }
+ result = set_addrkeylist(count, masters, &newaddrs,
+ keynames, &newnames, zone->mctx);
+ if (result != ISC_R_SUCCESS) {
+ isc_mem_put(zone->mctx, newok, count * sizeof(*newok));
+ goto unlock;
}
/*
* Everything is ok so attach to the zone.
*/
- zone->masters = new;
zone->mastersok = newok;
- zone->masterkeynames = newname;
+ zone->masters = newaddrs;
+ zone->masterkeynames = newnames;
zone->masterscnt = count;
DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOMASTERS);
@@ -4522,6 +4690,7 @@ static void
set_key_expiry_warning(dns_zone_t *zone, isc_stdtime_t when, isc_stdtime_t now)
{
unsigned int delta;
+ char timebuf[80];
zone->key_expiry = when;
if (when <= now) {
@@ -4529,30 +4698,67 @@ set_key_expiry_warning(dns_zone_t *zone, isc_stdtime_t when, isc_stdtime_t now)
"DNSKEY RRSIG(s) have expired");
isc_time_settoepoch(&zone->keywarntime);
} else if (when < now + 7 * 24 * 3600) {
+ isc_time_t t;
+ isc_time_set(&t, when, 0);
+ isc_time_formattimestamp(&t, timebuf, 80);
dns_zone_log(zone, ISC_LOG_WARNING,
- "DNSKEY RRSIG(s) will expire at %u",
- when); /* XXXMPA convert to date. */
+ "DNSKEY RRSIG(s) will expire within 7 days: %s",
+ timebuf);
delta = when - now;
delta--; /* loop prevention */
delta /= 24 * 3600; /* to whole days */
delta *= 24 * 3600; /* to seconds */
isc_time_set(&zone->keywarntime, when - delta, 0);
} else {
- dns_zone_log(zone, ISC_LOG_NOTICE, /* XXMPA ISC_LOG_DEBUG(1) */
- "setting keywarntime to %u - 7 days",
- when); /* XXXMPA convert to date. */
isc_time_set(&zone->keywarntime, when - 7 * 24 * 3600, 0);
+ isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
+ dns_zone_log(zone, ISC_LOG_NOTICE,
+ "setting keywarntime to %s", timebuf);
}
}
/*
+ * Helper function to del_sigs(). We don't want to delete RRSIGs that
+ * have no new key.
+ */
+static isc_boolean_t
+delsig_ok(dns_rdata_rrsig_t *rrsig_ptr, dst_key_t **keys, unsigned int nkeys) {
+ unsigned int i = 0;
+
+ /*
+ * It's okay to delete a signature if there is an active ZSK
+ * with the same algorithm
+ */
+ for (i = 0; i < nkeys; i++) {
+ if (rrsig_ptr->algorithm == dst_key_alg(keys[i]) &&
+ (dst_key_isprivate(keys[i])) && !KSK(keys[i]))
+ return (ISC_TRUE);
+ }
+
+ /*
+ * Failing that, it is *not* okay to delete a signature
+ * if the associated public key is still in the DNSKEY RRset
+ */
+ for (i = 0; i < nkeys; i++) {
+ if ((rrsig_ptr->algorithm == dst_key_alg(keys[i])) &&
+ (rrsig_ptr->keyid == dst_key_id(keys[i])))
+ return (ISC_FALSE);
+ }
+
+ /*
+ * But if the key is gone, then go ahead.
+ */
+ return (ISC_TRUE);
+}
+
+/*
* Delete expired RRsigs and any RRsigs we are about to re-sign.
* See also update.c:del_keysigs().
*/
static isc_result_t
del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
- unsigned int nkeys, isc_stdtime_t now)
+ unsigned int nkeys, isc_stdtime_t now, isc_boolean_t incremental)
{
isc_result_t result;
dns_dbnode_t *node = NULL;
@@ -4560,7 +4766,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
dns_rdata_t rdata = DNS_RDATA_INIT;
unsigned int i;
dns_rdata_rrsig_t rrsig;
- isc_boolean_t found;
+ isc_boolean_t found, changed;
isc_stdtime_t warn = 0, maybe = 0;
dns_rdataset_init(&rdataset);
@@ -4586,6 +4792,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
goto failure;
}
+ changed = ISC_FALSE;
for (result = dns_rdataset_first(&rdataset);
result == ISC_R_SUCCESS;
result = dns_rdataset_next(&rdataset)) {
@@ -4594,12 +4801,56 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
RUNTIME_CHECK(result == ISC_R_SUCCESS);
if (type != dns_rdatatype_dnskey) {
- result = update_one_rr(db, ver, diff,
+ if (delsig_ok(&rrsig, keys, nkeys)) {
+ result = update_one_rr(db, ver, diff,
DNS_DIFFOP_DELRESIGN, name,
rdataset.ttl, &rdata);
- dns_rdata_reset(&rdata);
- if (result != ISC_R_SUCCESS)
- break;
+ if (incremental)
+ changed = ISC_TRUE;
+ dns_rdata_reset(&rdata);
+ if (result != ISC_R_SUCCESS)
+ break;
+ } else {
+ /*
+ * At this point, we've got an RRSIG,
+ * which is signed by an inactive key.
+ * An administrator needs to provide a new
+ * key/alg, but until that time, we want to
+ * keep the old RRSIG. Marking the key as
+ * offline will prevent us spinning waiting
+ * for the private part.
+ */
+ if (incremental) {
+ result = offline(db, ver, diff, name,
+ rdataset.ttl, &rdata);
+ changed = ISC_TRUE;
+ if (result != ISC_R_SUCCESS)
+ break;
+ }
+
+ /*
+ * Log the key id and algorithm of
+ * the inactive key with no replacement
+ */
+ if (zone->log_key_expired_timer <= now) {
+ char origin[DNS_NAME_FORMATSIZE];
+ char algbuf[DNS_NAME_FORMATSIZE];
+ dns_name_format(&zone->origin, origin,
+ sizeof(origin));
+ dns_secalg_format(rrsig.algorithm,
+ algbuf,
+ sizeof(algbuf));
+ dns_zone_log(zone, ISC_LOG_WARNING,
+ "Key %s/%s/%d "
+ "missing or inactive "
+ "and has no replacement: "
+ "retaining signatures.",
+ origin, algbuf,
+ rrsig.keyid);
+ zone->log_key_expired_timer = now +
+ 3600;
+ }
+ }
continue;
}
@@ -4643,6 +4894,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
break;
}
}
+
/*
* If there is not a matching DNSKEY then
* delete the RRSIG.
@@ -4655,6 +4907,10 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
if (result != ISC_R_SUCCESS)
break;
}
+
+ if (changed && (rdataset.attributes & DNS_RDATASETATTR_RESIGN) != 0)
+ dns_db_resigned(db, &rdataset, ver);
+
dns_rdataset_disassociate(&rdataset);
if (result == ISC_R_NOMORE)
result = ISC_R_SUCCESS;
@@ -4704,10 +4960,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
goto failure;
}
-#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
-#define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0)
-#define ALG(x) dst_key_alg(x)
-
for (i = 0; i < nkeys; i++) {
isc_boolean_t both = ISC_FALSE;
@@ -4790,10 +5042,14 @@ zone_resigninc(dns_zone_t *zone) {
dns_diff_init(zone->mctx, &sig_diff);
sig_diff.resign = zone->sigresigninginterval;
+
/*
- * Updates are disabled. Pause for 5 minutes.
+ * Zone is frozen or automatic resigning is disabled.
+ * Pause for 5 minutes.
*/
- if (zone->update_disabled) {
+ if (zone->update_disabled ||
+ DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN))
+ {
result = ISC_R_FAILURE;
goto failure;
}
@@ -4846,6 +5102,8 @@ zone_resigninc(dns_zone_t *zone) {
while (result == ISC_R_SUCCESS) {
resign = rdataset.resign;
covers = rdataset.covers;
+ dns_rdataset_disassociate(&rdataset);
+
/*
* Stop if we hit the SOA as that means we have walked the
* entire zone. The SOA record should always be the most
@@ -4853,27 +5111,18 @@ zone_resigninc(dns_zone_t *zone) {
*/
/* XXXMPA increase number of RRsets signed pre call */
if (covers == dns_rdatatype_soa || i++ > zone->signatures ||
- resign > stop) {
- /*
- * Ensure that we don't loop resigning the SOA.
- */
- if (covers == dns_rdatatype_soa)
- dns_db_resigned(db, &rdataset, version);
- dns_rdataset_disassociate(&rdataset);
+ resign > stop)
break;
- }
-
- dns_db_resigned(db, &rdataset, version);
- dns_rdataset_disassociate(&rdataset);
result = del_sigs(zone, db, version, name, covers, &sig_diff,
- zone_keys, nkeys, now);
+ zone_keys, nkeys, now, ISC_TRUE);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
"zone_resigninc:del_sigs -> %s\n",
dns_result_totext(result));
break;
}
+
result = add_sigs(db, version, name, covers, &sig_diff,
zone_keys, nkeys, zone->mctx, inception,
expire, check_ksk, keyset_kskonly);
@@ -4899,7 +5148,7 @@ zone_resigninc(dns_zone_t *zone) {
goto failure;
result = del_sigs(zone, db, version, &zone->origin, dns_rdatatype_soa,
- &sig_diff, zone_keys, nkeys, now);
+ &sig_diff, zone_keys, nkeys, now, ISC_TRUE);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
"zone_resigninc:del_sigs -> %s\n",
@@ -4907,10 +5156,18 @@ zone_resigninc(dns_zone_t *zone) {
goto failure;
}
- result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
+ /*
+ * Did we change anything in the zone?
+ */
+ if (ISC_LIST_EMPTY(sig_diff.tuples))
+ goto failure;
+
+ /* Increment SOA serial if we have made changes */
+ result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+ zone->updatemethod);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
- "zone_resigninc:increment_soa_serial -> %s\n",
+ "zone_resigninc:update_soa_serial -> %s\n",
dns_result_totext(result));
goto failure;
}
@@ -4930,7 +5187,7 @@ zone_resigninc(dns_zone_t *zone) {
}
/* Write changes to journal file. */
- zone_journal(zone, &sig_diff, "zone_resigninc");
+ CHECK(zone_journal(zone, &sig_diff, "zone_resigninc"));
/* Everything has succeeded. Commit the changes. */
dns_db_closeversion(db, &version, ISC_TRUE);
@@ -5338,6 +5595,7 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
isc_buffer_t buffer;
unsigned char parambuf[DNS_NSEC3PARAM_BUFFERSIZE];
dns_ttl_t ttl = 0;
+ isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;
dns_rdataset_init(&rdataset);
@@ -5388,6 +5646,10 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
if (active)
goto add;
+
+ result = dns_nsec_nseconly(db, ver, &nseconly);
+ nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
+
/*
* Delete all private records which match that in nsec3chain.
*/
@@ -5410,7 +5672,9 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
continue;
CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
- if (nsec3param.hash != chain->nsec3param.hash ||
+ if ((!nsec3ok &&
+ (nsec3param.flags & DNS_NSEC3FLAG_INITIAL) != 0) ||
+ nsec3param.hash != chain->nsec3param.hash ||
nsec3param.iterations != chain->nsec3param.iterations ||
nsec3param.salt_length != chain->nsec3param.salt_length ||
memcmp(nsec3param.salt, chain->nsec3param.salt,
@@ -5616,7 +5880,7 @@ update_sigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
tuple = ISC_LIST_HEAD(diff->tuples)) {
result = del_sigs(zone, db, version, &tuple->name,
tuple->rdata.type, sig_diff,
- zone_keys, nkeys, now);
+ zone_keys, nkeys, now, ISC_FALSE);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
"update_sigs:del_sigs -> %s\n",
@@ -5670,11 +5934,11 @@ zone_nsec3chain(dns_zone_t *zone) {
dns_nsec3chainlist_t cleanup;
dst_key_t *zone_keys[MAXZONEKEYS];
isc_int32_t signatures;
- isc_boolean_t check_ksk, keyset_kskonly, is_ksk;
+ isc_boolean_t check_ksk, keyset_kskonly;
isc_boolean_t delegation;
isc_boolean_t first;
isc_result_t result;
- isc_stdtime_t now, inception, soaexpire, expire, stop;
+ isc_stdtime_t now, inception, soaexpire, expire;
isc_uint32_t jitter;
unsigned int i;
unsigned int nkeys = 0;
@@ -5739,7 +6003,6 @@ zone_nsec3chain(dns_zone_t *zone) {
*/
isc_random_get(&jitter);
expire = soaexpire - jitter % 3600;
- stop = now + 5;
check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY);
@@ -5785,8 +6048,6 @@ zone_nsec3chain(dns_zone_t *zone) {
if (NSEC3REMOVE(nsec3chain->nsec3param.flags))
goto next_addchain;
- is_ksk = ISC_FALSE;
- delegation = ISC_FALSE;
dns_dbiterator_current(nsec3chain->dbiterator, &node, name);
if (nsec3chain->delete_nsec) {
@@ -5981,7 +6242,8 @@ zone_nsec3chain(dns_zone_t *zone) {
* of removing this NSEC3 chain.
*/
if (first && !updatensec &&
- (nsec3chain->nsec3param.flags & DNS_NSEC3FLAG_NONSEC) == 0) {
+ (nsec3chain->nsec3param.flags & DNS_NSEC3FLAG_NONSEC) == 0)
+ {
result = need_nsec_chain(db, version,
&nsec3chain->nsec3param,
&buildnsecchain);
@@ -6172,6 +6434,12 @@ zone_nsec3chain(dns_zone_t *zone) {
result = dns_db_getoriginnode(db, &node);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
result = dns_db_allrdatasets(db, node, version, 0, &iterator);
+ if (result != ISC_R_SUCCESS) {
+ dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
+ "dns_db_allrdatasets -> %s\n",
+ dns_result_totext(result));
+ goto failure;
+ }
for (result = dns_rdatasetiter_first(iterator);
result == ISC_R_SUCCESS;
result = dns_rdatasetiter_next(iterator)) {
@@ -6269,17 +6537,18 @@ zone_nsec3chain(dns_zone_t *zone) {
goto done;
result = del_sigs(zone, db, version, &zone->origin, dns_rdatatype_soa,
- &sig_diff, zone_keys, nkeys, now);
+ &sig_diff, zone_keys, nkeys, now, ISC_FALSE);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
"del_sigs -> %s\n", dns_result_totext(result));
goto failure;
}
- result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
+ result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+ zone->updatemethod);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
- "increment_soa_serial -> %s\n",
+ "update_soa_serial -> %s\n",
dns_result_totext(result));
goto failure;
}
@@ -6294,10 +6563,11 @@ zone_nsec3chain(dns_zone_t *zone) {
}
/* Write changes to journal file. */
- zone_journal(zone, &sig_diff, "zone_nsec3chain");
+ CHECK(zone_journal(zone, &sig_diff, "zone_nsec3chain"));
LOCK_ZONE(zone);
zone_needdump(zone, DNS_DUMP_DELAY);
+ DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
UNLOCK_ZONE(zone);
done:
@@ -6504,12 +6774,11 @@ zone_sign(dns_zone_t *zone) {
isc_boolean_t build_nsec3 = ISC_FALSE;
isc_boolean_t first;
isc_result_t result;
- isc_stdtime_t now, inception, soaexpire, expire, stop;
+ isc_stdtime_t now, inception, soaexpire, expire;
isc_uint32_t jitter;
unsigned int i, j;
unsigned int nkeys = 0;
isc_uint32_t nodes;
- isc_boolean_t was_ksk;
dns_rdataset_init(&rdataset);
dns_fixedname_init(&fixed);
@@ -6561,7 +6830,6 @@ zone_sign(dns_zone_t *zone) {
*/
isc_random_get(&jitter);
expire = soaexpire - jitter % 3600;
- stop = now + 5;
/*
* We keep pulling nodes off each iterator in turn until
@@ -6606,8 +6874,6 @@ zone_sign(dns_zone_t *zone) {
delegation = ISC_FALSE;
- was_ksk = ISC_FALSE;
-
if (first && signing->delete) {
/*
* Remove the key we are deleting from consideration.
@@ -6833,7 +7099,7 @@ zone_sign(dns_zone_t *zone) {
commit = ISC_TRUE;
result = del_sigs(zone, db, version, &zone->origin, dns_rdatatype_soa,
- &sig_diff, zone_keys, nkeys, now);
+ &sig_diff, zone_keys, nkeys, now, ISC_FALSE);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
"zone_sign:del_sigs -> %s\n",
@@ -6841,10 +7107,11 @@ zone_sign(dns_zone_t *zone) {
goto failure;
}
- result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
+ result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+ zone->updatemethod);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
- "zone_sign:increment_soa_serial -> %s\n",
+ "zone_sign:update_soa_serial -> %s\n",
dns_result_totext(result));
goto failure;
}
@@ -6866,9 +7133,7 @@ zone_sign(dns_zone_t *zone) {
/*
* Write changes to journal file.
*/
- result = zone_journal(zone, &sig_diff, "zone_sign");
- if (result != ISC_R_SUCCESS)
- goto failure;
+ CHECK(zone_journal(zone, &sig_diff, "zone_sign"));
pauseall:
/*
@@ -7050,6 +7315,7 @@ refresh_time(dns_keyfetch_t *kfetch, isc_boolean_t retry) {
dns_rdataset_current(rdset, &sigrr);
result = dns_rdata_tostruct(&sigrr, &sig, NULL);
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
if (!retry) {
t = sig.originalttl / 2;
@@ -7217,8 +7483,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
dns_keytable_t *secroots = NULL;
dns_dbversion_t *ver = NULL;
dns_diff_t diff;
- isc_boolean_t changed = ISC_FALSE;
isc_boolean_t alldone = ISC_FALSE;
+ isc_boolean_t commit = ISC_FALSE;
dns_name_t *keyname;
dns_rdata_t sigrr = DNS_RDATA_INIT;
dns_rdata_t dnskeyrr = DNS_RDATA_INIT;
@@ -7234,6 +7500,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
isc_stdtime_t now;
int pending = 0;
isc_boolean_t secure;
+ isc_boolean_t free_needed;
UNUSED(task);
INSIST(event != NULL && event->ev_type == DNS_EVENT_FETCHDONE);
@@ -7255,15 +7522,20 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
isc_event_free(&event);
dns_resolver_destroyfetch(&kfetch->fetch);
+ LOCK_ZONE(zone);
+ if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING) || zone->view == NULL)
+ goto cleanup;
+
isc_stdtime_get(&now);
dns_name_format(keyname, namebuf, sizeof(namebuf));
result = dns_view_getsecroots(zone->view, &secroots);
INSIST(result == ISC_R_SUCCESS);
- LOCK_ZONE(zone);
- dns_db_newversion(kfetch->db, &ver);
dns_diff_init(mctx, &diff);
+ diff.resign = zone->sigresigninginterval;
+
+ CHECK(dns_db_newversion(kfetch->db, &ver));
zone->refreshkeycount--;
alldone = ISC_TF(zone->refreshkeycount == 0);
@@ -7278,8 +7550,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
"Unable to fetch DNSKEY set "
"'%s': %s", namebuf, dns_result_totext(eresult));
CHECK(minimal_update(kfetch, ver, &diff));
- changed = ISC_TRUE;
- goto failure;
+ goto done;
}
/* No RRSIGs found */
@@ -7288,8 +7559,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
"No DNSKEY RRSIGs found for "
"'%s': %s", namebuf, dns_result_totext(eresult));
CHECK(minimal_update(kfetch, ver, &diff));
- changed = ISC_TRUE;
- goto failure;
+ goto done;
}
/*
@@ -7417,7 +7687,6 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
CHECK(update_one_rr(kfetch->db, ver, &diff,
DNS_DIFFOP_DEL, keyname, 0,
&keydatarr));
- changed = ISC_TRUE;
}
if (!secure || deletekey)
@@ -7433,7 +7702,6 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
CHECK(update_one_rr(kfetch->db, ver, &diff,
DNS_DIFFOP_ADD, keyname, 0,
&keydatarr));
- changed = ISC_TRUE;
set_refreshkeytimer(zone, &keydata, now);
}
@@ -7488,8 +7756,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
deletekey = ISC_TRUE;
} else if (keydata.removehd == 0) {
/* Remove from secroots */
- untrust_key(zone->view->viewlist,
- keyname, mctx, &dnskey);
+ dns_view_untrust(zone->view, keyname,
+ &dnskey, mctx);
/* If initializing, delete now */
if (keydata.addhd == 0)
@@ -7557,12 +7825,10 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
}
/* Delete old version */
- if (deletekey || !newkey) {
+ if (deletekey || !newkey)
CHECK(update_one_rr(kfetch->db, ver, &diff,
DNS_DIFFOP_DEL, keyname, 0,
&keydatarr));
- changed = ISC_TRUE;
- }
if (updatekey) {
/* Set refresh timer */
@@ -7577,7 +7843,6 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
CHECK(update_one_rr(kfetch->db, ver, &diff,
DNS_DIFFOP_ADD, keyname, 0,
&keydatarr));
- changed = ISC_TRUE;
} else if (newkey) {
/* Convert DNSKEY to KEYDATA */
dns_rdata_tostruct(&dnskeyrr, &dnskey, NULL);
@@ -7595,14 +7860,12 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
CHECK(update_one_rr(kfetch->db, ver, &diff,
DNS_DIFFOP_ADD, keyname, 0,
&keydatarr));
- changed = ISC_TRUE;
}
if (trustkey) {
- /* Trust this key in all views */
+ /* Trust this key. */
dns_rdata_tostruct(&dnskeyrr, &dnskey, NULL);
- trust_key(zone->view->viewlist, keyname, &dnskey,
- mctx);
+ trust_key(zone, keyname, &dnskey, mctx);
}
if (!deletekey)
@@ -7619,27 +7882,33 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
* the security roots; then all queries to the zone will fail.
*/
if (pending != 0)
- fail_secure(zone->view->viewlist, keyname);
+ fail_secure(zone, keyname);
+
+ done:
+
+ if (!ISC_LIST_EMPTY(diff.tuples)) {
+ /* Write changes to journal file. */
+ CHECK(update_soa_serial(kfetch->db, ver, &diff, mctx,
+ zone->updatemethod));
+ CHECK(zone_journal(zone, &diff, "keyfetch_done"));
+ commit = ISC_TRUE;
- failure:
- if (changed) {
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED);
zone_needdump(zone, 30);
}
- UNLOCK_ZONE(zone);
-
- /* Write changes to journal file. */
- if (alldone) {
- result = increment_soa_serial(kfetch->db, ver, &diff, mctx);
- if (result == ISC_R_SUCCESS)
- result = zone_journal(zone, &diff, "keyfetch_done");
- }
+ failure:
dns_diff_clear(&diff);
- dns_db_closeversion(kfetch->db, &ver, changed);
+ if (ver != NULL)
+ dns_db_closeversion(kfetch->db, &ver, commit);
+
+ cleanup:
dns_db_detach(&kfetch->db);
- dns_zone_detach(&kfetch->zone);
+
+ INSIST(zone->irefs > 0);
+ zone->irefs--;
+ kfetch->zone = NULL;
if (dns_rdataset_isassociated(&kfetch->keydataset))
dns_rdataset_disassociate(&kfetch->keydataset);
@@ -7654,6 +7923,11 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
if (secroots != NULL)
dns_keytable_detach(&secroots);
+
+ free_needed = exit_check(zone);
+ UNLOCK_ZONE(zone);
+ if (free_needed)
+ zone_free(zone);
}
/*
@@ -7678,14 +7952,21 @@ zone_refreshkeys(dns_zone_t *zone) {
isc_stdtime_get(&now);
+ LOCK_ZONE(zone);
+ if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
+ isc_time_settoepoch(&zone->refreshkeytime);
+ UNLOCK_ZONE(zone);
+ return;
+ }
+
ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
dns_db_attach(zone->db, &db);
ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
- LOCK_ZONE(zone);
- dns_db_newversion(db, &ver);
dns_diff_init(zone->mctx, &diff);
+ CHECK(dns_db_newversion(db, &ver));
+
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_REFRESHING);
dns_rriterator_init(&rrit, db, ver, 0);
@@ -7740,8 +8021,9 @@ zone_refreshkeys(dns_zone_t *zone) {
zone->refreshkeycount++;
kfetch = isc_mem_get(zone->mctx, sizeof(dns_keyfetch_t));
- kfetch->zone = NULL;
- dns_zone_attach(zone, &kfetch->zone);
+ kfetch->zone = zone;
+ zone->irefs++;
+ INSIST(zone->irefs != 0);
dns_fixedname_init(&kfetch->name);
dns_name_dup(name, zone->mctx,
dns_fixedname_name(&kfetch->name));
@@ -7764,18 +8046,22 @@ zone_refreshkeys(dns_zone_t *zone) {
&kfetch->fetch);
}
if (!ISC_LIST_EMPTY(diff.tuples)) {
- CHECK(increment_soa_serial(db, ver, &diff, zone->mctx));
+ CHECK(update_soa_serial(db, ver, &diff, zone->mctx,
+ zone->updatemethod));
+ CHECK(zone_journal(zone, &diff, "sync_keyzone"));
commit = ISC_TRUE;
- zone_journal(zone, &diff, "sync_keyzone");
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED);
zone_needdump(zone, 30);
}
+
failure:
UNLOCK_ZONE(zone);
- dns_rriterator_destroy(&rrit);
dns_diff_clear(&diff);
- dns_db_closeversion(db, &ver, commit);
+ if (ver != NULL) {
+ dns_rriterator_destroy(&rrit);
+ dns_db_closeversion(db, &ver, commit);
+ }
dns_db_detach(&db);
}
@@ -7805,6 +8091,9 @@ zone_maintenance(dns_zone_t *zone) {
* Expire check.
*/
switch (zone->type) {
+ case dns_zone_redirect:
+ if (zone->masters == NULL)
+ break;
case dns_zone_slave:
case dns_zone_stub:
LOCK_ZONE(zone);
@@ -7823,6 +8112,9 @@ zone_maintenance(dns_zone_t *zone) {
* Up to date check.
*/
switch (zone->type) {
+ case dns_zone_redirect:
+ if (zone->masters == NULL)
+ break;
case dns_zone_slave:
case dns_zone_stub:
if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH) &&
@@ -7840,6 +8132,7 @@ zone_maintenance(dns_zone_t *zone) {
case dns_zone_master:
case dns_zone_slave:
case dns_zone_key:
+ case dns_zone_redirect:
LOCK_ZONE(zone);
if (zone->masterfile != NULL &&
isc_time_compare(&now, &zone->dumptime) >= 0 &&
@@ -7990,7 +8283,7 @@ dns_zone_refresh(dns_zone_t *zone) {
isc_interval_set(&i, isc_random_jitter(zone->retry, zone->retry / 4),
0);
result = isc_time_nowplusinterval(&zone->refreshtime, &i);
- if (result |= ISC_R_SUCCESS)
+ if (result != ISC_R_SUCCESS)
dns_zone_log(zone, ISC_LOG_WARNING,
"isc_time_nowplusinterval() failed: %s",
dns_result_totext(result));
@@ -8461,6 +8754,8 @@ notify_destroy(dns_notify_t *notify, isc_boolean_t locked) {
dns_request_destroy(&notify->request);
if (dns_name_dynamic(&notify->ns))
dns_name_free(&notify->ns, notify->mctx);
+ if (notify->key != NULL)
+ dns_tsigkey_detach(&notify->key);
mctx = notify->mctx;
isc_mem_put(notify->mctx, notify, sizeof(*notify));
isc_mem_detach(&mctx);
@@ -8482,6 +8777,7 @@ notify_create(isc_mem_t *mctx, unsigned int flags, dns_notify_t **notifyp) {
notify->zone = NULL;
notify->find = NULL;
notify->request = NULL;
+ notify->key = NULL;
isc_sockaddr_any(&notify->dst);
dns_name_init(&notify->ns, NULL);
ISC_LINK_INIT(notify, link);
@@ -8626,15 +8922,23 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
if (result != ISC_R_SUCCESS)
goto cleanup;
- isc_netaddr_fromsockaddr(&dstip, &notify->dst);
- isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
- result = dns_view_getpeertsig(notify->zone->view, &dstip, &key);
- if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
- notify_log(notify->zone, ISC_LOG_ERROR, "NOTIFY to %s not "
- "sent. Peer TSIG key lookup failure.", addrbuf);
- goto cleanup_message;
+ if (notify->key != NULL) {
+ /* Transfer ownership of key */
+ key = notify->key;
+ notify->key = NULL;
+ } else {
+ isc_netaddr_fromsockaddr(&dstip, &notify->dst);
+ isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
+ result = dns_view_getpeertsig(notify->zone->view, &dstip, &key);
+ if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
+ notify_log(notify->zone, ISC_LOG_ERROR,
+ "NOTIFY to %s not sent. "
+ "Peer TSIG key lookup failure.", addrbuf);
+ goto cleanup_message;
+ }
}
+ /* XXX: should we log the tsig key too? */
notify_log(notify->zone, ISC_LOG_DEBUG(3), "sending notify to %s",
addrbuf);
if (notify->zone->view->peers != NULL) {
@@ -8836,14 +9140,30 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
*/
LOCK_ZONE(zone);
for (i = 0; i < zone->notifycnt; i++) {
+ dns_tsigkey_t *key = NULL;
+
dst = zone->notify[i];
if (notify_isqueued(zone, NULL, &dst))
continue;
+
result = notify_create(zone->mctx, flags, &notify);
if (result != ISC_R_SUCCESS)
continue;
+
zone_iattach(zone, &notify->zone);
notify->dst = dst;
+
+ if ((zone->notifykeynames != NULL) &&
+ (zone->notifykeynames[i] != NULL)) {
+ dns_view_t *view = dns_zone_getview(zone);
+ dns_name_t *keyname = zone->notifykeynames[i];
+ result = dns_view_gettsig(view, keyname, &key);
+ if (result == ISC_R_SUCCESS) {
+ notify->key = key;
+ key = NULL;
+ }
+ }
+
ISC_LIST_APPEND(zone->notifies, notify, link);
result = notify_send_queue(notify);
if (result != ISC_R_SUCCESS)
@@ -9331,7 +9651,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
"master %s exceeded (source %s)",
master, source);
/* Try with slave with TCP. */
- if (zone->type == dns_zone_slave &&
+ if ((zone->type == dns_zone_slave ||
+ zone->type == dns_zone_redirect) &&
DNS_ZONE_OPTION(zone, DNS_ZONEOPT_TRYTCPREFRESH)) {
if (!dns_zonemgr_unreachable(zone->zmgr,
&zone->masteraddr,
@@ -9344,7 +9665,7 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
goto tcp_transfer;
}
dns_zone_log(zone, ISC_LOG_DEBUG(1),
- "refresh: skipped tcp fallback"
+ "refresh: skipped tcp fallback "
"as master %s (source %s) is "
"unreachable (cached)",
master, source);
@@ -9400,7 +9721,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
* Perhaps AXFR/IXFR is allowed even if SOA queries aren't.
*/
if (msg->rcode == dns_rcode_refused &&
- zone->type == dns_zone_slave)
+ (zone->type == dns_zone_slave ||
+ zone->type == dns_zone_redirect))
goto tcp_transfer;
goto next_master;
}
@@ -9409,7 +9731,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
* If truncated punt to zone transfer which will query again.
*/
if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
- if (zone->type == dns_zone_slave) {
+ if (zone->type == dns_zone_slave ||
+ zone->type == dns_zone_redirect) {
dns_zone_log(zone, ISC_LOG_INFO,
"refresh: truncated UDP answer, "
"initiating TCP zone xfer "
@@ -9525,6 +9848,7 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
} else
zone_debuglog(zone, me, 1, "serial: new %u, old not loaded",
serial);
+
if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) ||
DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FORCEXFER) ||
isc_serial_gt(serial, oldserial)) {
@@ -9533,7 +9857,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
dns_zone_log(zone, ISC_LOG_INFO,
"refresh: skipping %s as master %s "
"(source %s) is unreachable (cached)",
- zone->type == dns_zone_slave ?
+ (zone->type == dns_zone_slave ||
+ zone->type == dns_zone_redirect) ?
"zone transfer" : "NS query",
master, source);
goto next_master;
@@ -9543,7 +9868,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
LOCK_ZONE(zone);
dns_request_destroy(&zone->request);
UNLOCK_ZONE(zone);
- if (zone->type == dns_zone_slave) {
+ if (zone->type == dns_zone_slave ||
+ zone->type == dns_zone_redirect) {
queue_xfrin(zone);
} else {
INSIST(zone->type == dns_zone_stub);
@@ -10068,7 +10394,13 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
dns_db_settask(stub->db, zone->task);
}
- dns_db_newversion(stub->db, &stub->version);
+ result = dns_db_newversion(stub->db, &stub->version);
+ if (result != ISC_R_SUCCESS) {
+ dns_zone_log(zone, ISC_LOG_INFO, "refreshing stub: "
+ "dns_db_newversion() failed: %s",
+ dns_result_totext(result));
+ goto cleanup;
+ }
/*
* Update SOA record.
@@ -10076,8 +10408,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
result = dns_db_findnode(stub->db, &zone->origin, ISC_TRUE,
&node);
if (result != ISC_R_SUCCESS) {
- dns_zone_log(zone, ISC_LOG_INFO,
- "refreshing stub: "
+ dns_zone_log(zone, ISC_LOG_INFO, "refreshing stub: "
"dns_db_findnode() failed: %s",
dns_result_totext(result));
goto cleanup;
@@ -10099,6 +10430,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
* XXX Optimisation: Create message when zone is setup and reuse.
*/
result = create_query(zone, dns_rdatatype_ns, &message);
+ INSIST(result == ISC_R_SUCCESS);
INSIST(zone->masterscnt > 0);
INSIST(zone->curmaster < zone->masterscnt);
@@ -10172,6 +10504,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
break;
default:
result = ISC_R_NOTIMPLEMENTED;
+ POST(result);
goto cleanup;
}
timeout = 15;
@@ -10334,6 +10667,11 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
isc_time_settoepoch(&next);
switch (zone->type) {
+ case dns_zone_redirect:
+ if (zone->masters != NULL)
+ goto treat_as_slave;
+ /* FALLTHROUGH */
+
case dns_zone_master:
if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY))
next = zone->notifytime;
@@ -10344,6 +10682,8 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
isc_time_compare(&zone->dumptime, &next) < 0)
next = zone->dumptime;
}
+ if (zone->type == dns_zone_redirect)
+ break;
if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING) &&
!isc_time_isepoch(&zone->refreshkeytime)) {
if (isc_time_isepoch(&next) ||
@@ -10373,9 +10713,10 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
break;
case dns_zone_slave:
+ treat_as_slave:
if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY))
next = zone->notifytime;
- /*FALLTHROUGH*/
+ /* FALLTHROUGH */
case dns_zone_stub:
if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESH) &&
@@ -11037,15 +11378,17 @@ zone_namerd_tostr(dns_zone_t *zone, char *buf, size_t length) {
* Leave space for terminating '\0'.
*/
isc_buffer_init(&buffer, buf, length - 1);
- if (dns_name_dynamic(&zone->origin))
- result = dns_name_totext(&zone->origin, ISC_TRUE, &buffer);
- if (result != ISC_R_SUCCESS &&
- isc_buffer_availablelength(&buffer) >= (sizeof("<UNKNOWN>") - 1))
- isc_buffer_putstr(&buffer, "<UNKNOWN>");
+ if (zone->type != dns_zone_redirect && zone->type != dns_zone_key) {
+ if (dns_name_dynamic(&zone->origin))
+ result = dns_name_totext(&zone->origin, ISC_TRUE, &buffer);
+ if (result != ISC_R_SUCCESS &&
+ isc_buffer_availablelength(&buffer) >= (sizeof("<UNKNOWN>") - 1))
+ isc_buffer_putstr(&buffer, "<UNKNOWN>");
- if (isc_buffer_availablelength(&buffer) > 0)
- isc_buffer_putstr(&buffer, "/");
- (void)dns_rdataclass_totext(zone->rdclass, &buffer);
+ if (isc_buffer_availablelength(&buffer) > 0)
+ isc_buffer_putstr(&buffer, "/");
+ (void)dns_rdataclass_totext(zone->rdclass, &buffer);
+ }
if (zone->view != NULL && strcmp(zone->view->name, "_bind") != 0 &&
strcmp(zone->view->name, "_default") != 0 &&
@@ -11154,8 +11497,9 @@ dns_zone_logc(dns_zone_t *zone, isc_logcategory_t *category,
vsnprintf(message, sizeof(message), fmt, ap);
va_end(ap);
isc_log_write(dns_lctx, category, DNS_LOGMODULE_ZONE,
- level, "%s %s: %s", (zone->type == dns_zone_key) ?
- "managed-keys-zone" : "zone", zone->strnamerd, message);
+ level, "%s%s: %s", (zone->type == dns_zone_key) ?
+ "managed-keys-zone" : (zone->type == dns_zone_redirect) ?
+ "redirect-zone" : "zone ", zone->strnamerd, message);
}
void
@@ -11170,8 +11514,9 @@ dns_zone_log(dns_zone_t *zone, int level, const char *fmt, ...) {
vsnprintf(message, sizeof(message), fmt, ap);
va_end(ap);
isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_ZONE,
- level, "%s %s: %s", (zone->type == dns_zone_key) ?
- "managed-keys-zone" : "zone", zone->strnamerd, message);
+ level, "%s%s: %s", (zone->type == dns_zone_key) ?
+ "managed-keys-zone" : (zone->type == dns_zone_redirect) ?
+ "redirect-zone" : "zone ", zone->strnamerd, message);
}
static void
@@ -11449,8 +11794,10 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
&oldserial, NULL, NULL, NULL, NULL,
NULL);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
- if (zone->type == dns_zone_slave &&
- !isc_serial_gt(serial, oldserial)) {
+ if ((zone->type == dns_zone_slave ||
+ (zone->type == dns_zone_redirect &&
+ zone->masters != NULL))
+ && !isc_serial_gt(serial, oldserial)) {
isc_uint32_t serialmin, serialmax;
serialmin = (oldserial + 1) & 0xffffffffU;
serialmax = (oldserial + 0x7fffffffU) & 0xffffffffU;
@@ -12362,16 +12709,10 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
zmgr->transfersin = 10;
zmgr->transfersperns = 2;
- /* Create the zone task pool. */
- result = isc_taskpool_create(taskmgr, mctx,
- 8 /* XXX */, 2, &zmgr->zonetasks);
- if (result != ISC_R_SUCCESS)
- goto free_rwlock;
-
/* Create a single task for queueing of SOA queries. */
result = isc_task_create(taskmgr, 1, &zmgr->task);
if (result != ISC_R_SUCCESS)
- goto free_taskpool;
+ goto free_rwlock;
isc_task_setname(zmgr->task, "zmgr", zmgr);
result = isc_ratelimiter_create(mctx, timermgr, zmgr->task,
&zmgr->rl);
@@ -12405,8 +12746,6 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
isc_ratelimiter_detach(&zmgr->rl);
free_task:
isc_task_detach(&zmgr->task);
- free_taskpool:
- isc_taskpool_destroy(&zmgr->zonetasks);
free_rwlock:
isc_rwlock_destroy(&zmgr->rwlock);
free_mem:
@@ -12422,16 +12761,16 @@ dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
REQUIRE(DNS_ZONE_VALID(zone));
REQUIRE(DNS_ZONEMGR_VALID(zmgr));
+ if (zmgr->zonetasks == NULL)
+ return (ISC_R_FAILURE);
+
RWLOCK(&zmgr->rwlock, isc_rwlocktype_write);
LOCK_ZONE(zone);
REQUIRE(zone->task == NULL);
REQUIRE(zone->timer == NULL);
REQUIRE(zone->zmgr == NULL);
- isc_taskpool_gettask(zmgr->zonetasks,
- dns_name_hash(dns_zone_getorigin(zone),
- ISC_FALSE),
- &zone->task);
+ isc_taskpool_gettask(zmgr->zonetasks, &zone->task);
/*
* Set the task name. The tag will arbitrarily point to one
@@ -12524,6 +12863,7 @@ dns_zonemgr_detach(dns_zonemgr_t **zmgrp) {
if (free_now)
zonemgr_free(zmgr);
+ *zmgrp = NULL;
}
isc_result_t
@@ -12575,6 +12915,35 @@ dns_zonemgr_shutdown(dns_zonemgr_t *zmgr) {
isc_taskpool_destroy(&zmgr->zonetasks);
}
+isc_result_t
+dns_zonemgr_setsize(dns_zonemgr_t *zmgr, int num_zones) {
+ isc_result_t result;
+ int ntasks = num_zones / 100;
+ isc_taskpool_t *pool = NULL;
+
+ REQUIRE(DNS_ZONEMGR_VALID(zmgr));
+
+ /*
+ * For anything fewer than 1000 zones we use 10 tasks in
+ * the task pool. More than that, and we'll scale at one
+ * task per 100 zones.
+ */
+ if (ntasks < 10)
+ ntasks = 10;
+
+ /* Create or resize the zone task pool. */
+ if (zmgr->zonetasks == NULL)
+ result = isc_taskpool_create(zmgr->taskmgr, zmgr->mctx,
+ ntasks, 2, &pool);
+ else
+ result = isc_taskpool_expand(&zmgr->zonetasks, ntasks, &pool);
+
+ if (result == ISC_R_SUCCESS)
+ zmgr->zonetasks = pool;
+
+ return (result);
+}
+
static void
zonemgr_free(dns_zonemgr_t *zmgr) {
isc_mem_t *mctx;
@@ -13058,7 +13427,8 @@ void
dns_zone_forcereload(dns_zone_t *zone) {
REQUIRE(DNS_ZONE_VALID(zone));
- if (zone->type == dns_zone_master)
+ if (zone->type == dns_zone_master ||
+ (zone->type == dns_zone_redirect && zone->masters == NULL))
return;
LOCK_ZONE(zone);
@@ -13150,7 +13520,7 @@ dns_zone_dialup(dns_zone_t *zone) {
if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALNOTIFY))
dns_zone_notify(zone);
- if (zone->type != dns_zone_master &&
+ if (zone->type != dns_zone_master && zone->masters != NULL &&
DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH))
dns_zone_refresh(zone);
}
@@ -13588,7 +13958,8 @@ rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
*/
static isc_result_t
add_signing_records(dns_db_t *db, dns_rdatatype_t privatetype,
- dns_dbversion_t *ver, dns_diff_t *diff)
+ dns_dbversion_t *ver, dns_diff_t *diff,
+ isc_boolean_t sign_all)
{
dns_difftuple_t *tuple, *newtuple = NULL;
dns_rdata_dnskey_t dnskey;
@@ -13627,13 +13998,16 @@ add_signing_records(dns_db_t *db, dns_rdatatype_t privatetype,
rdata.type = privatetype;
rdata.rdclass = tuple->rdata.rdclass;
- CHECK(rr_exists(db, ver, name, &rdata, &flag));
- if (flag)
- continue;
- CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD,
- name, 0, &rdata, &newtuple));
- CHECK(do_one_tuple(&newtuple, db, ver, diff));
- INSIST(newtuple == NULL);
+ if (sign_all || tuple->op == DNS_DIFFOP_DEL) {
+ CHECK(rr_exists(db, ver, name, &rdata, &flag));
+ if (flag)
+ continue;
+ CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD,
+ name, 0, &rdata, &newtuple));
+ CHECK(do_one_tuple(&newtuple, db, ver, diff));
+ INSIST(newtuple == NULL);
+ }
+
/*
* Remove any record which says this operation has already
* completed.
@@ -13694,7 +14068,7 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
if (tuple == NULL) {
result = del_sigs(zone, db, ver, &zone->origin,
dns_rdatatype_dnskey, sig_diff,
- zone_keys, nkeys, now);
+ zone_keys, nkeys, now, ISC_FALSE);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
"sign_apex:del_sigs -> %s\n",
@@ -13762,8 +14136,12 @@ dnskey_sane(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
}
/* Check existing DB for NSEC-only DNSKEY */
- if (!nseconly)
- CHECK(dns_nsec_nseconly(db, ver, &nseconly));
+ if (!nseconly) {
+ result = dns_nsec_nseconly(db, ver, &nseconly);
+ if (result == ISC_R_NOTFOUND)
+ result = ISC_R_SUCCESS;
+ CHECK(result);
+ }
/* Check existing DB for NSEC3 */
if (!nsec3)
@@ -13870,6 +14248,7 @@ zone_rekey(dns_zone_t *zone) {
dns_dnsseckey_t *key;
dns_diff_t diff, sig_diff;
isc_boolean_t commit = ISC_FALSE, newactive = ISC_FALSE;
+ isc_boolean_t newalg = ISC_FALSE;
isc_boolean_t fullsign;
dns_ttl_t ttl = 3600;
const char *dir;
@@ -13892,6 +14271,7 @@ zone_rekey(dns_zone_t *zone) {
mctx = zone->mctx;
dns_diff_init(mctx, &diff);
dns_diff_init(mctx, &sig_diff);
+ sig_diff.resign = zone->sigresigninginterval;
CHECK(dns_zone_getdb(zone, &db));
CHECK(dns_db_newversion(db, &ver));
@@ -13910,14 +14290,11 @@ zone_rekey(dns_zone_t *zone) {
dns_rdatatype_none, 0, &keyset, &keysigs);
if (result == ISC_R_SUCCESS) {
ttl = keyset.ttl;
- result = dns_dnssec_keylistfromrdataset(&zone->origin, dir,
- mctx, &keyset,
- &keysigs, &soasigs,
- ISC_FALSE, ISC_FALSE,
- &dnskeys);
- /* Can't get keys for some reason; try again later. */
- if (result != ISC_R_SUCCESS)
- goto trylater;
+ CHECK(dns_dnssec_keylistfromrdataset(&zone->origin, dir,
+ mctx, &keyset,
+ &keysigs, &soasigs,
+ ISC_FALSE, ISC_FALSE,
+ &dnskeys));
} else if (result != ISC_R_NOTFOUND)
goto failure;
@@ -13943,15 +14320,37 @@ zone_rekey(dns_zone_t *zone) {
dns_zone_log(zone, ISC_LOG_ERROR, "zone_rekey:"
"couldn't update zone keys: %s",
isc_result_totext(result));
- goto trylater;
+ goto failure;
}
- /* See if any pre-existing keys have newly become active */
+ /* See if any pre-existing keys have newly become active;
+ * also, see if any new key is for a new algorithm, as in that
+ * event, we need to sign the zone fully. (If there's a new
+ * key, but it's for an already-existing algorithm, then
+ * the zone signing can be handled incrementally.)
+ */
for (key = ISC_LIST_HEAD(dnskeys);
key != NULL;
key = ISC_LIST_NEXT(key, link)) {
- if (key->first_sign) {
- newactive = ISC_TRUE;
+ if (!key->first_sign)
+ continue;
+
+ newactive = ISC_TRUE;
+
+ if (!dns_rdataset_isassociated(&keysigs)) {
+ newalg = ISC_TRUE;
+ break;
+ }
+
+ if (signed_with_alg(&keysigs, dst_key_alg(key->key))) {
+ /*
+ * This isn't a new algorithm; clear
+ * first_sign so we won't sign the
+ * whole zone with this key later
+ */
+ key->first_sign = ISC_FALSE;
+ } else {
+ newalg = ISC_TRUE;
break;
}
}
@@ -13960,9 +14359,11 @@ zone_rekey(dns_zone_t *zone) {
dnskey_sane(zone, db, ver, &diff)) {
CHECK(dns_diff_apply(&diff, db, ver));
CHECK(clean_nsec3param(zone, db, ver, &diff));
- CHECK(add_signing_records(db, zone->privatetype, ver,
- &diff));
- CHECK(increment_soa_serial(db, ver, &diff, mctx));
+ CHECK(add_signing_records(db, zone->privatetype,
+ ver, &diff,
+ ISC_TF(newalg || fullsign)));
+ CHECK(update_soa_serial(db, ver, &diff, mctx,
+ zone->updatemethod));
CHECK(add_chains(zone, db, ver, &diff));
CHECK(sign_apex(zone, db, ver, &diff, &sig_diff));
CHECK(zone_journal(zone, &sig_diff, "zone_rekey"));
@@ -13975,8 +14376,6 @@ zone_rekey(dns_zone_t *zone) {
if (commit) {
isc_time_t timenow;
dns_difftuple_t *tuple;
- isc_boolean_t newkey = ISC_FALSE;
- isc_boolean_t newalg = ISC_FALSE;
LOCK_ZONE(zone);
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
@@ -13986,43 +14385,6 @@ zone_rekey(dns_zone_t *zone) {
TIME_NOW(&timenow);
zone_settimer(zone, &timenow);
- /*
- * Has a new key become active? If so, is it for
- * a new algorithm?
- */
- for (tuple = ISC_LIST_HEAD(sig_diff.tuples);
- tuple != NULL;
- tuple = ISC_LIST_NEXT(tuple, link)) {
- dns_rdata_dnskey_t dnskey;
-
- if (tuple->rdata.type != dns_rdatatype_dnskey)
- continue;
-
- newkey = ISC_TRUE;
- if (!dns_rdataset_isassociated(&keysigs)) {
- newalg = ISC_TRUE;
- break;
- }
-
- result = dns_rdata_tostruct(&tuple->rdata,
- &dnskey, NULL);
- RUNTIME_CHECK(result == ISC_R_SUCCESS);
- if (!signed_with_alg(&keysigs,
- dnskey.algorithm)) {
- newalg = ISC_TRUE;
- break;
- }
- }
-
- /*
- * If we found a new algorithm, we need to sign the
- * zone fully. If there's a new key, but it's for an
- * already-existing algorithm, then the zone signing
- * can be handled incrementally.
- */
- if (newkey && !newalg)
- set_resigntime(zone);
-
/* Remove any signatures from removed keys. */
if (!ISC_LIST_EMPTY(rmkeys)) {
for (key = ISC_LIST_HEAD(rmkeys);
@@ -14040,7 +14402,6 @@ zone_rekey(dns_zone_t *zone) {
}
}
-
if (fullsign) {
/*
* "rndc sign" was called, so we now sign the zone
@@ -14066,30 +14427,19 @@ zone_rekey(dns_zone_t *zone) {
/*
* We haven't been told to sign fully, but a new
* algorithm was added to the DNSKEY. We sign
- * the full zone, but only with the newly-added
+ * the full zone, but only with newly active
* keys.
*/
- for (tuple = ISC_LIST_HEAD(sig_diff.tuples);
- tuple != NULL;
- tuple = ISC_LIST_NEXT(tuple, link)) {
- dns_rdata_dnskey_t dnskey;
- dns_secalg_t algorithm;
- isc_region_t r;
- isc_uint16_t keyid;
-
- if (tuple->rdata.type != dns_rdatatype_dnskey ||
- tuple->op == DNS_DIFFOP_DEL)
+ for (key = ISC_LIST_HEAD(dnskeys);
+ key != NULL;
+ key = ISC_LIST_NEXT(key, link)) {
+ if (!key->first_sign)
continue;
- result = dns_rdata_tostruct(&tuple->rdata,
- &dnskey, NULL);
- RUNTIME_CHECK(result == ISC_R_SUCCESS);
- dns_rdata_toregion(&tuple->rdata, &r);
- algorithm = dnskey.algorithm;
- keyid = dst_region_computeid(&r, algorithm);
-
- result = zone_signwithkey(zone, algorithm,
- keyid, ISC_FALSE);
+ result = zone_signwithkey(zone,
+ dst_key_alg(key->key),
+ dst_key_id(key->key),
+ ISC_FALSE);
if (result != ISC_R_SUCCESS) {
dns_zone_log(zone, ISC_LOG_ERROR,
"zone_signwithkey failed: %s",
@@ -14134,53 +14484,69 @@ zone_rekey(dns_zone_t *zone) {
dns_result_totext(result));
}
}
+
+ /*
+ * Activate any NSEC3 chain updates that may have
+ * been scheduled before this rekey.
+ */
+ if (fullsign || newalg)
+ resume_addnsec3chain(zone);
+
+ /*
+ * Schedule the next resigning event
+ */
+ set_resigntime(zone);
UNLOCK_ZONE(zone);
}
+ /*
+ * If we are doing automatic key maintenance and the key metadata
+ * indicates there is a key change event scheduled in the future,
+ * set the key refresh timer.
+ */
isc_stdtime_get(&now);
TIME_NOW(&timenow);
isc_time_settoepoch(&zone->refreshkeytime);
- for (key = ISC_LIST_HEAD(dnskeys);
- key != NULL;
- key = ISC_LIST_NEXT(key, link)) {
- isc_stdtime_t then;
+
+ /*
+ * If we're doing key maintenance, set the key refresh timer to
+ * the next scheduled key event or to 'dnssec-loadkeys-interval'
+ * seconds in the future, whichever is sooner.
+ */
+ if (DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN)) {
isc_time_t timethen;
+ isc_stdtime_t then;
- /*
- * If we are doing automatic key maintenance and the
- * key metadata indicates there is a key change event
- * scheduled in the future, set the key refresh timer.
- */
- if (!DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN))
- break;
+ LOCK_ZONE(zone);
+ DNS_ZONE_TIME_ADD(&timenow, zone->refreshkeyinterval,
+ &timethen);
+ zone->refreshkeytime = timethen;
+ UNLOCK_ZONE(zone);
- then = now;
- result = next_keyevent(key->key, &then);
- if (result != ISC_R_SUCCESS)
- continue;
+ for (key = ISC_LIST_HEAD(dnskeys);
+ key != NULL;
+ key = ISC_LIST_NEXT(key, link)) {
+ then = now;
+ result = next_keyevent(key->key, &then);
+ if (result != ISC_R_SUCCESS)
+ continue;
- DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
- LOCK_ZONE(zone);
- if (isc_time_isepoch(&zone->refreshkeytime) ||
- isc_time_compare(&timethen, &zone->refreshkeytime) < 0) {
- zone->refreshkeytime = timethen;
- zone_settimer(zone, &timenow);
+ DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
+ LOCK_ZONE(zone);
+ if (isc_time_compare(&timethen,
+ &zone->refreshkeytime) < 0) {
+ zone->refreshkeytime = timethen;
+ }
+ UNLOCK_ZONE(zone);
}
- UNLOCK_ZONE(zone);
- }
- /*
- * If no key event is scheduled, we should still check the key
- * repository for updates every so often. (Currently this is
- * hard-coded to 12 hours, but it could be configurable.)
- */
- if (isc_time_isepoch(&zone->refreshkeytime))
- DNS_ZONE_TIME_ADD(&timenow, (3600 * 12), &zone->refreshkeytime);
+ zone_settimer(zone, &timenow);
- isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
- dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf);
+ isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
+ dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf);
+ }
- failure:
+ done:
dns_diff_clear(&diff);
dns_diff_clear(&sig_diff);
@@ -14202,10 +14568,14 @@ zone_rekey(dns_zone_t *zone) {
dns_db_detach(&db);
return;
- trylater:
- isc_interval_set(&ival, HOUR, 0);
+ failure:
+ /*
+ * Something went wrong; try again in ten minutes or
+ * after a key refresh interval, whichever is shorter.
+ */
+ isc_interval_set(&ival, ISC_MIN(zone->refreshkeyinterval, 600), 0);
isc_time_nowplusinterval(&zone->refreshkeytime, &ival);
- goto failure;
+ goto done;
}
void
@@ -14271,3 +14641,28 @@ dns_zone_dlzpostload(dns_zone_t *zone, dns_db_t *db)
UNLOCK_ZONE(zone);
return result;
}
+
+isc_result_t
+dns_zone_setrefreshkeyinterval(dns_zone_t *zone, isc_uint32_t interval) {
+ REQUIRE(DNS_ZONE_VALID(zone));
+ if (interval == 0)
+ return (ISC_R_RANGE);
+ /* Maximum value: 24 hours (3600 minutes) */
+ if (interval > (24 * 60))
+ interval = (24 * 60);
+ /* Multiply by 60 for seconds */
+ zone->refreshkeyinterval = interval * 60;
+ return (ISC_R_SUCCESS);
+}
+
+void
+dns_zone_setserialupdatemethod(dns_zone_t *zone, dns_updatemethod_t method) {
+ REQUIRE(DNS_ZONE_VALID(zone));
+ zone->updatemethod = method;
+}
+
+dns_updatemethod_t
+dns_zone_getserialupdatemethod(dns_zone_t *zone) {
+ REQUIRE(DNS_ZONE_VALID(zone));
+ return(zone->updatemethod);
+}
diff --git a/external/bsd/bind/dist/lib/dns/zt.c b/external/bsd/bind/dist/lib/dns/zt.c
index 9f1dfe8b4b6..9b92ae8361a 100644
--- a/external/bsd/bind/dist/lib/dns/zt.c
+++ b/external/bsd/bind/dist/lib/dns/zt.c
@@ -1,7 +1,7 @@
-/* $NetBSD: zt.c,v 1.2 2011/02/16 03:47:05 christos Exp $ */
+/* $NetBSD: zt.c,v 1.3 2011/09/11 18:55:38 christos Exp $ */
/*
- * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: zt.c,v 1.47 2007-06-19 23:47:16 tbox Exp */
+/* Id: zt.c,v 1.50 2011-03-21 23:47:21 tbox Exp */
/*! \file */
@@ -294,13 +294,14 @@ freezezones(dns_zone_t *zone, void *uap) {
char classstr[DNS_RDATACLASS_FORMATSIZE];
char zonename[DNS_NAME_FORMATSIZE];
dns_view_t *view;
- char *journal;
const char *vname;
const char *sep;
int level;
if (dns_zone_gettype(zone) != dns_zone_master)
return (ISC_R_SUCCESS);
+ if (!dns_zone_isdynamic(zone, ISC_TRUE))
+ return (ISC_R_SUCCESS);
frozen = dns_zone_getupdatedisabled(zone);
if (freeze) {
@@ -308,11 +309,6 @@ freezezones(dns_zone_t *zone, void *uap) {
result = DNS_R_FROZEN;
if (result == ISC_R_SUCCESS)
result = dns_zone_flush(zone);
- if (result == ISC_R_SUCCESS) {
- journal = dns_zone_getjournal(zone);
- if (journal != NULL)
- (void)isc_file_remove(journal);
- }
} else {
if (frozen) {
result = dns_zone_load(zone);
diff --git a/external/bsd/bind/dist/lib/export/samples/nsprobe.c b/external/bsd/bind/dist/lib/export/samples/nsprobe.c
index 85c1239e439..b06ca199a7e 100644
--- a/external/bsd/bind/dist/lib/export/samples/nsprobe.c
+++ b/external/bsd/bind/dist/lib/export/samples/nsprobe.c
@@ -1,7 +1,7 @@
-/* $NetBSD: nsprobe.c,v 1.2 2011/02/16 03:47:10 christos Exp $ */
+/* $NetBSD: nsprobe.c,v 1.3 2011/09/11 18:55:40 christos Exp $ */
/*
- * Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: nsprobe.c,v 1.7 2010-01-07 23:48:54 tbox Exp */
+/* Id: nsprobe.c,v 1.10 2011-04-05 06:33:50 marka Exp */
#include <config.h>
@@ -789,6 +789,7 @@ resolve_nsaddress(isc_task_t *task, isc_event_t *event) {
fprintf(stderr, "resolve_nsaddress: "
"mem_get failed");
result = ISC_R_NOMEMORY;
+ POST(result);
goto cleanup;
}
isc_sockaddr_fromin(&server->address,
@@ -925,6 +926,7 @@ resolve_ns(isc_task_t *task, isc_event_t *event) {
fprintf(stderr,
"resolve_ns: mem_get failed");
result = ISC_R_NOMEMORY;
+ POST(result);
/*
* XXX: should we continue with the
* available servers anyway?
@@ -1099,8 +1101,8 @@ main(int argc, char *argv[]) {
if (res->ai_addrlen > sizeof(sa.type)) {
fprintf(stderr,
- "assumption failure: addrlen is too long: %d\n",
- res->ai_addrlen);
+ "assumption failure: addrlen is too long: %ld\n",
+ (long)res->ai_addrlen);
exit(1);
}
memcpy(&sa.type.sa, res->ai_addr, res->ai_addrlen);
diff --git a/external/bsd/bind/dist/lib/irs/getnameinfo.c b/external/bsd/bind/dist/lib/irs/getnameinfo.c
index d465dfc3d28..5d444b2a661 100644
--- a/external/bsd/bind/dist/lib/irs/getnameinfo.c
+++ b/external/bsd/bind/dist/lib/irs/getnameinfo.c
@@ -1,7 +1,7 @@
-/* $NetBSD: getnameinfo.c,v 1.2 2011/02/16 03:47:10 christos Exp $ */
+/* $NetBSD: getnameinfo.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: getnameinfo.c,v 1.4 2009-09-02 23:48:02 tbox Exp */
+/* Id: getnameinfo.c,v 1.6 2011-03-12 04:59:48 tbox Exp */
/*! \file */
@@ -151,12 +151,12 @@ getnameinfo(const struct sockaddr *sa, socklen_t salen, char *host,
{
struct afd *afd;
struct servent *sp;
- unsigned short port;
+ unsigned short port = 0;
#ifdef IRS_PLATFORM_HAVESALEN
size_t len;
#endif
int family, i;
- const void *addr;
+ const void *addr = NULL;
char *p;
#if 0
unsigned long v4a;
@@ -201,8 +201,6 @@ getnameinfo(const struct sockaddr *sa, socklen_t salen, char *host,
break;
default:
- port = 0;
- addr = NULL;
INSIST(0);
}
proto = (flags & NI_DGRAM) ? "udp" : "tcp";
diff --git a/external/bsd/bind/dist/lib/irs/resconf.c b/external/bsd/bind/dist/lib/irs/resconf.c
index bc91fe4e40c..7c545dd903a 100644
--- a/external/bsd/bind/dist/lib/irs/resconf.c
+++ b/external/bsd/bind/dist/lib/irs/resconf.c
@@ -1,7 +1,7 @@
-/* $NetBSD: resconf.c,v 1.2 2011/02/16 03:47:10 christos Exp $ */
+/* $NetBSD: resconf.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: resconf.c,v 1.3 2009-09-02 23:48:02 tbox Exp */
+/* Id: resconf.c,v 1.5 2011-03-12 04:59:48 tbox Exp */
/*! \file resconf.c */
@@ -519,6 +519,7 @@ irs_resconf_load(isc_mem_t *mctx, const char *filename, irs_resconf_t **confp)
stopchar = getword(fp, word, sizeof(word));
if (stopchar == EOF) {
rval = ISC_R_SUCCESS;
+ POST(rval);
break;
}
diff --git a/external/bsd/bind/dist/lib/isc/heap.c b/external/bsd/bind/dist/lib/isc/heap.c
index 048084edf33..a54cb413ba5 100644
--- a/external/bsd/bind/dist/lib/isc/heap.c
+++ b/external/bsd/bind/dist/lib/isc/heap.c
@@ -1,7 +1,7 @@
-/* $NetBSD: heap.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: heap.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1997-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: heap.c,v 1.39 2010-02-04 23:49:13 tbox Exp */
+/* Id: heap.c,v 1.41 2011-03-03 23:47:32 tbox Exp */
/*! \file
* Heap implementation of priority queues adapted from the following:
@@ -88,8 +88,9 @@ isc_heap_create(isc_mem_t *mctx, isc_heapcompare_t compare,
if (heap == NULL)
return (ISC_R_NOMEMORY);
heap->magic = HEAP_MAGIC;
- heap->mctx = mctx;
heap->size = 0;
+ heap->mctx = NULL;
+ isc_mem_attach(mctx, &heap->mctx);
if (size_increment == 0)
heap->size_increment = SIZE_INCREMENT;
else
@@ -116,7 +117,7 @@ isc_heap_destroy(isc_heap_t **heapp) {
isc_mem_put(heap->mctx, heap->array,
heap->size * sizeof(void *));
heap->magic = 0;
- isc_mem_put(heap->mctx, heap, sizeof(*heap));
+ isc_mem_putanddetach(&heap->mctx, heap, sizeof(*heap));
*heapp = NULL;
}
diff --git a/external/bsd/bind/dist/lib/isc/httpd.c b/external/bsd/bind/dist/lib/isc/httpd.c
index 89f0d4b2cac..2cacb3904c6 100644
--- a/external/bsd/bind/dist/lib/isc/httpd.c
+++ b/external/bsd/bind/dist/lib/isc/httpd.c
@@ -1,7 +1,7 @@
-/* $NetBSD: httpd.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: httpd.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2006-2008, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006-2008, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: httpd.c,v 1.20 2010-11-16 05:38:31 marka Exp */
+/* Id: httpd.c,v 1.23 2011-03-11 06:11:25 marka Exp */
/*! \file */
@@ -317,7 +317,7 @@ isc_httpdmgr_create(isc_mem_t *mctx, isc_socket_t *sock, isc_task_t *task,
isc_task_detach(&httpd->task);
isc_socket_detach(&httpd->sock);
isc_mem_detach(&httpd->mctx);
- isc_mutex_destroy(&httpd->lock);
+ (void)isc_mutex_destroy(&httpd->lock);
isc_mem_put(mctx, httpd, sizeof(isc_httpdmgr_t));
return (result);
}
@@ -366,7 +366,7 @@ httpdmgr_destroy(isc_httpdmgr_t *httpdmgr)
}
UNLOCK(&httpdmgr->lock);
- isc_mutex_destroy(&httpdmgr->lock);
+ (void)isc_mutex_destroy(&httpdmgr->lock);
if (httpdmgr->ondestroy != NULL)
(httpdmgr->ondestroy)(httpdmgr->cb_arg);
@@ -588,6 +588,8 @@ isc_httpd_accept(isc_task_t *task, isc_event_t *ev)
r.length = HTTP_RECVLEN - 1;
result = isc_socket_recv(httpd->sock, &r, 1, task, isc_httpd_recvdone,
httpd);
+ /* FIXME!!! */
+ POST(result);
NOTICE("accept queued recv on socket");
requeue:
@@ -685,8 +687,9 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
}
r.base = (unsigned char *)httpd->recvbuf + httpd->recvlen;
r.length = HTTP_RECVLEN - httpd->recvlen - 1;
- result = isc_socket_recv(httpd->sock, &r, 1, task,
- isc_httpd_recvdone, httpd);
+ /* check return code? */
+ (void)isc_socket_recv(httpd->sock, &r, 1, task,
+ isc_httpd_recvdone, httpd);
goto out;
} else if (result != ISC_R_SUCCESS) {
destroy_client(&httpd);
@@ -724,14 +727,14 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
&httpd->mimetype, &httpd->bodybuffer,
&httpd->freecb, &httpd->freecb_arg);
if (result != ISC_R_SUCCESS) {
- result = httpd->mgr->render_500(httpd->url, httpd->querystring,
- NULL,
- &httpd->retcode,
- &httpd->retmsg,
- &httpd->mimetype,
- &httpd->bodybuffer,
- &httpd->freecb,
- &httpd->freecb_arg);
+ result = httpd->mgr->render_500(httpd->url, httpd->querystring,
+ NULL, &httpd->retcode,
+ &httpd->retmsg,
+ &httpd->mimetype,
+ &httpd->bodybuffer,
+ &httpd->freecb,
+ &httpd->freecb_arg);
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
}
isc_httpd_response(httpd);
@@ -755,8 +758,9 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
if (isc_buffer_length(&httpd->bodybuffer) > 0)
ISC_LIST_APPEND(httpd->bufflist, &httpd->bodybuffer, link);
- result = isc_socket_sendv(httpd->sock, &httpd->bufflist, task,
- isc_httpd_senddone, httpd);
+ /* check return code? */
+ (void)isc_socket_sendv(httpd->sock, &httpd->bufflist, task,
+ isc_httpd_senddone, httpd);
out:
isc_event_free(&ev);
@@ -823,7 +827,7 @@ isc_httpd_response(isc_httpd_t *httpd)
needlen += 3 + 1; /* room for response code, always 3 bytes */
needlen += strlen(httpd->retmsg) + 2; /* return msg + CRLF */
- if (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
+ while (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
result = grow_headerspace(httpd);
if (result != ISC_R_SUCCESS)
return (result);
@@ -848,7 +852,7 @@ isc_httpd_addheader(isc_httpd_t *httpd, const char *name,
needlen += 2 + strlen(val); /* :<space> and val */
needlen += 2; /* CRLF */
- if (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
+ while (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
result = grow_headerspace(httpd);
if (result != ISC_R_SUCCESS)
return (result);
@@ -871,7 +875,7 @@ isc_httpd_endheaders(isc_httpd_t *httpd)
{
isc_result_t result;
- if (isc_buffer_availablelength(&httpd->headerbuffer) < 2) {
+ while (isc_buffer_availablelength(&httpd->headerbuffer) < 2) {
result = grow_headerspace(httpd);
if (result != ISC_R_SUCCESS)
return (result);
@@ -895,7 +899,7 @@ isc_httpd_addheaderuint(isc_httpd_t *httpd, const char *name, int val) {
needlen += 2 + strlen(buf); /* :<space> and val */
needlen += 2; /* CRLF */
- if (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
+ while (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
result = grow_headerspace(httpd);
if (result != ISC_R_SUCCESS)
return (result);
@@ -914,7 +918,6 @@ isc_httpd_senddone(isc_task_t *task, isc_event_t *ev)
{
isc_httpd_t *httpd = ev->ev_arg;
isc_region_t r;
- isc_result_t result;
isc_socketevent_t *sev = (isc_socketevent_t *)ev;
ENTER("senddone");
@@ -965,8 +968,9 @@ isc_httpd_senddone(isc_task_t *task, isc_event_t *ev)
r.base = (unsigned char *)httpd->recvbuf;
r.length = HTTP_RECVLEN - 1;
- result = isc_socket_recv(httpd->sock, &r, 1, task, isc_httpd_recvdone,
- httpd);
+ /* check return code? */
+ (void)isc_socket_recv(httpd->sock, &r, 1, task,
+ isc_httpd_recvdone, httpd);
out:
isc_event_free(&ev);
diff --git a/external/bsd/bind/dist/lib/isc/include/isc/file.h b/external/bsd/bind/dist/lib/isc/include/isc/file.h
index 475774e7c30..a261b6a3ba5 100644
--- a/external/bsd/bind/dist/lib/isc/include/isc/file.h
+++ b/external/bsd/bind/dist/lib/isc/include/isc/file.h
@@ -1,4 +1,4 @@
-/* $NetBSD: file.h,v 1.2 2011/02/16 03:47:12 christos Exp $ */
+/* $NetBSD: file.h,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
* Copyright (C) 2004-2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: file.h,v 1.39 2011-01-11 23:47:14 tbox Exp */
+/* Id: file.h,v 1.41 2011-03-04 23:47:47 tbox Exp */
#ifndef ISC_FILE_H
#define ISC_FILE_H 1
@@ -187,6 +187,27 @@ isc_file_isabsolute(const char *filename);
* \brief Return #ISC_TRUE if the given file name is absolute.
*/
+isc_result_t
+isc_file_isplainfile(const char *name);
+/*!<
+ * \brief Check that the file is a plain file
+ *
+ * Returns:
+ *\li #ISC_R_SUCCESS
+ * Success. The file is a plain file.
+ *\li #ISC_R_INVALIDFILE
+ * The path specified was not usable by the operating system.
+ *\li #ISC_R_FILENOTFOUND
+ * The file does not exist. This return code comes from
+ * errno=ENOENT when stat returns -1. This code is mentioned
+ * here, because in logconf.c, it is the one rcode that is
+ * permitted in addition to ISC_R_SUCCESS. This is done since
+ * the next call in logconf.c is to isc_stdio_open(), which
+ * will create the file if it can.
+ *\li #other ISC_R_* errors translated from errno
+ * These occur when stat returns -1 and an errno.
+ */
+
isc_boolean_t
isc_file_iscurrentdir(const char *filename);
/*!<
diff --git a/external/bsd/bind/dist/lib/isc/include/isc/mem.h b/external/bsd/bind/dist/lib/isc/include/isc/mem.h
index 5fae0e40db3..211199cd6cb 100644
--- a/external/bsd/bind/dist/lib/isc/include/isc/mem.h
+++ b/external/bsd/bind/dist/lib/isc/include/isc/mem.h
@@ -1,7 +1,7 @@
-/* $NetBSD: mem.h,v 1.6 2011/02/16 03:47:12 christos Exp $ */
+/* $NetBSD: mem.h,v 1.7 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1997-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: mem.h,v 1.89 2010-08-11 22:54:58 jinmei Exp */
+/* Id: mem.h,v 1.91 2011-08-09 23:46:39 tbox Exp */
#ifndef ISC_MEM_H
#define ISC_MEM_H 1
@@ -336,7 +336,7 @@ isc_mem_createx2(size_t max_size, size_t target_size,
* ISC_MEMFLAG_INTERNAL is not set, 'target_size' is ignored.
*
* 'max_size' is also used to size the statistics arrays and the array
- * used to record active memory when ISC_MEM_DEBUGRECORD is set. Settin
+ * used to record active memory when ISC_MEM_DEBUGRECORD is set. Setting
* 'max_size' too low can have detrimental effects on performance.
*
* A memory context created using isc_mem_createx() will obtain
diff --git a/external/bsd/bind/dist/lib/isc/include/isc/namespace.h b/external/bsd/bind/dist/lib/isc/include/isc/namespace.h
index 469919094f0..c59bd68853f 100644
--- a/external/bsd/bind/dist/lib/isc/include/isc/namespace.h
+++ b/external/bsd/bind/dist/lib/isc/include/isc/namespace.h
@@ -1,7 +1,7 @@
-/* $NetBSD: namespace.h,v 1.2 2011/02/16 03:47:12 christos Exp $ */
+/* $NetBSD: namespace.h,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: namespace.h,v 1.9 2010-12-04 13:25:59 marka Exp */
+/* Id: namespace.h,v 1.12 2011-08-23 17:02:53 each Exp */
#ifndef ISCAPI_NAMESPACE_H
#define ISCAPI_NAMESPACE_H 1
@@ -90,6 +90,7 @@
#define isc_mempool_getfillcount isc__mempool_getfillcount
#define isc_socket_create isc__socket_create
+#define isc_socket_dup isc__socket_dup
#define isc_socket_attach isc__socket_attach
#define isc_socket_detach isc__socket_detach
#define isc_socketmgr_create isc__socketmgr_create
@@ -112,6 +113,7 @@
#define isc_socket_listen isc__socket_listen
#define isc_socket_accept isc__socket_accept
#define isc_socket_connect isc__socket_connect
+#define isc_socket_getfd isc__socket_getfd
#define isc_socket_getname isc__socket_getname
#define isc_socket_gettag isc__socket_gettag
#define isc_socket_getpeername isc__socket_getpeername
diff --git a/external/bsd/bind/dist/lib/isc/include/isc/socket.h b/external/bsd/bind/dist/lib/isc/include/isc/socket.h
index 2c5f3a4f4cb..fa60782de21 100644
--- a/external/bsd/bind/dist/lib/isc/include/isc/socket.h
+++ b/external/bsd/bind/dist/lib/isc/include/isc/socket.h
@@ -1,7 +1,7 @@
-/* $NetBSD: socket.h,v 1.2 2011/02/16 03:47:12 christos Exp $ */
+/* $NetBSD: socket.h,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: socket.h,v 1.94 2009-10-01 01:30:01 sar Exp */
+/* Id: socket.h,v 1.98 2011-08-24 23:17:52 marka Exp */
#ifndef ISC_SOCKET_H
#define ISC_SOCKET_H 1
@@ -298,6 +298,9 @@ typedef struct isc_socketmethods {
isc_sockettype_t (*gettype)(isc_socket_t *sock);
void (*ipv6only)(isc_socket_t *sock, isc_boolean_t yes);
isc_result_t (*fdwatchpoke)(isc_socket_t *sock, int flags);
+ isc_result_t (*dup)(isc_socket_t *socket,
+ isc_socket_t **socketp);
+ int (*getfd)(isc_socket_t *socket);
} isc_socketmethods_t;
/*%
@@ -451,6 +454,12 @@ isc_socket_create(isc_socketmgr_t *manager,
*\li #ISC_R_UNEXPECTED
*/
+isc_result_t
+isc_socket_dup(isc_socket_t *sock0, isc_socket_t **socketp);
+/*%<
+ * Duplicate an existing socket, reusing its file descriptor.
+ */
+
void
isc_socket_cancel(isc_socket_t *sock, isc_task_t *task,
unsigned int how);
@@ -1104,6 +1113,11 @@ void *isc_socket_gettag(isc_socket_t *socket);
* Get the tag associated with a socket, if any.
*/
+int isc_socket_getfd(isc_socket_t *socket);
+/*%<
+ * Get the file descriptor associated with a socket
+ */
+
void
isc__socketmgr_setreserved(isc_socketmgr_t *mgr, isc_uint32_t);
/*%<
diff --git a/external/bsd/bind/dist/lib/isc/include/isc/task.h b/external/bsd/bind/dist/lib/isc/include/isc/task.h
index 6b9693697ed..78ec8f236ec 100644
--- a/external/bsd/bind/dist/lib/isc/include/isc/task.h
+++ b/external/bsd/bind/dist/lib/isc/include/isc/task.h
@@ -1,4 +1,4 @@
-/* $NetBSD: task.h,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: task.h,v 1.4 2011/09/11 18:55:41 christos Exp $ */
/*
* Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: task.h,v 1.69.14.1.2.1 2011-06-02 23:47:36 tbox Exp */
+/* Id: task.h,v 1.71 2011-02-03 12:18:12 tbox Exp */
#ifndef ISC_TASK_H
#define ISC_TASK_H 1
diff --git a/external/bsd/bind/dist/lib/isc/include/isc/taskpool.h b/external/bsd/bind/dist/lib/isc/include/isc/taskpool.h
index 6a9e70482b3..063dd8110a6 100644
--- a/external/bsd/bind/dist/lib/isc/include/isc/taskpool.h
+++ b/external/bsd/bind/dist/lib/isc/include/isc/taskpool.h
@@ -1,7 +1,7 @@
-/* $NetBSD: taskpool.h,v 1.2 2011/02/16 03:47:13 christos Exp $ */
+/* $NetBSD: taskpool.h,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: taskpool.h,v 1.15 2007-06-19 23:47:18 tbox Exp */
+/* Id: taskpool.h,v 1.17 2011-07-07 23:47:50 tbox Exp */
#ifndef ISC_TASKPOOL_H
#define ISC_TASKPOOL_H 1
@@ -85,11 +85,50 @@ isc_taskpool_create(isc_taskmgr_t *tmgr, isc_mem_t *mctx,
*\li #ISC_R_UNEXPECTED
*/
-void
-isc_taskpool_gettask(isc_taskpool_t *pool, unsigned int hash,
- isc_task_t **targetp);
+void
+isc_taskpool_gettask(isc_taskpool_t *pool, isc_task_t **targetp);
+/*%<
+ * Attach to a task from the pool. Currently the next task is chosen
+ * from the pool at random. (This may be changed in the future to
+ * something that guaratees balance.)
+ */
+
+int
+isc_taskpool_size(isc_taskpool_t *pool);
+/*%<
+ * Returns the number of tasks in the task pool 'pool'.
+ */
+
+isc_result_t
+isc_taskpool_expand(isc_taskpool_t **sourcep, unsigned int size,
+ isc_taskpool_t **targetp);
+
/*%<
- * Attach to the task corresponding to the hash value "hash".
+ * If 'size' is larger than the number of tasks in the pool pointed to by
+ * 'sourcep', then a new taskpool of size 'size' is allocated, the existing
+ * tasks from are moved into it, additional tasks are created to bring the
+ * total number up to 'size', and the resulting pool is attached to
+ * 'targetp'.
+ *
+ * If 'size' is less than or equal to the tasks in pool 'source', then
+ * 'sourcep' is attached to 'targetp' without any other action being taken.
+ *
+ * In either case, 'sourcep' is detached.
+ *
+ * Requires:
+ *
+ * \li 'sourcep' is not NULL and '*source' is not NULL
+ * \li 'targetp' is not NULL and '*source' is NULL
+ *
+ * Ensures:
+ *
+ * \li On success, '*targetp' points to a valid task pool.
+ * \li On success, '*sourcep' points to NULL.
+ *
+ * Returns:
+ *
+ * \li #ISC_R_SUCCESS
+ * \li #ISC_R_NOMEMORY
*/
void
diff --git a/external/bsd/bind/dist/lib/isc/include/isc/util.h b/external/bsd/bind/dist/lib/isc/include/isc/util.h
index 597575463e0..03ee9034b31 100644
--- a/external/bsd/bind/dist/lib/isc/include/isc/util.h
+++ b/external/bsd/bind/dist/lib/isc/include/isc/util.h
@@ -1,7 +1,7 @@
-/* $NetBSD: util.h,v 1.4 2011/02/16 03:47:13 christos Exp $ */
+/* $NetBSD: util.h,v 1.5 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: util.h,v 1.32 2010-01-11 23:48:37 tbox Exp */
+/* Id: util.h,v 1.34 2011-03-12 04:59:49 tbox Exp */
#ifndef ISC_UTIL_H
#define ISC_UTIL_H 1
@@ -50,6 +50,11 @@
*/
#define UNUSED(x) (void)&(x)
+/*%
+ * The opposite: silent warnings about stored values which are never read.
+ */
+#define POST(x) (void)(x)
+
#define ISC_MAX(a, b) ((a) > (b) ? (a) : (b))
#define ISC_MIN(a, b) ((a) < (b) ? (a) : (b))
diff --git a/external/bsd/bind/dist/lib/isc/log.c b/external/bsd/bind/dist/lib/isc/log.c
index e427829fab9..0c317dd8ea7 100644
--- a/external/bsd/bind/dist/lib/isc/log.c
+++ b/external/bsd/bind/dist/lib/isc/log.c
@@ -1,7 +1,7 @@
-/* $NetBSD: log.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: log.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: log.c,v 1.99 2009-02-16 02:01:16 marka Exp */
+/* Id: log.c,v 1.101 2011-03-12 04:59:48 tbox Exp */
/*! \file
* \author Principal Authors: DCL */
@@ -1344,9 +1344,10 @@ isc_log_open(isc_logchannel_t *channel) {
(FILE_MAXSIZE(channel) > 0 &&
statbuf.st_size >= FILE_MAXSIZE(channel)))
roll = regular_file;
- } else if (errno == ENOENT)
+ } else if (errno == ENOENT) {
regular_file = ISC_TRUE;
- else
+ POST(regular_file);
+ } else
result = ISC_R_INVALIDFILE;
/*
diff --git a/external/bsd/bind/dist/lib/isc/netaddr.c b/external/bsd/bind/dist/lib/isc/netaddr.c
index 0c02542904a..d16e1711fdd 100644
--- a/external/bsd/bind/dist/lib/isc/netaddr.c
+++ b/external/bsd/bind/dist/lib/isc/netaddr.c
@@ -1,7 +1,7 @@
-/* $NetBSD: netaddr.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: netaddr.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: netaddr.c,v 1.41 2010-11-17 23:47:08 tbox Exp */
+/* Id: netaddr.c,v 1.44 2011-03-11 06:11:26 marka Exp */
/*! \file */
@@ -71,10 +71,10 @@ isc_boolean_t
isc_netaddr_eqprefix(const isc_netaddr_t *a, const isc_netaddr_t *b,
unsigned int prefixlen)
{
- const unsigned char *pa, *pb;
- unsigned int ipabytes; /* Length of whole IP address in bytes */
- unsigned int nbytes; /* Number of significant whole bytes */
- unsigned int nbits; /* Number of significant leftover bits */
+ const unsigned char *pa = NULL, *pb = NULL;
+ unsigned int ipabytes = 0; /* Length of whole IP address in bytes */
+ unsigned int nbytes; /* Number of significant whole bytes */
+ unsigned int nbits; /* Number of significant leftover bits */
REQUIRE(a != NULL && b != NULL);
@@ -96,8 +96,6 @@ isc_netaddr_eqprefix(const isc_netaddr_t *a, const isc_netaddr_t *b,
ipabytes = 16;
break;
default:
- pa = pb = NULL; /* Avoid silly compiler warning. */
- ipabytes = 0; /* Ditto. */
return (ISC_FALSE);
}
@@ -190,6 +188,9 @@ isc_netaddr_format(const isc_netaddr_t *na, char *array, unsigned int size) {
isc_buffer_init(&buf, array, size);
result = isc_netaddr_totext(na, &buf);
+ if (size == 0)
+ return;
+
/*
* Null terminate.
*/
@@ -214,7 +215,7 @@ isc_netaddr_format(const isc_netaddr_t *na, char *array, unsigned int size) {
isc_result_t
isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen) {
static const unsigned char zeros[16];
- unsigned int nbits, nbytes, ipbytes;
+ unsigned int nbits, nbytes, ipbytes = 0;
const unsigned char *p;
switch (na->family) {
@@ -231,7 +232,6 @@ isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen) {
return (ISC_R_RANGE);
break;
default:
- ipbytes = 0;
return (ISC_R_NOTIMPLEMENTED);
}
nbytes = prefixlen / 8;
@@ -248,7 +248,7 @@ isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen) {
isc_result_t
isc_netaddr_masktoprefixlen(const isc_netaddr_t *s, unsigned int *lenp) {
- unsigned int nbits, nbytes, ipbytes, i;
+ unsigned int nbits = 0, nbytes = 0, ipbytes = 0, i;
const unsigned char *p;
switch (s->family) {
@@ -261,10 +261,8 @@ isc_netaddr_masktoprefixlen(const isc_netaddr_t *s, unsigned int *lenp) {
ipbytes = 16;
break;
default:
- ipbytes = 0;
return (ISC_R_NOTIMPLEMENTED);
}
- nbytes = nbits = 0;
for (i = 0; i < ipbytes; i++) {
if (p[i] != 0xFF)
break;
diff --git a/external/bsd/bind/dist/lib/isc/powerpc/include/isc/atomic.h b/external/bsd/bind/dist/lib/isc/powerpc/include/isc/atomic.h
index 6a0ff7cc29a..63d608448f2 100644
--- a/external/bsd/bind/dist/lib/isc/powerpc/include/isc/atomic.h
+++ b/external/bsd/bind/dist/lib/isc/powerpc/include/isc/atomic.h
@@ -1,7 +1,7 @@
-/* $NetBSD: atomic.h,v 1.4 2011/02/16 03:47:14 christos Exp $ */
+/* $NetBSD: atomic.h,v 1.5 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: atomic.h,v 1.8 2009-10-14 23:47:51 tbox Exp */
+/* Id: atomic.h,v 1.11 2011-03-08 00:52:42 marka Exp */
#ifndef ISC_ATOMIC_H
#define ISC_ATOMIC_H 1
@@ -112,14 +112,16 @@ isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
"mr %0, r6\n"
"add r6, r6, %2\n"
"stwcx. r6, 0, %1\n"
- "bne- 1b"
+ "bne- 1b\n"
+ "sync"
#else
"1:"
"lwarx 6, 0, %1\n"
"mr %0, 6\n"
"add 6, 6, %2\n"
"stwcx. 6, 0, %1\n"
- "bne- 1b"
+ "bne- 1b\n"
+ "sync"
#endif
: "=&r"(orig)
: "r"(p), "r"(val)
@@ -137,13 +139,15 @@ isc_atomic_store(void *p, isc_int32_t val) {
"lwarx r6, 0, %0\n"
"lwz r6, %1\n"
"stwcx. r6, 0, %0\n"
- "bne- 1b"
+ "bne- 1b\n"
+ "sync"
#else
"1:"
"lwarx 6, 0, %0\n"
"lwz 6, %1\n"
"stwcx. 6, 0, %0\n"
- "bne- 1b"
+ "bne- 1b\n"
+ "sync"
#endif
:
: "r"(p), "m"(val)
@@ -165,7 +169,8 @@ isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
"mr r6, %3\n"
"stwcx. r6, 0, %1\n"
"bne- 1b\n"
- "2:"
+ "2:\n"
+ "sync"
#else
"1:"
"lwarx 6, 0, %1\n"
@@ -175,7 +180,8 @@ isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
"mr 6, %3\n"
"stwcx. 6, 0, %1\n"
"bne- 1b\n"
- "2:"
+ "2:\n"
+ "sync"
#endif
: "=&r" (orig)
: "r"(p), "r"(cmpval), "r"(val)
diff --git a/external/bsd/bind/dist/lib/isc/radix.c b/external/bsd/bind/dist/lib/isc/radix.c
index 3a2fb245b0b..faf5ec00e58 100644
--- a/external/bsd/bind/dist/lib/isc/radix.c
+++ b/external/bsd/bind/dist/lib/isc/radix.c
@@ -1,7 +1,7 @@
-/* $NetBSD: radix.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: radix.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: radix.c,v 1.23 2009-01-18 23:48:14 tbox Exp */
+/* Id: radix.c,v 1.25 2011-03-12 04:59:48 tbox Exp */
/*
* This source was adapted from MRT's RCS Ids:
@@ -277,7 +277,7 @@ isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target,
if (node && node->prefix)
stack[cnt++] = node;
- while (--cnt >= 0) {
+ while (cnt-- > 0) {
node = stack[cnt];
if (_comp_with_mask(isc_prefix_tochar(node->prefix),
diff --git a/external/bsd/bind/dist/lib/isc/rwlock.c b/external/bsd/bind/dist/lib/isc/rwlock.c
index 3d8c3083b10..69e9292854d 100644
--- a/external/bsd/bind/dist/lib/isc/rwlock.c
+++ b/external/bsd/bind/dist/lib/isc/rwlock.c
@@ -1,7 +1,7 @@
-/* $NetBSD: rwlock.c,v 1.4 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: rwlock.c,v 1.5 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: rwlock.c,v 1.46 2009-01-18 23:48:14 tbox Exp */
+/* Id: rwlock.c,v 1.48 2011-03-12 04:59:49 tbox Exp */
/*! \file */
@@ -369,6 +369,7 @@ isc_rwlock_lock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
}
cntflag = isc_atomic_xadd(&rwl->cnt_and_flag, READER_INCR);
+ POST(cntflag);
while (1) {
if ((rwl->cnt_and_flag & WRITER_ACTIVE) == 0)
break;
diff --git a/external/bsd/bind/dist/lib/isc/sha1.c b/external/bsd/bind/dist/lib/isc/sha1.c
index 26432636e93..09da78732b2 100644
--- a/external/bsd/bind/dist/lib/isc/sha1.c
+++ b/external/bsd/bind/dist/lib/isc/sha1.c
@@ -1,7 +1,7 @@
-/* $NetBSD: sha1.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: sha1.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,9 +17,8 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sha1.c,v 1.20 2009-02-06 23:47:42 tbox Exp */
+/* Id: sha1.c,v 1.22 2011-03-12 04:59:49 tbox Exp */
-/* $NetBSD: sha1.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
/* $OpenBSD: sha1.c,v 1.9 1997/07/23 21:12:32 kstailey Exp $ */
/*! \file
@@ -258,6 +257,8 @@ transform(isc_uint32_t state[5], const unsigned char buffer[64]) {
/* Wipe variables */
a = b = c = d = e = 0;
+ /* Avoid compiler warnings */
+ POST(a); POST(b); POST(c); POST(d); POST(e);
}
diff --git a/external/bsd/bind/dist/lib/isc/sha2.c b/external/bsd/bind/dist/lib/isc/sha2.c
index 921d9618a13..2dd4c61161a 100644
--- a/external/bsd/bind/dist/lib/isc/sha2.c
+++ b/external/bsd/bind/dist/lib/isc/sha2.c
@@ -1,7 +1,7 @@
-/* $NetBSD: sha2.c,v 1.3 2011/07/01 02:24:14 joerg Exp $ */
+/* $NetBSD: sha2.c,v 1.4 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2005-2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005-2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sha2.c,v 1.18 2009-10-22 02:21:31 each Exp */
+/* Id: sha2.c,v 1.20 2011-03-12 04:59:49 tbox Exp */
/* $FreeBSD: src/sys/crypto/sha2/sha2.c,v 1.2.2.2 2002/03/05 08:36:47 ume Exp $ */
/* $KAME: sha2.c,v 1.8 2001/11/08 01:07:52 itojun Exp $ */
@@ -694,6 +694,9 @@ void isc_sha256_transform(isc_sha256_t *context, const isc_uint32_t* data) {
/* Clean up */
a = b = c = d = e = f = g = h = T1 = 0;
+ /* Avoid compiler warnings */
+ POST(a); POST(b); POST(c); POST(d); POST(e); POST(f);
+ POST(g); POST(h); POST(T1);
}
#else /* ISC_SHA2_UNROLL_TRANSFORM */
@@ -775,6 +778,9 @@ isc_sha256_transform(isc_sha256_t *context, const isc_uint32_t* data) {
/* Clean up */
a = b = c = d = e = f = g = h = T1 = T2 = 0;
+ /* Avoid compiler warnings */
+ POST(a); POST(b); POST(c); POST(d); POST(e); POST(f);
+ POST(g); POST(h); POST(T1); POST(T2);
}
#endif /* ISC_SHA2_UNROLL_TRANSFORM */
@@ -811,6 +817,8 @@ isc_sha256_update(isc_sha256_t *context, const isc_uint8_t *data, size_t len) {
context->bitcount += len << 3;
/* Clean up: */
usedspace = freespace = 0;
+ /* Avoid compiler warnings: */
+ POST(usedspace); POST(freespace);
return;
}
}
@@ -829,6 +837,8 @@ isc_sha256_update(isc_sha256_t *context, const isc_uint8_t *data, size_t len) {
}
/* Clean up: */
usedspace = freespace = 0;
+ /* Avoid compiler warnings: */
+ POST(usedspace); POST(freespace);
}
void
@@ -899,6 +909,7 @@ isc_sha256_final(isc_uint8_t digest[], isc_sha256_t *context) {
/* Clean up state data: */
memset(context, 0, sizeof(*context));
usedspace = 0;
+ POST(usedspace);
}
/*** SHA-512: *********************************************************/
@@ -1005,6 +1016,9 @@ void isc_sha512_transform(isc_sha512_t *context, const isc_uint64_t* data) {
/* Clean up */
a = b = c = d = e = f = g = h = T1 = 0;
+ /* Avoid compiler warnings */
+ POST(a); POST(b); POST(c); POST(d); POST(e); POST(f);
+ POST(g); POST(h); POST(T1);
}
#else /* ISC_SHA2_UNROLL_TRANSFORM */
@@ -1084,6 +1098,9 @@ isc_sha512_transform(isc_sha512_t *context, const isc_uint64_t* data) {
/* Clean up */
a = b = c = d = e = f = g = h = T1 = T2 = 0;
+ /* Avoid compiler warnings */
+ POST(a); POST(b); POST(c); POST(d); POST(e); POST(f);
+ POST(g); POST(h); POST(T1); POST(T2);
}
#endif /* ISC_SHA2_UNROLL_TRANSFORM */
@@ -1119,6 +1136,8 @@ void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t le
ADDINC128(context->bitcount, len << 3);
/* Clean up: */
usedspace = freespace = 0;
+ /* Avoid compiler warnings: */
+ POST(usedspace); POST(freespace);
return;
}
}
@@ -1137,6 +1156,8 @@ void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t le
}
/* Clean up: */
usedspace = freespace = 0;
+ /* Avoid compiler warnings: */
+ POST(usedspace); POST(freespace);
}
void isc_sha512_last(isc_sha512_t *context) {
diff --git a/external/bsd/bind/dist/lib/isc/sockaddr.c b/external/bsd/bind/dist/lib/isc/sockaddr.c
index 1e23aab3699..5eadf41e8a0 100644
--- a/external/bsd/bind/dist/lib/isc/sockaddr.c
+++ b/external/bsd/bind/dist/lib/isc/sockaddr.c
@@ -1,7 +1,7 @@
-/* $NetBSD: sockaddr.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: sockaddr.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: sockaddr.c,v 1.73 2010-11-17 23:47:09 tbox Exp */
+/* Id: sockaddr.c,v 1.75 2011-02-21 23:47:45 tbox Exp */
/*! \file */
@@ -184,6 +184,9 @@ isc_sockaddr_format(const isc_sockaddr_t *sa, char *array, unsigned int size) {
isc_result_t result;
isc_buffer_t buf;
+ if (size == 0U)
+ return;
+
isc_buffer_init(&buf, array, size);
result = isc_sockaddr_totext(sa, &buf);
if (result != ISC_R_SUCCESS) {
diff --git a/external/bsd/bind/dist/lib/isc/socket_api.c b/external/bsd/bind/dist/lib/isc/socket_api.c
index 21f60b13558..d68368a8b49 100644
--- a/external/bsd/bind/dist/lib/isc/socket_api.c
+++ b/external/bsd/bind/dist/lib/isc/socket_api.c
@@ -1,7 +1,7 @@
-/* $NetBSD: socket_api.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: socket_api.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: socket_api.c,v 1.5 2009-10-01 01:30:01 sar Exp */
+/* Id: socket_api.c,v 1.8 2011-08-24 23:17:52 marka Exp */
#include <config.h>
@@ -216,3 +216,18 @@ isc_socket_fdwatchpoke(isc_socket_t *sock, int flags)
return(sock->methods->fdwatchpoke(sock, flags));
}
+
+isc_result_t
+isc_socket_dup(isc_socket_t *sock, isc_socket_t **socketp) {
+ REQUIRE(ISCAPI_SOCKET_VALID(sock));
+ REQUIRE(socketp != NULL && *socketp == NULL);
+
+ return(sock->methods->dup(sock, socketp));
+}
+
+int
+isc_socket_getfd(isc_socket_t *sock) {
+ REQUIRE(ISCAPI_SOCKET_VALID(sock));
+
+ return(sock->methods->getfd(sock));
+}
diff --git a/external/bsd/bind/dist/lib/isc/string.c b/external/bsd/bind/dist/lib/isc/string.c
index 5e40dc3640a..664e13fd9c7 100644
--- a/external/bsd/bind/dist/lib/isc/string.c
+++ b/external/bsd/bind/dist/lib/isc/string.c
@@ -1,7 +1,7 @@
-/* $NetBSD: string.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: string.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: string.c,v 1.20 2007-06-19 23:47:17 tbox Exp */
+/* Id: string.c,v 1.22 2011-03-12 04:59:49 tbox Exp */
/*! \file */
@@ -167,14 +167,15 @@ isc_string_printf(char *target, size_t size, const char *format, ...) {
}
void
-isc_string_printf_truncate(char *target, size_t size, const char *format, ...) {
+isc_string_printf_truncate(char *target, size_t size, const char *format, ...)
+{
va_list args;
- size_t n;
REQUIRE(size > 0U);
va_start(args, format);
- n = vsnprintf(target, size, format, args);
+ /* check return code? */
+ (void)vsnprintf(target, size, format, args);
va_end(args);
ENSURE(strlen(target) < size);
diff --git a/external/bsd/bind/dist/lib/isc/task.c b/external/bsd/bind/dist/lib/isc/task.c
index cfef96a21af..8dc213f495b 100644
--- a/external/bsd/bind/dist/lib/isc/task.c
+++ b/external/bsd/bind/dist/lib/isc/task.c
@@ -1,4 +1,4 @@
-/* $NetBSD: task.c,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: task.c,v 1.4 2011/09/11 18:55:41 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: task.c,v 1.115.14.1.2.1 2011-06-02 23:47:36 tbox Exp */
+/* Id: task.c,v 1.117 2011-02-03 12:18:12 tbox Exp */
/*! \file
* \author Principal Author: Bob Halley
diff --git a/external/bsd/bind/dist/lib/isc/taskpool.c b/external/bsd/bind/dist/lib/isc/taskpool.c
index 5dc41413e5d..ee78007be5b 100644
--- a/external/bsd/bind/dist/lib/isc/taskpool.c
+++ b/external/bsd/bind/dist/lib/isc/taskpool.c
@@ -1,7 +1,7 @@
-/* $NetBSD: taskpool.c,v 1.2 2011/02/16 03:47:11 christos Exp $ */
+/* $NetBSD: taskpool.c,v 1.3 2011/09/11 18:55:41 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,13 +17,14 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: taskpool.c,v 1.18 2007-06-18 23:47:44 tbox Exp */
+/* Id: taskpool.c,v 1.20 2011-07-07 23:47:49 tbox Exp */
/*! \file */
#include <config.h>
#include <isc/mem.h>
+#include <isc/random.h>
#include <isc/taskpool.h>
#include <isc/util.h>
@@ -33,28 +34,30 @@
struct isc_taskpool {
isc_mem_t * mctx;
+ isc_taskmgr_t * tmgr;
unsigned int ntasks;
+ unsigned int quantum;
isc_task_t ** tasks;
};
+
/***
*** Functions.
***/
-isc_result_t
-isc_taskpool_create(isc_taskmgr_t *tmgr, isc_mem_t *mctx,
- unsigned int ntasks, unsigned int quantum,
- isc_taskpool_t **poolp)
+static isc_result_t
+alloc_pool(isc_taskmgr_t *tmgr, isc_mem_t *mctx, unsigned int ntasks,
+ unsigned int quantum, isc_taskpool_t **poolp)
{
- unsigned int i;
isc_taskpool_t *pool;
- isc_result_t result;
+ unsigned int i;
- INSIST(ntasks > 0);
pool = isc_mem_get(mctx, sizeof(*pool));
if (pool == NULL)
return (ISC_R_NOMEMORY);
pool->mctx = mctx;
pool->ntasks = ntasks;
+ pool->quantum = quantum;
+ pool->tmgr = tmgr;
pool->tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
if (pool->tasks == NULL) {
isc_mem_put(mctx, pool, sizeof(*pool));
@@ -62,6 +65,28 @@ isc_taskpool_create(isc_taskmgr_t *tmgr, isc_mem_t *mctx,
}
for (i = 0; i < ntasks; i++)
pool->tasks[i] = NULL;
+
+ *poolp = pool;
+ return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+isc_taskpool_create(isc_taskmgr_t *tmgr, isc_mem_t *mctx,
+ unsigned int ntasks, unsigned int quantum,
+ isc_taskpool_t **poolp)
+{
+ unsigned int i;
+ isc_taskpool_t *pool = NULL;
+ isc_result_t result;
+
+ INSIST(ntasks > 0);
+
+ /* Allocate the pool structure */
+ result = alloc_pool(tmgr, mctx, ntasks, quantum, &pool);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
+ /* Create the tasks */
for (i = 0; i < ntasks; i++) {
result = isc_task_create(tmgr, quantum, &pool->tasks[i]);
if (result != ISC_R_SUCCESS) {
@@ -70,14 +95,69 @@ isc_taskpool_create(isc_taskmgr_t *tmgr, isc_mem_t *mctx,
}
isc_task_setname(pool->tasks[i], "taskpool", NULL);
}
+
*poolp = pool;
return (ISC_R_SUCCESS);
}
-void isc_taskpool_gettask(isc_taskpool_t *pool, unsigned int hash,
- isc_task_t **targetp)
+void
+isc_taskpool_gettask(isc_taskpool_t *pool, isc_task_t **targetp) {
+ isc_uint32_t i;
+ isc_random_get(&i);
+ isc_task_attach(pool->tasks[i % pool->ntasks], targetp);
+}
+
+int
+isc_taskpool_size(isc_taskpool_t *pool) {
+ REQUIRE(pool != NULL);
+ return (pool->ntasks);
+}
+
+isc_result_t
+isc_taskpool_expand(isc_taskpool_t **sourcep, unsigned int size,
+ isc_taskpool_t **targetp)
{
- isc_task_attach(pool->tasks[hash % pool->ntasks], targetp);
+ isc_result_t result;
+ isc_taskpool_t *pool;
+
+ REQUIRE(sourcep != NULL && *sourcep != NULL);
+ REQUIRE(targetp != NULL && *targetp == NULL);
+
+ pool = *sourcep;
+ if (size > pool->ntasks) {
+ isc_taskpool_t *newpool = NULL;
+ unsigned int i;
+
+ /* Allocate a new pool structure */
+ result = alloc_pool(pool->tmgr, pool->mctx, size,
+ pool->quantum, &newpool);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
+ /* Copy over the tasks from the old pool */
+ for (i = 0; i < pool->ntasks; i++) {
+ newpool->tasks[i] = pool->tasks[i];
+ pool->tasks[i] = NULL;
+ }
+
+ /* Create new tasks */
+ for (i = pool->ntasks; i < size; i++) {
+ result = isc_task_create(pool->tmgr, pool->quantum,
+ &newpool->tasks[i]);
+ if (result != ISC_R_SUCCESS) {
+ isc_taskpool_destroy(&newpool);
+ return (result);
+ }
+ isc_task_setname(newpool->tasks[i], "taskpool", NULL);
+ }
+
+ isc_taskpool_destroy(&pool);
+ pool = newpool;
+ }
+
+ *sourcep = NULL;
+ *targetp = pool;
+ return (ISC_R_SUCCESS);
}
void
diff --git a/external/bsd/bind/dist/lib/isc/timer.c b/external/bsd/bind/dist/lib/isc/timer.c
index 0854f264771..f665b090b7e 100644
--- a/external/bsd/bind/dist/lib/isc/timer.c
+++ b/external/bsd/bind/dist/lib/isc/timer.c
@@ -1,4 +1,4 @@
-/* $NetBSD: timer.c,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: timer.c,v 1.4 2011/09/11 18:55:41 christos Exp $ */
/*
* Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: timer.c,v 1.95.302.1.2.1 2011-06-02 23:47:36 tbox Exp */
+/* Id: timer.c,v 1.98 2011-03-11 06:11:26 marka Exp */
/*! \file */
@@ -335,7 +335,9 @@ schedule(isc__timer_t *timer, isc_time_t *now, isc_boolean_t signal_ok) {
static inline void
deschedule(isc__timer_t *timer) {
+#ifdef USE_TIMER_THREAD
isc_boolean_t need_wakeup = ISC_FALSE;
+#endif
isc__timermgr_t *manager;
/*
@@ -344,8 +346,10 @@ deschedule(isc__timer_t *timer) {
manager = timer->manager;
if (timer->index > 0) {
+#ifdef USE_TIMER_THREAD
if (timer->index == 1)
need_wakeup = ISC_TRUE;
+#endif
isc_heap_delete(manager->heap, timer->index);
timer->index = 0;
INSIST(manager->nscheduled > 0);
@@ -529,6 +533,7 @@ isc__timer_reset(isc_timer_t *timer0, isc_timertype_t type,
REQUIRE(VALID_TIMER(timer));
manager = timer->manager;
REQUIRE(VALID_MANAGER(manager));
+
if (expires == NULL)
expires = isc_time_epoch;
if (interval == NULL)
@@ -552,8 +557,6 @@ isc__timer_reset(isc_timer_t *timer0, isc_timertype_t type,
isc_time_settoepoch(&now);
}
- manager = timer->manager;
-
LOCK(&manager->lock);
LOCK(&timer->lock);
diff --git a/external/bsd/bind/dist/lib/isc/unix/dir.c b/external/bsd/bind/dist/lib/isc/unix/dir.c
index 4cafd491efb..3acb87a1e3b 100644
--- a/external/bsd/bind/dist/lib/isc/unix/dir.c
+++ b/external/bsd/bind/dist/lib/isc/unix/dir.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dir.c,v 1.2 2011/02/16 03:47:15 christos Exp $ */
+/* $NetBSD: dir.c,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dir.c,v 1.29 2009-02-16 23:48:04 tbox Exp */
+/* Id: dir.c,v 1.31 2011-03-12 04:59:49 tbox Exp */
/*! \file
* \author Principal Authors: DCL */
@@ -81,7 +81,7 @@ isc_dir_open(isc_dir_t *dir, const char *dirname) {
if (dir->dirname < p && *(p - 1) != '/')
*p++ = '/';
*p++ = '*';
- *p++ = '\0';
+ *p = '\0';
/*
* Open stream.
diff --git a/external/bsd/bind/dist/lib/isc/unix/file.c b/external/bsd/bind/dist/lib/isc/unix/file.c
index 1ae86df3230..607cfa4e898 100644
--- a/external/bsd/bind/dist/lib/isc/unix/file.c
+++ b/external/bsd/bind/dist/lib/isc/unix/file.c
@@ -1,4 +1,4 @@
-/* $NetBSD: file.c,v 1.2 2011/02/16 03:47:15 christos Exp $ */
+/* $NetBSD: file.c,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
* Copyright (C) 2004, 2005, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -50,7 +50,7 @@
* SUCH DAMAGE.
*/
-/* Id: file.c,v 1.57 2011-01-11 23:47:14 tbox Exp */
+/* Id: file.c,v 1.58 2011-03-04 14:07:03 smann Exp */
/*! \file */
@@ -350,6 +350,23 @@ isc_file_exists(const char *pathname) {
return (ISC_TF(file_stats(pathname, &stats) == ISC_R_SUCCESS));
}
+isc_result_t
+isc_file_isplainfile(const char *filename) {
+ /*
+ * This function returns success if filename is a plain file.
+ */
+ struct stat filestat;
+ memset(&filestat,0,sizeof(struct stat));
+
+ if ((stat(filename, &filestat)) == -1)
+ return(isc__errno2result(errno));
+
+ if(! S_ISREG(filestat.st_mode))
+ return(ISC_R_INVALIDFILE);
+
+ return(ISC_R_SUCCESS);
+}
+
isc_boolean_t
isc_file_isabsolute(const char *filename) {
REQUIRE(filename != NULL);
diff --git a/external/bsd/bind/dist/lib/isc/unix/include/isc/stdtime.h b/external/bsd/bind/dist/lib/isc/unix/include/isc/stdtime.h
index 95ea31131eb..b025c18c4c2 100644
--- a/external/bsd/bind/dist/lib/isc/unix/include/isc/stdtime.h
+++ b/external/bsd/bind/dist/lib/isc/unix/include/isc/stdtime.h
@@ -1,7 +1,7 @@
-/* $NetBSD: stdtime.h,v 1.2 2011/02/16 03:47:15 christos Exp $ */
+/* $NetBSD: stdtime.h,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: stdtime.h,v 1.14 2007-06-19 23:47:19 tbox Exp */
+/* Id: stdtime.h,v 1.16 2011-03-18 23:47:36 tbox Exp */
#ifndef ISC_STDTIME_H
#define ISC_STDTIME_H 1
@@ -33,6 +33,10 @@
* about its size.
*/
typedef isc_uint32_t isc_stdtime_t;
+
+/* but this flag helps... */
+#define STDTIME_ON_32BITS 1
+
/*
* isc_stdtime32_t is a 32-bit version of isc_stdtime_t. A variable of this
* type should only be used as an opaque integer (e.g.,) to compare two
diff --git a/external/bsd/bind/dist/lib/isc/unix/socket.c b/external/bsd/bind/dist/lib/isc/unix/socket.c
index 8725fe47b0b..9cf5971b9be 100644
--- a/external/bsd/bind/dist/lib/isc/unix/socket.c
+++ b/external/bsd/bind/dist/lib/isc/unix/socket.c
@@ -1,4 +1,4 @@
-/* $NetBSD: socket.c,v 1.7 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: socket.c,v 1.8 2011/09/11 18:55:42 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: socket.c,v 1.333.14.2.2.1 2011-06-02 23:47:36 tbox Exp */
+/* Id: socket.c,v 1.346 2011-08-24 23:17:52 marka Exp */
/*! \file */
@@ -336,7 +336,8 @@ struct isc__socket {
listener : 1, /* listener socket */
connected : 1,
connecting : 1, /* connect pending */
- bound : 1; /* bound to local addr */
+ bound : 1, /* bound to local addr */
+ dupped : 1;
#ifdef ISC_NET_RECVOVERFLOW
unsigned char overflow; /* used for MSG_TRUNC fake */
@@ -430,6 +431,10 @@ static isc__socketmgr_t *socketmgr = NULL;
# define MAXSCATTERGATHER_RECV (ISC_SOCKET_MAXSCATTERGATHER)
#endif
+static isc_result_t socket_create(isc_socketmgr_t *manager0, int pf,
+ isc_sockettype_t type,
+ isc_socket_t **socketp,
+ isc_socket_t *dup_socket);
static void send_recvdone_event(isc__socket_t *, isc_socketevent_t **);
static void send_senddone_event(isc__socket_t *, isc_socketevent_t **);
static void free_socket(isc__socket_t **);
@@ -548,6 +553,10 @@ isc__socket_fdwatchcreate(isc_socketmgr_t *manager, int fd, int flags,
isc_task_t *task, isc_socket_t **socketp);
ISC_SOCKETFUNC_SCOPE isc_result_t
isc__socket_fdwatchpoke(isc_socket_t *sock, int flags);
+ISC_SOCKETFUNC_SCOPE isc_result_t
+isc__socket_dup(isc_socket_t *sock, isc_socket_t **socketp);
+ISC_SOCKETFUNC_SCOPE int
+isc__socket_getfd(isc_socket_t *sock);
static struct {
isc_socketmethods_t methods;
@@ -571,7 +580,9 @@ static struct {
isc__socket_getsockname,
isc__socket_gettype,
isc__socket_ipv6only,
- isc__socket_fdwatchpoke
+ isc__socket_fdwatchpoke,
+ isc__socket_dup,
+ isc__socket_getfd
}
#ifndef BIND9
,
@@ -766,6 +777,7 @@ FIX_IPV6_RECVPKTINFO(isc__socket_t *sock)
if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO,
(void *)&on, sizeof(on)) < 0) {
+ isc__strerror(errno, strbuf, sizeof(strbuf));
UNEXPECTED_ERROR(__FILE__, __LINE__,
"setsockopt(%d, IPV6_RECVPKTINFO) "
"%s: %s", sock->fd,
@@ -1366,6 +1378,9 @@ build_msghdr_send(isc__socket_t *sock, isc_socketevent_t *dev,
#if defined(USE_CMSG) && defined(ISC_PLATFORM_HAVEIN6PKTINFO)
if ((sock->type == isc_sockettype_udp)
&& ((dev->attributes & ISC_SOCKEVENTATTR_PKTINFO) != 0)) {
+#if defined(IPV6_USE_MIN_MTU)
+ int use_min_mtu = 1; /* -1, 0, 1 */
+#endif
struct cmsghdr *cmsgp;
struct in6_pktinfo *pktinfop;
@@ -1384,6 +1399,22 @@ build_msghdr_send(isc__socket_t *sock, isc_socketevent_t *dev,
cmsgp->cmsg_len = cmsg_len(sizeof(struct in6_pktinfo));
pktinfop = (struct in6_pktinfo *)CMSG_DATA(cmsgp);
memcpy(pktinfop, &dev->pktinfo, sizeof(struct in6_pktinfo));
+#if defined(IPV6_USE_MIN_MTU)
+ /*
+ * Set IPV6_USE_MIN_MTU as a per packet option as FreeBSD
+ * ignores setsockopt(IPV6_USE_MIN_MTU) when IPV6_PKTINFO
+ * is used.
+ */
+ cmsgp = (struct cmsghdr *)(sock->sendcmsgbuf +
+ msg->msg_controllen);
+ msg->msg_controllen += cmsg_space(sizeof(use_min_mtu));
+ INSIST(msg->msg_controllen <= sock->sendcmsgbuflen);
+
+ cmsgp->cmsg_level = IPPROTO_IPV6;
+ cmsgp->cmsg_type = IPV6_USE_MIN_MTU;
+ cmsgp->cmsg_len = cmsg_len(sizeof(use_min_mtu));
+ memcpy(CMSG_DATA(cmsgp), &use_min_mtu, sizeof(use_min_mtu));
+#endif
}
#endif /* USE_CMSG && ISC_PLATFORM_HAVEIPV6 */
#else /* ISC_NET_BSD44MSGHDR */
@@ -1760,6 +1791,7 @@ doio_recv(isc__socket_t *sock, isc_socketevent_t *dev) {
} else {
isc_buffer_add(buffer, actual_count);
actual_count = 0;
+ POST(actual_count);
break;
}
buffer = ISC_LIST_NEXT(buffer, link);
@@ -1999,9 +2031,10 @@ destroy(isc__socket_t **sockp) {
SIGNAL(&manager->shutdown_ok);
#endif /* USE_WATCHER_THREAD */
- UNLOCK(&manager->lock);
-
+ /* can't unlock manager as its memory context is still used */
free_socket(sockp);
+
+ UNLOCK(&manager->lock);
}
static isc_result_t
@@ -2026,6 +2059,7 @@ allocate_socket(isc__socketmgr_t *manager, isc_sockettype_t type,
sock->manager = manager;
sock->type = type;
sock->fd = -1;
+ sock->dupped = 0;
sock->statsindex = NULL;
ISC_LINK_INIT(sock, link);
@@ -2038,7 +2072,7 @@ allocate_socket(isc__socketmgr_t *manager, isc_sockettype_t type,
*/
cmsgbuflen = 0;
#if defined(USE_CMSG) && defined(ISC_PLATFORM_HAVEIN6PKTINFO)
- cmsgbuflen = cmsg_space(sizeof(struct in6_pktinfo));
+ cmsgbuflen += cmsg_space(sizeof(struct in6_pktinfo));
#endif
#if defined(USE_CMSG) && defined(SO_TIMESTAMP)
cmsgbuflen += cmsg_space(sizeof(struct timeval));
@@ -2052,7 +2086,14 @@ allocate_socket(isc__socketmgr_t *manager, isc_sockettype_t type,
cmsgbuflen = 0;
#if defined(USE_CMSG) && defined(ISC_PLATFORM_HAVEIN6PKTINFO)
- cmsgbuflen = cmsg_space(sizeof(struct in6_pktinfo));
+ cmsgbuflen += cmsg_space(sizeof(struct in6_pktinfo));
+#if defined(IPV6_USE_MIN_MTU)
+ /*
+ * Provide space for working around FreeBSD's broken IPV6_USE_MIN_MTU
+ * support.
+ */
+ cmsgbuflen += cmsg_space(sizeof(int));
+#endif
#endif
sock->sendcmsgbuflen = cmsgbuflen;
if (sock->sendcmsgbuflen != 0U) {
@@ -2195,7 +2236,8 @@ clear_bsdcompat(void) {
#endif
static isc_result_t
-opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
+opensocket(isc__socketmgr_t *manager, isc__socket_t *sock,
+ isc__socket_t *dup_socket) {
char strbuf[ISC_STRERRORSIZE];
const char *err = "socket";
int tries = 0;
@@ -2208,22 +2250,28 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
#endif
again:
- switch (sock->type) {
- case isc_sockettype_udp:
- sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP);
- break;
- case isc_sockettype_tcp:
- sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP);
- break;
- case isc_sockettype_unix:
- sock->fd = socket(sock->pf, SOCK_STREAM, 0);
- break;
- case isc_sockettype_fdwatch:
- /*
- * We should not be called for isc_sockettype_fdwatch sockets.
- */
- INSIST(0);
- break;
+ if (dup_socket == NULL) {
+ switch (sock->type) {
+ case isc_sockettype_udp:
+ sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP);
+ break;
+ case isc_sockettype_tcp:
+ sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP);
+ break;
+ case isc_sockettype_unix:
+ sock->fd = socket(sock->pf, SOCK_STREAM, 0);
+ break;
+ case isc_sockettype_fdwatch:
+ /*
+ * We should not be called for isc_sockettype_fdwatch
+ * sockets.
+ */
+ INSIST(0);
+ break;
+ }
+ } else {
+ sock->fd = dup(dup_socket->fd);
+ sock->dupped = 1;
}
if (sock->fd == -1 && errno == EINTR && tries++ < 42)
goto again;
@@ -2300,6 +2348,9 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
}
}
+ if (dup_socket != NULL)
+ goto setup_done;
+
if (make_nonblock(sock->fd) != ISC_R_SUCCESS) {
(void)close(sock->fd);
return (ISC_R_UNEXPECTED);
@@ -2402,10 +2453,18 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
#endif /* ISC_PLATFORM_HAVEIN6PKTINFO */
#ifdef IPV6_USE_MIN_MTU /* RFC 3542, not too common yet*/
/* use minimum MTU */
- if (sock->pf == AF_INET6) {
- (void)setsockopt(sock->fd, IPPROTO_IPV6,
- IPV6_USE_MIN_MTU,
- (void *)&on, sizeof(on));
+ if (sock->pf == AF_INET6 &&
+ setsockopt(sock->fd, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
+ (void *)&on, sizeof(on)) < 0) {
+ isc__strerror(errno, strbuf, sizeof(strbuf));
+ UNEXPECTED_ERROR(__FILE__, __LINE__,
+ "setsockopt(%d, IPV6_USE_MIN_MTU) "
+ "%s: %s", sock->fd,
+ isc_msgcat_get(isc_msgcat,
+ ISC_MSGSET_GENERAL,
+ ISC_MSG_FAILED,
+ "failed"),
+ strbuf);
}
#endif
#if defined(IPV6_MTU)
@@ -2424,8 +2483,9 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
*/
if (sock->pf == AF_INET6) {
int action = IPV6_PMTUDISC_DONT;
- (void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
- &action, sizeof(action));
+ (void)setsockopt(sock->fd, IPPROTO_IPV6,
+ IPV6_MTU_DISCOVER, &action,
+ sizeof(action));
}
#endif
#endif /* ISC_PLATFORM_HAVEIPV6 */
@@ -2475,20 +2535,21 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
}
#endif /* defined(USE_CMSG) || defined(SO_RCVBUF) */
+setup_done:
inc_stats(manager->stats, sock->statsindex[STATID_OPEN]);
return (ISC_R_SUCCESS);
}
-/*%
- * Create a new 'type' socket managed by 'manager'. Events
- * will be posted to 'task' and when dispatched 'action' will be
- * called with 'arg' as the arg value. The new socket is returned
- * in 'socketp'.
+/*
+ * Create a 'type' socket or duplicate an existing socket, managed
+ * by 'manager'. Events will be posted to 'task' and when dispatched
+ * 'action' will be called with 'arg' as the arg value. The new
+ * socket is returned in 'socketp'.
*/
-ISC_SOCKETFUNC_SCOPE isc_result_t
-isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
- isc_socket_t **socketp)
+static isc_result_t
+socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
+ isc_socket_t **socketp, isc_socket_t *dup_socket)
{
isc__socket_t *sock = NULL;
isc__socketmgr_t *manager = (isc__socketmgr_t *)manager0;
@@ -2520,7 +2581,8 @@ isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
}
sock->pf = pf;
- result = opensocket(manager, sock);
+
+ result = opensocket(manager, sock, (isc__socket_t *)dup_socket);
if (result != ISC_R_SUCCESS) {
inc_stats(manager->stats, sock->statsindex[STATID_OPENFAIL]);
free_socket(&sock);
@@ -2555,11 +2617,40 @@ isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
UNLOCK(&manager->lock);
socket_log(sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET,
- ISC_MSG_CREATED, "created");
+ ISC_MSG_CREATED, dup_socket == NULL ? "dupped" : "created");
return (ISC_R_SUCCESS);
}
+/*%
+ * Create a new 'type' socket managed by 'manager'. Events
+ * will be posted to 'task' and when dispatched 'action' will be
+ * called with 'arg' as the arg value. The new socket is returned
+ * in 'socketp'.
+ */
+ISC_SOCKETFUNC_SCOPE isc_result_t
+isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
+ isc_socket_t **socketp)
+{
+ return (socket_create(manager0, pf, type, socketp, NULL));
+}
+
+/*%
+ * Duplicate an existing socket. The new socket is returned
+ * in 'socketp'.
+ */
+ISC_SOCKETFUNC_SCOPE isc_result_t
+isc__socket_dup(isc_socket_t *sock0, isc_socket_t **socketp) {
+ isc__socket_t *sock = (isc__socket_t *)sock0;
+
+ REQUIRE(VALID_SOCKET(sock));
+ REQUIRE(socketp != NULL && *socketp == NULL);
+
+ return (socket_create((isc_socketmgr_t *) sock->manager,
+ sock->pf, sock->type, socketp,
+ sock0));
+}
+
#ifdef BIND9
ISC_SOCKETFUNC_SCOPE isc_result_t
isc__socket_open(isc_socket_t *sock0) {
@@ -2578,7 +2669,7 @@ isc__socket_open(isc_socket_t *sock0) {
*/
REQUIRE(sock->fd == -1);
- result = opensocket(sock->manager, sock);
+ result = opensocket(sock->manager, sock, NULL);
if (result != ISC_R_SUCCESS)
sock->fd = -1;
@@ -2757,8 +2848,8 @@ isc__socket_close(isc_socket_t *sock0) {
isc__socket_t *sock = (isc__socket_t *)sock0;
int fd;
isc__socketmgr_t *manager;
- isc_sockettype_t type;
+ fflush(stdout);
REQUIRE(VALID_SOCKET(sock));
LOCK(&sock->lock);
@@ -2777,9 +2868,9 @@ isc__socket_close(isc_socket_t *sock0) {
INSIST(sock->connect_ev == NULL);
manager = sock->manager;
- type = sock->type;
fd = sock->fd;
sock->fd = -1;
+ sock->dupped = 0;
memset(sock->name, 0, sizeof(sock->name));
sock->tag = NULL;
sock->listener = 0;
@@ -4457,9 +4548,8 @@ isc__socket_recvv(isc_socket_t *sock0, isc_bufferlist_t *buflist,
INSIST(sock->bound);
dev = allocate_socketevent(sock, ISC_SOCKEVENT_RECVDONE, action, arg);
- if (dev == NULL) {
+ if (dev == NULL)
return (ISC_R_NOMEMORY);
- }
/*
* UDP sockets are always partial read
@@ -4663,9 +4753,8 @@ isc__socket_sendto(isc_socket_t *sock0, isc_region_t *region,
INSIST(sock->bound);
dev = allocate_socketevent(sock, ISC_SOCKEVENT_SENDDONE, action, arg);
- if (dev == NULL) {
+ if (dev == NULL)
return (ISC_R_NOMEMORY);
- }
dev->region = *region;
@@ -4704,9 +4793,8 @@ isc__socket_sendtov(isc_socket_t *sock0, isc_bufferlist_t *buflist,
REQUIRE(iocount > 0);
dev = allocate_socketevent(sock, ISC_SOCKEVENT_SENDDONE, action, arg);
- if (dev == NULL) {
+ if (dev == NULL)
return (ISC_R_NOMEMORY);
- }
/*
* Move each buffer from the passed in list to our internal one.
@@ -4945,48 +5033,49 @@ isc__socket_bind(isc_socket_t *sock0, isc_sockaddr_t *sockaddr,
UNLOCK(&sock->lock);
return (ISC_R_FAMILYMISMATCH);
}
- /*
- * Only set SO_REUSEADDR when we want a specific port.
- */
+ if (!sock->dupped) {
+ /*
+ * Only set SO_REUSEADDR when we want a specific port.
+ */
#ifdef AF_UNIX
- if (sock->pf == AF_UNIX)
- goto bind_socket;
+ if (sock->pf == AF_UNIX)
+ goto bind_socket;
#endif
- if ((options & ISC_SOCKET_REUSEADDRESS) != 0 &&
- isc_sockaddr_getport(sockaddr) != (in_port_t)0 &&
- setsockopt(sock->fd, SOL_SOCKET, SO_REUSEADDR, (void *)&on,
- sizeof(on)) < 0) {
- UNEXPECTED_ERROR(__FILE__, __LINE__,
- "setsockopt(%d) %s", sock->fd,
- isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
- ISC_MSG_FAILED, "failed"));
- /* Press on... */
- }
+ if ((options & ISC_SOCKET_REUSEADDRESS) != 0 &&
+ isc_sockaddr_getport(sockaddr) != (in_port_t)0 &&
+ setsockopt(sock->fd, SOL_SOCKET, SO_REUSEADDR, (void *)&on,
+ sizeof(on)) < 0) {
+ UNEXPECTED_ERROR(__FILE__, __LINE__,
+ "setsockopt(%d) %s", sock->fd,
+ isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+ ISC_MSG_FAILED, "failed"));
+ /* Press on... */
+ }
#ifdef AF_UNIX
- bind_socket:
+ bind_socket:
#endif
- if (bind(sock->fd, &sockaddr->type.sa, sockaddr->length) < 0) {
- inc_stats(sock->manager->stats,
- sock->statsindex[STATID_BINDFAIL]);
+ if (bind(sock->fd, &sockaddr->type.sa, sockaddr->length) < 0) {
+ inc_stats(sock->manager->stats,
+ sock->statsindex[STATID_BINDFAIL]);
- UNLOCK(&sock->lock);
- switch (errno) {
- case EACCES:
- return (ISC_R_NOPERM);
- case EADDRNOTAVAIL:
- return (ISC_R_ADDRNOTAVAIL);
- case EADDRINUSE:
- return (ISC_R_ADDRINUSE);
- case EINVAL:
- return (ISC_R_BOUND);
- default:
- isc__strerror(errno, strbuf, sizeof(strbuf));
- UNEXPECTED_ERROR(__FILE__, __LINE__, "bind: %s",
- strbuf);
- return (ISC_R_UNEXPECTED);
+ UNLOCK(&sock->lock);
+ switch (errno) {
+ case EACCES:
+ return (ISC_R_NOPERM);
+ case EADDRNOTAVAIL:
+ return (ISC_R_ADDRNOTAVAIL);
+ case EADDRINUSE:
+ return (ISC_R_ADDRINUSE);
+ case EINVAL:
+ return (ISC_R_BOUND);
+ default:
+ isc__strerror(errno, strbuf, sizeof(strbuf));
+ UNEXPECTED_ERROR(__FILE__, __LINE__, "bind: %s",
+ strbuf);
+ return (ISC_R_UNEXPECTED);
+ }
}
}
-
socket_log(sock, sockaddr, TRACE,
isc_msgcat, ISC_MSGSET_SOCKET, ISC_MSG_BOUND, "bound");
sock->bound = 1;
@@ -5123,6 +5212,7 @@ isc__socket_accept(isc_socket_t *sock0,
*/
isc_task_attach(task, &ntask);
if (isc_task_exiting(ntask)) {
+ free_socket(&nsock);
isc_task_detach(&ntask);
isc_event_free(ISC_EVENT_PTR(&dev));
UNLOCK(&sock->lock);
@@ -5634,7 +5724,7 @@ isc__socket_ipv6only(isc_socket_t *sock0, isc_boolean_t yes) {
if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_V6ONLY,
(void *)&onoff, sizeof(int)) < 0) {
char strbuf[ISC_STRERRORSIZE];
-
+ isc__strerror(errno, strbuf, sizeof(strbuf));
UNEXPECTED_ERROR(__FILE__, __LINE__,
"setsockopt(%d, IPV6_V6ONLY) "
"%s: %s", sock->fd,
@@ -5794,6 +5884,13 @@ isc__socket_register() {
}
#endif
+ISC_SOCKETFUNC_SCOPE int
+isc__socket_getfd(isc_socket_t *socket0) {
+ isc__socket_t *socket = (isc__socket_t *)socket0;
+
+ return ((short) socket->fd);
+}
+
#if defined(HAVE_LIBXML2) && defined(BIND9)
static const char *
diff --git a/external/bsd/bind/dist/lib/isc/unix/stdio.c b/external/bsd/bind/dist/lib/isc/unix/stdio.c
index 12667c0d8a0..1116229f34e 100644
--- a/external/bsd/bind/dist/lib/isc/unix/stdio.c
+++ b/external/bsd/bind/dist/lib/isc/unix/stdio.c
@@ -1,7 +1,7 @@
-/* $NetBSD: stdio.c,v 1.2 2011/02/16 03:47:15 christos Exp $ */
+/* $NetBSD: stdio.c,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000, 2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: stdio.c,v 1.8 2007-06-19 23:47:18 tbox Exp */
+/* Id: stdio.c,v 1.10 2011-03-05 23:52:31 tbox Exp */
#include <config.h>
@@ -25,6 +25,7 @@
#include <unistd.h>
#include <isc/stdio.h>
+#include <isc/stat.h>
#include "errno2result.h"
diff --git a/external/bsd/bind/dist/lib/isc/unix/time.c b/external/bsd/bind/dist/lib/isc/unix/time.c
index 4f9240ea154..e35853fa919 100644
--- a/external/bsd/bind/dist/lib/isc/unix/time.c
+++ b/external/bsd/bind/dist/lib/isc/unix/time.c
@@ -1,7 +1,7 @@
-/* $NetBSD: time.c,v 1.3 2011/06/20 09:11:16 mrg Exp $ */
+/* $NetBSD: time.c,v 1.4 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: time.c,v 1.56 2008-02-15 23:46:51 tbox Exp */
+/* Id: time.c,v 1.58 2011-03-12 04:59:49 tbox Exp */
/*! \file */
@@ -321,7 +321,7 @@ isc_time_microdiff(const isc_time_t *t1, const isc_time_t *t2) {
/*
* Convert to microseconds.
*/
- i3 = (i1 - i2) / NS_PER_US;
+ i3 /= NS_PER_US;
return (i3);
}
diff --git a/external/bsd/bind/dist/lib/isc/win32/dir.c b/external/bsd/bind/dist/lib/isc/win32/dir.c
index 8e1180a16cd..28cc796d02f 100644
--- a/external/bsd/bind/dist/lib/isc/win32/dir.c
+++ b/external/bsd/bind/dist/lib/isc/win32/dir.c
@@ -1,7 +1,7 @@
-/* $NetBSD: dir.c,v 1.2 2011/02/16 03:47:15 christos Exp $ */
+/* $NetBSD: dir.c,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: dir.c,v 1.18 2009-01-18 23:48:14 tbox Exp */
+/* Id: dir.c,v 1.20 2011-03-12 04:59:49 tbox Exp */
/* Principal Authors: DCL */
@@ -87,7 +87,7 @@ isc_dir_open(isc_dir_t *dir, const char *dirname) {
if (dir->dirname < p && *(p - 1) != '\\' && *(p - 1) != ':')
*p++ = '\\';
*p++ = '*';
- *p++ = '\0';
+ *p = '\0';
/*
* Open stream.
diff --git a/external/bsd/bind/dist/lib/isc/win32/file.c b/external/bsd/bind/dist/lib/isc/win32/file.c
index 5d59c8f075e..cc6f216690e 100644
--- a/external/bsd/bind/dist/lib/isc/win32/file.c
+++ b/external/bsd/bind/dist/lib/isc/win32/file.c
@@ -1,4 +1,4 @@
-/* $NetBSD: file.c,v 1.2 2011/02/16 03:47:15 christos Exp $ */
+/* $NetBSD: file.c,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
* Copyright (C) 2004, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: file.c,v 1.39 2011-01-13 06:36:04 marka Exp */
+/* Id: file.c,v 1.40 2011-03-04 14:07:03 smann Exp */
#include <config.h>
@@ -400,6 +400,23 @@ isc_file_exists(const char *pathname) {
return (ISC_TF(file_stats(pathname, &stats) == ISC_R_SUCCESS));
}
+isc_result_t
+isc_file_isplainfile(const char *filename) {
+ /*
+ * This function returns success if filename is a plain file.
+ */
+ struct stat filestat;
+ memset(&filestat,0,sizeof(struct stat));
+
+ if ((stat(filename, &filestat)) == -1)
+ return(isc__errno2result(errno));
+
+ if(! S_ISREG(filestat.st_mode))
+ return(ISC_R_INVALIDFILE);
+
+ return(ISC_R_SUCCESS);
+}
+
isc_boolean_t
isc_file_isabsolute(const char *filename) {
REQUIRE(filename != NULL);
diff --git a/external/bsd/bind/dist/lib/isc/win32/include/isc/ipv6.h b/external/bsd/bind/dist/lib/isc/win32/include/isc/ipv6.h
index 5eb1c8bb1ee..434241f0cd6 100644
--- a/external/bsd/bind/dist/lib/isc/win32/include/isc/ipv6.h
+++ b/external/bsd/bind/dist/lib/isc/win32/include/isc/ipv6.h
@@ -1,4 +1,4 @@
-/* $NetBSD: ipv6.h,v 1.3 2011/07/05 21:59:19 spz Exp $ */
+/* $NetBSD: ipv6.h,v 1.4 2011/09/11 18:55:42 christos Exp $ */
/*
* Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: ipv6.h,v 1.19.814.1.2.1 2011-06-02 23:47:36 tbox Exp */
+/* Id: ipv6.h,v 1.21 2011-02-03 12:18:12 tbox Exp */
#ifndef ISC_IPV6_H
#define ISC_IPV6_H 1
diff --git a/external/bsd/bind/dist/lib/isc/win32/include/isc/stdtime.h b/external/bsd/bind/dist/lib/isc/win32/include/isc/stdtime.h
index 19a136d67bb..cde50cd310c 100644
--- a/external/bsd/bind/dist/lib/isc/win32/include/isc/stdtime.h
+++ b/external/bsd/bind/dist/lib/isc/win32/include/isc/stdtime.h
@@ -1,7 +1,7 @@
-/* $NetBSD: stdtime.h,v 1.2 2011/02/16 03:47:16 christos Exp $ */
+/* $NetBSD: stdtime.h,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: stdtime.h,v 1.12 2007-06-19 23:47:20 tbox Exp */
+/* Id: stdtime.h,v 1.14 2011-03-18 23:47:36 tbox Exp */
#ifndef ISC_STDTIME_H
#define ISC_STDTIME_H 1
@@ -31,6 +31,10 @@
* about its size.
*/
typedef isc_uint32_t isc_stdtime_t;
+
+/* but this flag helps... */
+#define STDTIME_ON_32BITS 1
+
/*
* isc_stdtime32_t is a 32-bit version of isc_stdtime_t. A variable of this
* type should only be used as an opaque integer (e.g.,) to compare two
diff --git a/external/bsd/bind/dist/lib/isc/win32/socket.c b/external/bsd/bind/dist/lib/isc/win32/socket.c
index 5ff5ed07b1e..324dbc1d9f0 100644
--- a/external/bsd/bind/dist/lib/isc/win32/socket.c
+++ b/external/bsd/bind/dist/lib/isc/win32/socket.c
@@ -1,7 +1,7 @@
-/* $NetBSD: socket.c,v 1.2 2011/02/16 03:47:16 christos Exp $ */
+/* $NetBSD: socket.c,v 1.3 2011/09/11 18:55:42 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: socket.c,v 1.87 2010-12-09 06:08:05 marka Exp */
+/* Id: socket.c,v 1.92 2011-08-23 18:24:33 each Exp */
/* This code uses functions which are only available on Server 2003 and
* higher, and Windows XP and higher.
@@ -267,7 +267,8 @@ struct isc_socket {
unsigned int listener : 1, /* listener socket */
connected : 1,
pending_connect : 1, /* connect pending */
- bound : 1; /* bound to local addr */
+ bound : 1, /* bound to local addr */
+ dupped : 1; /* created by isc_socket_dup() */
unsigned int pending_iocp; /* Should equal the counters below. Debug. */
unsigned int pending_recv; /* Number of outstanding recv() calls. */
unsigned int pending_send; /* Number of outstanding send() calls. */
@@ -353,6 +354,10 @@ enum {
#define MAXSCATTERGATHER_SEND (ISC_SOCKET_MAXSCATTERGATHER)
#define MAXSCATTERGATHER_RECV (ISC_SOCKET_MAXSCATTERGATHER)
+static isc_result_t socket_create(isc_socketmgr_t *manager0, int pf,
+ isc_sockettype_t type,
+ isc_socket_t **socketp,
+ isc_socket_t *dup_socket);
static isc_threadresult_t WINAPI SocketIoThread(LPVOID ThreadContext);
static void maybe_free_socket(isc_socket_t **, int);
static void free_socket(isc_socket_t **, int);
@@ -1463,6 +1468,7 @@ allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
sock->connected = 0;
sock->pending_connect = 0;
sock->bound = 0;
+ sock->dupped = 0;
memset(sock->name, 0, sizeof(sock->name)); // zero the name field
_set_state(sock, SOCK_INITIALIZED);
@@ -1625,9 +1631,10 @@ free_socket(isc_socket_t **sockp, int lineno) {
* called with 'arg' as the arg value. The new socket is returned
* in 'socketp'.
*/
-isc_result_t
-isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
- isc_socket_t **socketp) {
+static isc_result_t
+socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
+ isc_socket_t **socketp, isc_socket_t *dup_socket)
+{
isc_socket_t *sock = NULL;
isc_result_t result;
#if defined(USE_CMSG)
@@ -1649,27 +1656,40 @@ isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
return (result);
sock->pf = pf;
- switch (type) {
- case isc_sockettype_udp:
- sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP);
- if (sock->fd != INVALID_SOCKET) {
- result = connection_reset_fix(sock->fd);
- if (result != ISC_R_SUCCESS) {
- socket_log(__LINE__, sock, NULL, EVENT, NULL, 0, 0,
- "closed %d %d %d con_reset_fix_failed",
- sock->pending_recv, sock->pending_send,
- sock->references);
- closesocket(sock->fd);
- _set_state(sock, SOCK_CLOSED);
- sock->fd = INVALID_SOCKET;
- free_socket(&sock, __LINE__);
- return (result);
+ if (dup_socket == NULL) {
+ switch (type) {
+ case isc_sockettype_udp:
+ sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP);
+ if (sock->fd != INVALID_SOCKET) {
+ result = connection_reset_fix(sock->fd);
+ if (result != ISC_R_SUCCESS) {
+ socket_log(__LINE__, sock,
+ NULL, EVENT, NULL, 0, 0,
+ "closed %d %d %d "
+ "con_reset_fix_failed",
+ sock->pending_recv,
+ sock->pending_send,
+ sock->references);
+ closesocket(sock->fd);
+ _set_state(sock, SOCK_CLOSED);
+ sock->fd = INVALID_SOCKET;
+ free_socket(&sock, __LINE__);
+ return (result);
+ }
}
+ break;
+ case isc_sockettype_tcp:
+ sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP);
+ break;
}
- break;
- case isc_sockettype_tcp:
- sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP);
- break;
+ } else {
+ /*
+ * XXX: dup() is deprecated in windows, use _dup()
+ * instead. In future we may want to investigate
+ * WSADuplicateSocket().
+ */
+ sock->fd = _dup(dup_socket->fd);
+ sock->dupped = 1;
}
if (sock->fd == INVALID_SOCKET) {
@@ -1788,13 +1808,30 @@ isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
InterlockedIncrement(&manager->totalSockets);
UNLOCK(&manager->lock);
- socket_log(__LINE__, sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET,
- ISC_MSG_CREATED, "created %u type %u", sock->fd, type);
+ socket_log(__LINE__, sock, NULL, CREATION, isc_msgcat,
+ ISC_MSGSET_SOCKET, ISC_MSG_CREATED,
+ "created %u type %u", sock->fd, type);
return (ISC_R_SUCCESS);
}
isc_result_t
+isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
+ isc_socket_t **socketp)
+{
+ return (socket_create(manager, pf, type, socketp, NULL));
+}
+
+isc_result_t
+isc__socket_dup(isc_socket_t *sock, isc_socket_t **socketp) {
+ REQUIRE(VALID_SOCKET(sock));
+ REQUIRE(socketp != NULL && *socketp == NULL);
+
+ return (socket_create(sock->manager, sock->pf, sock->type,
+ socketp, sock));
+}
+
+isc_result_t
isc_socket_open(isc_socket_t *sock) {
REQUIRE(VALID_SOCKET(sock));
REQUIRE(sock->type != isc_sockettype_fdwatch);
@@ -3316,6 +3353,7 @@ isc__socket_accept(isc_socket_t *sock,
*/
isc_task_attach(task, &ntask);
if (isc_task_exiting(ntask)) {
+ free_socket(&nsock, __LINE__);
isc_task_detach(&ntask);
isc_event_free(ISC_EVENT_PTR(&adev));
UNLOCK(&sock->lock);
@@ -3790,6 +3828,11 @@ isc__socket_gettag(isc_socket_t *socket) {
return (socket->tag);
}
+int
+isc__socket_getfd(isc_socket_t *socket) {
+ return ((short) socket->fd);
+}
+
void
isc__socketmgr_setreserved(isc_socketmgr_t *manager, isc_uint32_t reserved) {
UNUSED(manager);
diff --git a/external/bsd/bind/dist/lib/isccfg/aclconf.c b/external/bsd/bind/dist/lib/isccfg/aclconf.c
index bd962eae75e..6dad898d8f2 100644
--- a/external/bsd/bind/dist/lib/isccfg/aclconf.c
+++ b/external/bsd/bind/dist/lib/isccfg/aclconf.c
@@ -1,7 +1,7 @@
-/* $NetBSD: aclconf.c,v 1.2 2011/02/16 03:47:17 christos Exp $ */
+/* $NetBSD: aclconf.c,v 1.3 2011/09/11 18:55:43 christos Exp $ */
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: aclconf.c,v 1.29 2010-08-13 23:47:03 tbox Exp */
+/* Id: aclconf.c,v 1.31 2011-06-17 23:47:49 tbox Exp */
#include <config.h>
@@ -35,39 +35,70 @@
#define LOOP_MAGIC ISC_MAGIC('L','O','O','P')
-void
-cfg_aclconfctx_init(cfg_aclconfctx_t *ctx) {
- ISC_LIST_INIT(ctx->named_acl_cache);
+isc_result_t
+cfg_aclconfctx_create(isc_mem_t *mctx, cfg_aclconfctx_t **ret) {
+ isc_result_t result;
+ cfg_aclconfctx_t *actx;
+
+ REQUIRE(mctx != NULL);
+ REQUIRE(ret != NULL && *ret == NULL);
+
+ actx = isc_mem_get(mctx, sizeof(*actx));
+ if (actx == NULL)
+ return (ISC_R_NOMEMORY);
+
+ result = isc_refcount_init(&actx->references, 1);
+ if (result != ISC_R_SUCCESS)
+ goto cleanup;
+
+ actx->mctx = NULL;
+ isc_mem_attach(mctx, &actx->mctx);
+ ISC_LIST_INIT(actx->named_acl_cache);
+
+ *ret = actx;
+ return (ISC_R_SUCCESS);
+
+ cleanup:
+ isc_mem_put(mctx, actx, sizeof(*actx));
+ return (result);
}
void
-cfg_aclconfctx_clear(cfg_aclconfctx_t *ctx) {
- dns_acl_t *dacl, *next;
+cfg_aclconfctx_attach(cfg_aclconfctx_t *src, cfg_aclconfctx_t **dest) {
+ REQUIRE(src != NULL);
+ REQUIRE(dest != NULL && *dest == NULL);
- for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
- dacl != NULL;
- dacl = next)
- {
- next = ISC_LIST_NEXT(dacl, nextincache);
- dns_acl_detach(&dacl);
- }
+ isc_refcount_increment(&src->references, NULL);
+ *dest = src;
}
void
-cfg_aclconfctx_clone(cfg_aclconfctx_t *src, cfg_aclconfctx_t *dest) {
+cfg_aclconfctx_detach(cfg_aclconfctx_t **actxp) {
+ cfg_aclconfctx_t *actx;
dns_acl_t *dacl, *next;
- REQUIRE(src != NULL && dest != NULL);
-
- cfg_aclconfctx_init(dest);
- for (dacl = ISC_LIST_HEAD(src->named_acl_cache);
- dacl != NULL;
- dacl = next)
- {
- dns_acl_t *copy;
- next = ISC_LIST_NEXT(dacl, nextincache);
- dns_acl_attach(dacl, &copy);
- ISC_LIST_APPEND(dest->named_acl_cache, copy, nextincache);
+ isc_mem_t *mctx;
+ unsigned int refs;
+
+ REQUIRE(actxp != NULL && *actxp != NULL);
+
+ actx = *actxp;
+ mctx = actx->mctx;
+
+ isc_refcount_decrement(&actx->references, &refs);
+ if (refs == 0) {
+ for (dacl = ISC_LIST_HEAD(actx->named_acl_cache);
+ dacl != NULL;
+ dacl = next)
+ {
+ next = ISC_LIST_NEXT(dacl, nextincache);
+ ISC_LIST_UNLINK(actx->named_acl_cache, dacl,
+ nextincache);
+ dns_acl_detach(&dacl);
+ }
+ isc_mem_putanddetach(&actx->mctx, actx, sizeof(*actx));
}
+
+ *actxp = NULL;
}
/*
diff --git a/external/bsd/bind/dist/lib/isccfg/include/isccfg/aclconf.h b/external/bsd/bind/dist/lib/isccfg/include/isccfg/aclconf.h
index f4a2fbeddde..d400c136d57 100644
--- a/external/bsd/bind/dist/lib/isccfg/include/isccfg/aclconf.h
+++ b/external/bsd/bind/dist/lib/isccfg/include/isccfg/aclconf.h
@@ -1,7 +1,7 @@
-/* $NetBSD: aclconf.h,v 1.2 2011/02/16 03:47:18 christos Exp $ */
+/* $NetBSD: aclconf.h,v 1.3 2011/09/11 18:55:43 christos Exp $ */
/*
- * Copyright (C) 2004-2007, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2010, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: aclconf.h,v 1.12 2010-08-13 23:47:04 tbox Exp */
+/* Id: aclconf.h,v 1.14 2011-06-17 23:47:49 tbox Exp */
#ifndef ISCCFG_ACLCONF_H
#define ISCCFG_ACLCONF_H 1
@@ -30,7 +30,8 @@
typedef struct cfg_aclconfctx {
ISC_LIST(dns_acl_t) named_acl_cache;
- ISC_LIST(dns_iptable_t) named_iptable_cache;
+ isc_mem_t *mctx;
+ isc_refcount_t references;
} cfg_aclconfctx_t;
/***
@@ -39,22 +40,23 @@ typedef struct cfg_aclconfctx {
ISC_LANG_BEGINDECLS
-void
-cfg_aclconfctx_init(cfg_aclconfctx_t *ctx);
+isc_result_t
+cfg_aclconfctx_create(isc_mem_t *mctx, cfg_aclconfctx_t **ret);
/*
- * Initialize an ACL configuration context.
+ * Creates and initializes an ACL configuration context.
*/
void
-cfg_aclconfctx_clone(cfg_aclconfctx_t *src, cfg_aclconfctx_t *dest);
+cfg_aclconfctx_detach(cfg_aclconfctx_t **actxp);
/*
- * Copy the contents of one ACL configuration context into another.
+ * Removes a reference to an ACL configuration context; when references
+ * reaches zero, clears the contents and deallocate the structure.
*/
void
-cfg_aclconfctx_clear(cfg_aclconfctx_t *ctx);
+cfg_aclconfctx_attach(cfg_aclconfctx_t *src, cfg_aclconfctx_t **dest);
/*
- * Clear the contents of an ACL configuration context.
+ * Attaches a pointer to an existing ACL configuration context.
*/
isc_result_t
diff --git a/external/bsd/bind/dist/lib/isccfg/namedconf.c b/external/bsd/bind/dist/lib/isccfg/namedconf.c
index 4ea799a0e97..918588823a1 100644
--- a/external/bsd/bind/dist/lib/isccfg/namedconf.c
+++ b/external/bsd/bind/dist/lib/isccfg/namedconf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: namedconf.c,v 1.2 2011/02/16 03:47:17 christos Exp $ */
+/* $NetBSD: namedconf.c,v 1.3 2011/09/11 18:55:43 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: namedconf.c,v 1.131.8.1 2011-02-03 05:50:08 marka Exp */
+/* Id: namedconf.c,v 1.139 2011-07-01 02:25:48 marka Exp */
/*! \file */
@@ -230,9 +230,8 @@ static cfg_type_t cfg_type_namesockaddrkeylist = {
};
/*%
- * A list of socket addresses with an optional default port,
- * as used in the also-notify option. E.g.,
- * "port 1234 { 10.0.0.1; 1::2 port 69; }"
+ * A list of socket addresses with an optional default port, as used
+ * in the lwresd 'listen-on' option. E.g., "{ 10.0.0.1; 1::2 port 69; }"
*/
static cfg_tuplefielddef_t portiplist_fields[] = {
{ "port", &cfg_type_optional_port, 0 },
@@ -240,8 +239,8 @@ static cfg_tuplefielddef_t portiplist_fields[] = {
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_portiplist = {
- "portiplist", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple,
- portiplist_fields
+ "portiplist", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
+ &cfg_rep_tuple, portiplist_fields
};
/*%
@@ -544,13 +543,24 @@ static cfg_type_t cfg_type_bracketed_sockaddrlist = {
&cfg_rep_list, &cfg_type_sockaddr
};
-static const char *autodnssec_enums[] = { "allow", "maintain", "create",
- "off", NULL };
+static const char *autodnssec_enums[] = { "allow", "maintain", "off", NULL };
static cfg_type_t cfg_type_autodnssec = {
"autodnssec", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, &autodnssec_enums
};
+static const char *dnssecupdatemode_enums[] = { "maintain", "no-resign", NULL };
+static cfg_type_t cfg_type_dnssecupdatemode = {
+ "dnssecupdatemode", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
+ &cfg_rep_string, &dnssecupdatemode_enums
+};
+
+static const char *updatemethods_enums[] = { "increment", "unixtime", NULL };
+static cfg_type_t cfg_type_updatemethod = {
+ "updatemethod", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
+ &cfg_rep_string, &updatemethods_enums
+};
+
static cfg_type_t cfg_type_rrsetorder = {
"rrsetorder", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list,
&cfg_rep_list, &cfg_type_rrsetorderingelement
@@ -596,7 +606,7 @@ static cfg_type_t cfg_type_forwardtype = {
static const char *zonetype_enums[] = {
"master", "slave", "stub", "static-stub", "hint", "forward",
- "delegation-only", NULL };
+ "delegation-only", "redirect", NULL };
static cfg_type_t cfg_type_zonetype = {
"zonetype", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, &zonetype_enums
@@ -1133,6 +1143,24 @@ static cfg_type_t cfg_type_rpz = {
* dnssec-lookaside
*/
+static void
+print_lookaside(cfg_printer_t *pctx, const cfg_obj_t *obj)
+{
+ const cfg_obj_t *domain = obj->value.tuple[0];
+
+ if (domain->value.string.length == 4 &&
+ strncmp(domain->value.string.base, "auto", 4) == 0)
+ cfg_print_cstr(pctx, "auto");
+ else
+ cfg_print_tuple(pctx, obj);
+}
+
+static void
+doc_lookaside(cfg_printer_t *pctx, const cfg_type_t *type) {
+ UNUSED(type);
+ cfg_print_cstr(pctx, "( <string> trust-anchor <string> | auto )");
+}
+
static keyword_type_t trustanchor_kw = { "trust-anchor", &cfg_type_astring };
static cfg_type_t cfg_type_optional_trustanchor = {
@@ -1147,7 +1175,7 @@ static cfg_tuplefielddef_t lookaside_fields[] = {
};
static cfg_type_t cfg_type_lookaside = {
- "lookaside", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
+ "lookaside", cfg_parse_tuple, print_lookaside, doc_lookaside,
&cfg_rep_tuple, lookaside_fields
};
@@ -1331,7 +1359,7 @@ zone_clauses[] = {
{ "allow-transfer", &cfg_type_bracketed_aml, 0 },
{ "allow-update", &cfg_type_bracketed_aml, 0 },
{ "allow-update-forwarding", &cfg_type_bracketed_aml, 0 },
- { "also-notify", &cfg_type_portiplist, 0 },
+ { "also-notify", &cfg_type_namesockaddrkeylist, 0 },
{ "alt-transfer-source", &cfg_type_sockaddr4wild, 0 },
{ "alt-transfer-source-v6", &cfg_type_sockaddr6wild, 0 },
{ "check-dup-records", &cfg_type_checkmode, 0 },
@@ -1343,7 +1371,9 @@ zone_clauses[] = {
{ "check-wildcard", &cfg_type_boolean, 0 },
{ "dialup", &cfg_type_dialuptype, 0 },
{ "dnssec-dnskey-kskonly", &cfg_type_boolean, 0 },
+ { "dnssec-loadkeys-interval", &cfg_type_uint32, 0 },
{ "dnssec-secure-to-insecure", &cfg_type_boolean, 0 },
+ { "dnssec-update-mode", &cfg_type_dnssecupdatemode, 0 },
{ "forward", &cfg_type_forwardtype, 0 },
{ "forwarders", &cfg_type_portiplist, 0 },
{ "key-directory", &cfg_type_qstring, 0 },
@@ -1366,6 +1396,7 @@ zone_clauses[] = {
{ "notify-source-v6", &cfg_type_sockaddr6wild, 0 },
{ "notify-to-soa", &cfg_type_boolean, 0 },
{ "nsec3-test-zone", &cfg_type_boolean, CFG_CLAUSEFLAG_TESTONLY },
+ { "serial-update-method", &cfg_type_updatemethod, 0 },
{ "sig-signing-nodes", &cfg_type_uint32, 0 },
{ "sig-signing-signatures", &cfg_type_uint32, 0 },
{ "sig-signing-type", &cfg_type_uint32, 0 },
@@ -2237,7 +2268,8 @@ static cfg_type_t cfg_type_controls_sockaddr = {
* statement, which takes a single key with or without braces and semicolon.
*/
static isc_result_t
-parse_server_key_kludge(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret)
+parse_server_key_kludge(cfg_parser_t *pctx, const cfg_type_t *type,
+ cfg_obj_t **ret)
{
isc_result_t result;
isc_boolean_t braces = ISC_FALSE;
@@ -2247,7 +2279,7 @@ parse_server_key_kludge(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_special &&
pctx->token.value.as_char == '{') {
- result = cfg_gettoken(pctx, 0);
+ CHECK(cfg_gettoken(pctx, 0));
braces = ISC_TRUE;
}
diff --git a/external/bsd/bind/dist/lib/isccfg/parser.c b/external/bsd/bind/dist/lib/isccfg/parser.c
index 16703437354..595db5757d2 100644
--- a/external/bsd/bind/dist/lib/isccfg/parser.c
+++ b/external/bsd/bind/dist/lib/isccfg/parser.c
@@ -1,4 +1,4 @@
-/* $NetBSD: parser.c,v 1.2 2011/02/16 03:47:17 christos Exp $ */
+/* $NetBSD: parser.c,v 1.3 2011/09/11 18:55:43 christos Exp $ */
/*
* Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: parser.c,v 1.139 2011-01-04 23:47:14 tbox Exp */
+/* Id: parser.c,v 1.141 2011-03-11 06:11:27 marka Exp */
/*! \file */
@@ -1906,6 +1906,7 @@ cfg_doc_netaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
cfg_print_chars(pctx, " | ", 3);
cfg_print_chars(pctx, "*", 1);
n++;
+ POST(n);
}
if (*flagp != CFG_ADDR_V4OK && *flagp != CFG_ADDR_V6OK)
cfg_print_chars(pctx, " )", 2);
@@ -1945,7 +1946,7 @@ cfg_parse_netprefix(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t *obj = NULL;
isc_result_t result;
isc_netaddr_t netaddr;
- unsigned int addrlen, prefixlen;
+ unsigned int addrlen = 0, prefixlen;
UNUSED(type);
CHECK(cfg_parse_rawaddr(pctx, CFG_ADDR_V4OK | CFG_ADDR_V4PREFIXOK |
@@ -1958,7 +1959,6 @@ cfg_parse_netprefix(cfg_parser_t *pctx, const cfg_type_t *type,
addrlen = 128;
break;
default:
- addrlen = 0;
INSIST(0);
break;
}
@@ -2008,8 +2008,12 @@ cfg_obj_isnetprefix(const cfg_obj_t *obj) {
void
cfg_obj_asnetprefix(const cfg_obj_t *obj, isc_netaddr_t *netaddr,
- unsigned int *prefixlen) {
+ unsigned int *prefixlen)
+{
REQUIRE(obj != NULL && obj->type->rep == &cfg_rep_netprefix);
+ REQUIRE(netaddr != NULL);
+ REQUIRE(prefixlen != NULL);
+
*netaddr = obj->value.netprefix.address;
*prefixlen = obj->value.netprefix.prefixlen;
}
@@ -2093,6 +2097,7 @@ cfg_doc_sockaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
cfg_print_chars(pctx, " | ", 3);
cfg_print_chars(pctx, "*", 1);
n++;
+ POST(n);
}
cfg_print_chars(pctx, " ) ", 3);
if (*flagp & CFG_ADDR_WILDOK) {
diff --git a/external/bsd/bind/dist/lib/lwres/assert_p.h b/external/bsd/bind/dist/lib/lwres/assert_p.h
index 063e42287b1..5d60d31fe63 100644
--- a/external/bsd/bind/dist/lib/lwres/assert_p.h
+++ b/external/bsd/bind/dist/lib/lwres/assert_p.h
@@ -1,7 +1,7 @@
-/* $NetBSD: assert_p.h,v 1.2 2011/02/16 03:47:18 christos Exp $ */
+/* $NetBSD: assert_p.h,v 1.3 2011/09/11 18:55:43 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000, 2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: assert_p.h,v 1.14 2007-06-19 23:47:22 tbox Exp */
+/* Id: assert_p.h,v 1.16 2011-03-12 04:59:49 tbox Exp */
#ifndef LWRES_ASSERT_P_H
#define LWRES_ASSERT_P_H 1
@@ -29,7 +29,8 @@
#define REQUIRE(x) assert(x)
#define INSIST(x) assert(x)
-#define UNUSED(x) ((void)&(x))
+#define UNUSED(x) ((void)(x))
+#define POST(x) ((void)(x))
#define SPACE_OK(b, s) (LWRES_BUFFER_AVAILABLECOUNT(b) >= (s))
#define SPACE_REMAINING(b, s) (LWRES_BUFFER_REMAINING(b) >= (s))
diff --git a/external/bsd/bind/dist/lib/lwres/herror.c b/external/bsd/bind/dist/lib/lwres/herror.c
index 9227b5819a0..7f672e6cac8 100644
--- a/external/bsd/bind/dist/lib/lwres/herror.c
+++ b/external/bsd/bind/dist/lib/lwres/herror.c
@@ -1,7 +1,7 @@
-/* $NetBSD: herror.c,v 1.2 2011/02/16 03:47:18 christos Exp $ */
+/* $NetBSD: herror.c,v 1.3 2011/09/11 18:55:43 christos Exp $ */
/*
- * Portions Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -74,7 +74,7 @@
#if defined(LIBC_SCCS) && !defined(lint)
static const char sccsid[] = "@(#)herror.c 8.1 (Berkeley) 6/4/93";
static const char rcsid[] =
- "Id: herror.c,v 1.17 2007-06-19 23:47:22 tbox Exp";
+ "Id: herror.c,v 1.19 2011-03-12 04:59:49 tbox Exp";
#endif /* LIBC_SCCS and not lint */
#include <config.h>
@@ -98,7 +98,7 @@ static const char *h_errlist[] = {
"No address associated with name", /*%< 4 NO_ADDRESS */
};
-static int h_nerr = { sizeof(h_errlist) / sizeof(h_errlist[0]) };
+static int h_nerr = sizeof(h_errlist) / sizeof(h_errlist[0]);
/*!
diff --git a/external/bsd/bind/dist/lib/lwres/lwconfig.c b/external/bsd/bind/dist/lib/lwres/lwconfig.c
index 89a8e2bc836..1f69109c939 100644
--- a/external/bsd/bind/dist/lib/lwres/lwconfig.c
+++ b/external/bsd/bind/dist/lib/lwres/lwconfig.c
@@ -1,7 +1,7 @@
-/* $NetBSD: lwconfig.c,v 1.2 2011/02/16 03:47:18 christos Exp $ */
+/* $NetBSD: lwconfig.c,v 1.3 2011/09/11 18:55:43 christos Exp $ */
/*
- * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: lwconfig.c,v 1.48 2008-12-17 23:47:58 tbox Exp */
+/* Id: lwconfig.c,v 1.50 2011-03-12 04:59:49 tbox Exp */
/*! \file */
@@ -591,6 +591,7 @@ lwres_conf_parse(lwres_context_t *ctx, const char *filename) {
stopchar = getword(fp, word, sizeof(word));
if (stopchar == EOF) {
rval = LWRES_R_SUCCESS;
+ POST(rval);
break;
}
diff --git a/external/bsd/bind/dist/lib/lwres/print.c b/external/bsd/bind/dist/lib/lwres/print.c
index 985d2f9a47f..b9fb6360ebd 100644
--- a/external/bsd/bind/dist/lib/lwres/print.c
+++ b/external/bsd/bind/dist/lib/lwres/print.c
@@ -1,7 +1,7 @@
-/* $NetBSD: print.c,v 1.2 2011/02/16 03:47:18 christos Exp $ */
+/* $NetBSD: print.c,v 1.3 2011/09/11 18:55:43 christos Exp $ */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: print.c,v 1.10 2007-06-19 23:47:22 tbox Exp */
+/* Id: print.c,v 1.12 2011-03-12 04:59:49 tbox Exp */
#include <config.h>
@@ -117,6 +117,7 @@ lwres__print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
width = precision = 0;
head = "";
length = pad = zeropad = 0;
+ POST(length);
do {
if (*format == '#') {
diff --git a/external/bsd/bind/include/config.h b/external/bsd/bind/include/config.h
index 8f5d24d0e8b..69f54e858da 100644
--- a/external/bsd/bind/include/config.h
+++ b/external/bsd/bind/include/config.h
@@ -17,7 +17,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* Id: config.h.in,v 1.143.8.1 2011-02-03 05:52:35 marka Exp */
+/* Id: config.h.in,v 1.147 2011-07-28 13:33:09 tbox Exp */
/*! \file */
@@ -160,6 +160,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to enable the "filter-aaaa-on-v4" option. */
/* #undef ALLOW_FILTER_AAAA_ON_V4 */
+/* define if ATF unit tests are to be built. */
+/* #undef ATF_TEST */
+
/* Define if recvmsg() does not meet all of the BSD socket API specifications.
*/
/* #undef BROKEN_RECVMSG */
@@ -219,7 +222,7 @@ int sigwait(const unsigned int *set, int *sig);
#define HAVE_GSSAPI_GSSAPI_H 1
/* Define to 1 if you have the <gssapi/gssapi_krb5.h> header file. */
-/* #undef HAVE_GSSAPI_GSSAPI_KRB5_H */
+#define HAVE_GSSAPI_GSSAPI_KRB5_H 1
/* Define to 1 if you have the <gssapi.h> header file. */
#define HAVE_GSSAPI_H 1
@@ -234,7 +237,7 @@ int sigwait(const unsigned int *set, int *sig);
/* #undef HAVE_KERBEROSV5_KRB5_H */
/* Define to 1 if you have the <krb5.h> header file. */
-/* #undef HAVE_KRB5_H */
+#define HAVE_KRB5_H 1
/* Define to 1 if you have the <krb5/krb5.h> header file. */
#define HAVE_KRB5_KRB5_H 1
@@ -251,9 +254,6 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to 1 if you have the `c_r' library (-lc_r). */
/* #undef HAVE_LIBC_R */
-/* Define to 1 if you have the `dl' library (-ldl). */
-/* #undef HAVE_LIBDL */
-
/* Define to 1 if you have the `nsl' library (-lnsl). */
/* #undef HAVE_LIBNSL */
@@ -362,6 +362,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to 1 if you have the <unistd.h> header file. */
#define HAVE_UNISTD_H 1
+/* Define to 1 if you have the `usleep' function. */
+#define HAVE_USLEEP 1
+
/* return type of gai_strerror */
#define IRS_GAISTRERROR_RETURN_T const char *
@@ -371,6 +374,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to the flags type used by getnameinfo(3). */
#define IRS_GETNAMEINFO_FLAGS_T int
+/* Define to allow building of objects for dlopen(). */
+#define ISC_DLZ_DLOPEN 1
+
/* Defined if extern char *optarg is not declared. */
/* #undef NEED_OPTARG */
@@ -400,6 +406,9 @@ int sigwait(const unsigned int *set, int *sig);
(O_NDELAY/O_NONBLOCK). */
#define PORT_NONBLOCK O_NONBLOCK
+/* The size of `void *', as computed by sizeof. */
+#define SIZEOF_VOID_P 8
+
/* Define to 1 if you have the ANSI C header files. */
#define STDC_HEADERS 1
diff --git a/external/bsd/bind/include/dns/code.h b/external/bsd/bind/include/dns/code.h
index 4d97162377b..127f929cd56 100644
--- a/external/bsd/bind/include/dns/code.h
+++ b/external/bsd/bind/include/dns/code.h
@@ -65,7 +65,7 @@
#include "rdata/generic/loc_29.c"
#include "rdata/generic/nxt_30.c"
#include "rdata/in_1/srv_33.c"
-#include "rdata/in_1/naptr_35.c"
+#include "rdata/generic/naptr_35.c"
#include "rdata/in_1/kx_36.c"
#include "rdata/generic/cert_37.c"
#include "rdata/in_1/a6_38.c"
@@ -86,6 +86,7 @@
#include "rdata/generic/unspec_103.c"
#include "rdata/generic/tkey_249.c"
#include "rdata/any_255/tsig_250.c"
+#include "rdata/generic/uri_256.c"
#include "rdata/generic/dlv_32769.c"
#include "rdata/generic/keydata_65533.c"
@@ -154,11 +155,7 @@
default: result = DNS_R_UNKNOWN; break; \
} \
break; \
- case 35: switch (rdclass) { \
- case 1: result = fromtext_in_naptr(rdclass, type, lexer, origin, options, target, callbacks); break; \
- default: result = DNS_R_UNKNOWN; break; \
- } \
- break; \
+ case 35: result = fromtext_naptr(rdclass, type, lexer, origin, options, target, callbacks); break; \
case 36: switch (rdclass) { \
case 1: result = fromtext_in_kx(rdclass, type, lexer, origin, options, target, callbacks); break; \
default: result = DNS_R_UNKNOWN; break; \
@@ -199,6 +196,7 @@
default: result = DNS_R_UNKNOWN; break; \
} \
break; \
+ case 256: result = fromtext_uri(rdclass, type, lexer, origin, options, target, callbacks); break; \
case 32769: result = fromtext_dlv(rdclass, type, lexer, origin, options, target, callbacks); break; \
case 65533: result = fromtext_keydata(rdclass, type, lexer, origin, options, target, callbacks); break; \
default: result = DNS_R_UNKNOWN; break; \
@@ -267,11 +265,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdata->rdclass) { \
- case 1: result = totext_in_naptr(rdata, tctx, target); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = totext_naptr(rdata, tctx, target); break; \
case 36: switch (rdata->rdclass) { \
case 1: result = totext_in_kx(rdata, tctx, target); break; \
default: use_default = ISC_TRUE; break; \
@@ -312,6 +306,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = totext_uri(rdata, tctx, target); break; \
case 32769: result = totext_dlv(rdata, tctx, target); break; \
case 65533: result = totext_keydata(rdata, tctx, target); break; \
default: use_default = ISC_TRUE; break; \
@@ -380,11 +375,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdclass) { \
- case 1: result = fromwire_in_naptr(rdclass, type, source, dctx, options, target); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = fromwire_naptr(rdclass, type, source, dctx, options, target); break; \
case 36: switch (rdclass) { \
case 1: result = fromwire_in_kx(rdclass, type, source, dctx, options, target); break; \
default: use_default = ISC_TRUE; break; \
@@ -425,6 +416,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = fromwire_uri(rdclass, type, source, dctx, options, target); break; \
case 32769: result = fromwire_dlv(rdclass, type, source, dctx, options, target); break; \
case 65533: result = fromwire_keydata(rdclass, type, source, dctx, options, target); break; \
default: use_default = ISC_TRUE; break; \
@@ -493,11 +485,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdata->rdclass) { \
- case 1: result = towire_in_naptr(rdata, cctx, target); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = towire_naptr(rdata, cctx, target); break; \
case 36: switch (rdata->rdclass) { \
case 1: result = towire_in_kx(rdata, cctx, target); break; \
default: use_default = ISC_TRUE; break; \
@@ -538,6 +526,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = towire_uri(rdata, cctx, target); break; \
case 32769: result = towire_dlv(rdata, cctx, target); break; \
case 65533: result = towire_keydata(rdata, cctx, target); break; \
default: use_default = ISC_TRUE; break; \
@@ -606,11 +595,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdata1->rdclass) { \
- case 1: result = compare_in_naptr(rdata1, rdata2); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = compare_naptr(rdata1, rdata2); break; \
case 36: switch (rdata1->rdclass) { \
case 1: result = compare_in_kx(rdata1, rdata2); break; \
default: use_default = ISC_TRUE; break; \
@@ -651,6 +636,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = compare_uri(rdata1, rdata2); break; \
case 32769: result = compare_dlv(rdata1, rdata2); break; \
case 65533: result = compare_keydata(rdata1, rdata2); break; \
default: use_default = ISC_TRUE; break; \
@@ -719,11 +705,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdata1->rdclass) { \
- case 1: result = casecompare_in_naptr(rdata1, rdata2); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = casecompare_naptr(rdata1, rdata2); break; \
case 36: switch (rdata1->rdclass) { \
case 1: result = casecompare_in_kx(rdata1, rdata2); break; \
default: use_default = ISC_TRUE; break; \
@@ -764,6 +746,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = casecompare_uri(rdata1, rdata2); break; \
case 32769: result = casecompare_dlv(rdata1, rdata2); break; \
case 65533: result = casecompare_keydata(rdata1, rdata2); break; \
default: use_default = ISC_TRUE; break; \
@@ -832,11 +815,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdclass) { \
- case 1: result = fromstruct_in_naptr(rdclass, type, source, target); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = fromstruct_naptr(rdclass, type, source, target); break; \
case 36: switch (rdclass) { \
case 1: result = fromstruct_in_kx(rdclass, type, source, target); break; \
default: use_default = ISC_TRUE; break; \
@@ -877,6 +856,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = fromstruct_uri(rdclass, type, source, target); break; \
case 32769: result = fromstruct_dlv(rdclass, type, source, target); break; \
case 65533: result = fromstruct_keydata(rdclass, type, source, target); break; \
default: use_default = ISC_TRUE; break; \
@@ -945,11 +925,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdata->rdclass) { \
- case 1: result = tostruct_in_naptr(rdata, target, mctx); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = tostruct_naptr(rdata, target, mctx); break; \
case 36: switch (rdata->rdclass) { \
case 1: result = tostruct_in_kx(rdata, target, mctx); break; \
default: use_default = ISC_TRUE; break; \
@@ -990,6 +966,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = tostruct_uri(rdata, target, mctx); break; \
case 32769: result = tostruct_dlv(rdata, target, mctx); break; \
case 65533: result = tostruct_keydata(rdata, target, mctx); break; \
default: use_default = ISC_TRUE; break; \
@@ -1058,11 +1035,7 @@
default: break; \
} \
break; \
- case 35: switch (common->rdclass) { \
- case 1: freestruct_in_naptr(source); break; \
- default: break; \
- } \
- break; \
+ case 35: freestruct_naptr(source); break; \
case 36: switch (common->rdclass) { \
case 1: freestruct_in_kx(source); break; \
default: break; \
@@ -1103,6 +1076,7 @@
default: break; \
} \
break; \
+ case 256: freestruct_uri(source); break; \
case 32769: freestruct_dlv(source); break; \
case 65533: freestruct_keydata(source); break; \
default: break; \
@@ -1171,11 +1145,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdata->rdclass) { \
- case 1: result = additionaldata_in_naptr(rdata, add, arg); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = additionaldata_naptr(rdata, add, arg); break; \
case 36: switch (rdata->rdclass) { \
case 1: result = additionaldata_in_kx(rdata, add, arg); break; \
default: use_default = ISC_TRUE; break; \
@@ -1216,6 +1186,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = additionaldata_uri(rdata, add, arg); break; \
case 32769: result = additionaldata_dlv(rdata, add, arg); break; \
case 65533: result = additionaldata_keydata(rdata, add, arg); break; \
default: use_default = ISC_TRUE; break; \
@@ -1284,11 +1255,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdata->rdclass) { \
- case 1: result = digest_in_naptr(rdata, digest, arg); break; \
- default: use_default = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = digest_naptr(rdata, digest, arg); break; \
case 36: switch (rdata->rdclass) { \
case 1: result = digest_in_kx(rdata, digest, arg); break; \
default: use_default = ISC_TRUE; break; \
@@ -1329,6 +1296,7 @@
default: use_default = ISC_TRUE; break; \
} \
break; \
+ case 256: result = digest_uri(rdata, digest, arg); break; \
case 32769: result = digest_dlv(rdata, digest, arg); break; \
case 65533: result = digest_keydata(rdata, digest, arg); break; \
default: use_default = ISC_TRUE; break; \
@@ -1397,11 +1365,7 @@
default: result = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdclass) { \
- case 1: result = checkowner_in_naptr(name, rdclass, type, wildcard); break; \
- default: result = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = checkowner_naptr(name, rdclass, type, wildcard); break; \
case 36: switch (rdclass) { \
case 1: result = checkowner_in_kx(name, rdclass, type, wildcard); break; \
default: result = ISC_TRUE; break; \
@@ -1442,6 +1406,7 @@
default: result = ISC_TRUE; break; \
} \
break; \
+ case 256: result = checkowner_uri(name, rdclass, type, wildcard); break; \
case 32769: result = checkowner_dlv(name, rdclass, type, wildcard); break; \
case 65533: result = checkowner_keydata(name, rdclass, type, wildcard); break; \
default: result = ISC_TRUE; break; \
@@ -1510,11 +1475,7 @@
default: result = ISC_TRUE; break; \
} \
break; \
- case 35: switch (rdata->rdclass) { \
- case 1: result = checknames_in_naptr(rdata, owner, bad); break; \
- default: result = ISC_TRUE; break; \
- } \
- break; \
+ case 35: result = checknames_naptr(rdata, owner, bad); break; \
case 36: switch (rdata->rdclass) { \
case 1: result = checknames_in_kx(rdata, owner, bad); break; \
default: result = ISC_TRUE; break; \
@@ -1555,6 +1516,7 @@
default: result = ISC_TRUE; break; \
} \
break; \
+ case 256: result = checknames_uri(rdata, owner, bad); break; \
case 32769: result = checknames_dlv(rdata, owner, bad); break; \
case 65533: result = checknames_keydata(rdata, owner, bad); break; \
default: result = ISC_TRUE; break; \
@@ -1750,6 +1712,9 @@
case 68: \
RDATATYPE_COMPARE("any", 255, _typename, _length, _typep); \
break; \
+ case 56: \
+ RDATATYPE_COMPARE("uri", 256, _typename, _length, _typep); \
+ break; \
}
#define RDATATYPE_ATTRIBUTE_SW \
switch (type) { \
@@ -1817,6 +1782,7 @@
case 253: return (DNS_RDATATYPEATTR_META | DNS_RDATATYPEATTR_QUESTIONONLY); \
case 254: return (DNS_RDATATYPEATTR_META | DNS_RDATATYPEATTR_QUESTIONONLY); \
case 255: return (DNS_RDATATYPEATTR_META | DNS_RDATATYPEATTR_QUESTIONONLY); \
+ case 256: return (RRTYPE_URI_ATTRIBUTES); \
case 32769: return (RRTYPE_DLV_ATTRIBUTES); \
case 65533: return (RRTYPE_KEYDATA_ATTRIBUTES); \
}
@@ -1886,6 +1852,7 @@
case 253: return (str_totext("MAILB", target)); \
case 254: return (str_totext("MAILA", target)); \
case 255: return (str_totext("ANY", target)); \
+ case 256: return (str_totext("URI", target)); \
case 32769: return (str_totext("DLV", target)); \
case 65533: return (str_totext("KEYDATA", target)); \
}
diff --git a/external/bsd/bind/include/dns/enumtype.h b/external/bsd/bind/include/dns/enumtype.h
index 429362345de..b76ddedb20f 100644
--- a/external/bsd/bind/include/dns/enumtype.h
+++ b/external/bsd/bind/include/dns/enumtype.h
@@ -81,6 +81,7 @@ enum {
dns_rdatatype_unspec = 103,
dns_rdatatype_tkey = 249,
dns_rdatatype_tsig = 250,
+ dns_rdatatype_uri = 256,
dns_rdatatype_dlv = 32769,
dns_rdatatype_keydata = 65533,
dns_rdatatype_ixfr = 251,
@@ -143,6 +144,7 @@ enum {
#define dns_rdatatype_unspec ((dns_rdatatype_t)dns_rdatatype_unspec)
#define dns_rdatatype_tkey ((dns_rdatatype_t)dns_rdatatype_tkey)
#define dns_rdatatype_tsig ((dns_rdatatype_t)dns_rdatatype_tsig)
+#define dns_rdatatype_uri ((dns_rdatatype_t)dns_rdatatype_uri)
#define dns_rdatatype_dlv ((dns_rdatatype_t)dns_rdatatype_dlv)
#define dns_rdatatype_keydata ((dns_rdatatype_t)dns_rdatatype_keydata)
#define dns_rdatatype_ixfr ((dns_rdatatype_t)dns_rdatatype_ixfr)
diff --git a/external/bsd/bind/include/dns/rdatastruct.h b/external/bsd/bind/include/dns/rdatastruct.h
index d99d7efd97d..a66b3c9d392 100644
--- a/external/bsd/bind/include/dns/rdatastruct.h
+++ b/external/bsd/bind/include/dns/rdatastruct.h
@@ -1176,7 +1176,7 @@ typedef struct dns_rdata_in_srv {
#endif /* IN_1_SRV_33_H */
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -1192,15 +1192,15 @@ typedef struct dns_rdata_in_srv {
* PERFORMANCE OF THIS SOFTWARE.
*/
-#ifndef IN_1_NAPTR_35_H
-#define IN_1_NAPTR_35_H 1
+#ifndef GENERIC_NAPTR_35_H
+#define GENERIC_NAPTR_35_H 1
-/* Id: naptr_35.h,v 1.23 2007-06-19 23:47:17 tbox Exp */
+/* Id: naptr_35.h,v 1.2 2011-08-16 23:46:36 tbox Exp */
-/*!
+/*!
* \brief Per RFC2915 */
-typedef struct dns_rdata_in_naptr {
+typedef struct dns_rdata_naptr {
dns_rdatacommon_t common;
isc_mem_t *mctx;
isc_uint16_t order;
@@ -1212,9 +1212,9 @@ typedef struct dns_rdata_in_naptr {
char *regexp;
isc_uint8_t regexp_len;
dns_name_t replacement;
-} dns_rdata_in_naptr_t;
+} dns_rdata_naptr_t;
-#endif /* IN_1_NAPTR_35_H */
+#endif /* GENERIC_NAPTR_35_H */
/*
* Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
@@ -1707,7 +1707,7 @@ typedef struct dns_rdata_in_dhcid {
#endif /* IN_1_DHCID_49_H */
/*
- * Copyright (C) 2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -1726,7 +1726,7 @@ typedef struct dns_rdata_in_dhcid {
#ifndef GENERIC_NSEC3_50_H
#define GENERIC_NSEC3_50_H 1
-/* Id: nsec3_50.h,v 1.4 2008-09-25 04:02:39 tbox Exp */
+/* Id: nsec3_50.h,v 1.6 2011-06-10 23:47:32 tbox Exp */
/*!
* \brief Per RFC 5155 */
@@ -1754,7 +1754,16 @@ typedef struct dns_rdata_nsec3 {
#define DNS_NSEC3FLAG_OPTOUT 0x01U
/*%
- * Non-standard, NSEC3PARAM only.
+ * The following flags are used in the private-type record (implemented in
+ * lib/dns/private.c) which is used to store NSEC3PARAM data during the
+ * time when it is not legal to have an actual NSEC3PARAM record in the
+ * zone. They are defined here because the private-type record uses the
+ * same flags field for the OPTOUT flag above and for the private flags
+ * below. XXX: This should be considered for refactoring.
+ */
+
+/*%
+ * Non-standard, private type only.
*
* Create a corresponding NSEC3 chain.
* Once the NSEC3 chain is complete this flag will be removed to signal
@@ -1763,13 +1772,14 @@ typedef struct dns_rdata_nsec3 {
* This flag is automatically set when a NSEC3PARAM record is added to
* the zone via UPDATE.
*
- * NSEC3PARAM records with this flag set are supposed to be ignored by
- * RFC 5155 compliant nameservers.
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
*/
#define DNS_NSEC3FLAG_CREATE 0x80U
/*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
*
* The corresponding NSEC3 set is to be removed once the NSEC chain
* has been generated.
@@ -1777,24 +1787,39 @@ typedef struct dns_rdata_nsec3 {
* This flag is automatically set when the last active NSEC3PARAM record
* is removed from the zone via UPDATE.
*
- * NSEC3PARAM records with this flag set are supposed to be ignored by
- * RFC 5155 compliant nameservers.
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
*/
#define DNS_NSEC3FLAG_REMOVE 0x40U
/*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
+ *
+ * When set with the CREATE flag, a corresponding NSEC3 chain will be
+ * created when the zone becomes capable of supporting one (i.e., when it
+ * has a DNSKEY RRset containing at least one NSEC3-capable algorithm).
+ * Without this flag, NSEC3 chain creation would be attempted immediately,
+ * fail, and the private type record would be removed. With it, the NSEC3
+ * parameters are stored until they can be used. When the zone has the
+ * necessary prerequisites for NSEC3, then the INITIAL flag can be cleared,
+ * and the record will be cleaned up normally.
*
- * Used to identify NSEC3PARAM records added in this UPDATE request.
+ * NSEC3PARAM records containing this flag should never be published, but
+ * if they are, they should be ignored by RFC 5155 compliant nameservers.
*/
-#define DNS_NSEC3FLAG_UPDATE 0x20U
+#define DNS_NSEC3FLAG_INITIAL 0x20U
/*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
*
* Prevent the creation of a NSEC chain before the last NSEC3 chain
* is removed. This will normally only be set when the zone is
* transitioning from secure with NSEC3 chains to insecure.
+ *
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
*/
#define DNS_NSEC3FLAG_NONSEC 0x10U
@@ -2046,6 +2071,37 @@ typedef struct dns_rdata_any_tsig {
#endif /* ANY_255_TSIG_250_H */
/*
+ * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef GENERIC_URI_256_H
+#define GENERIC_URI_256_H 1
+
+/* Id: uri_256.h,v 1.2 2011-03-03 14:10:27 fdupont Exp */
+
+typedef struct dns_rdata_uri {
+ dns_rdatacommon_t common;
+ isc_mem_t * mctx;
+ isc_uint16_t priority;
+ isc_uint16_t weight;
+ unsigned char * target;
+ isc_uint16_t tgt_len;
+} dns_rdata_uri_t;
+
+#endif /* GENERIC_URI_256_H */
+/*
* Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
diff --git a/external/bsd/bind/include/isc/platform.h b/external/bsd/bind/include/isc/platform.h
index 57be63ebdda..97457bb20c6 100644
--- a/external/bsd/bind/include/isc/platform.h
+++ b/external/bsd/bind/include/isc/platform.h
@@ -221,18 +221,22 @@
* the GSSAPI header.
*/
+#define ISC_PLATFORM_GSSAPIHEADER <gssapi/gssapi.h>
/*
* Defined to <gssapi_krb5.h> or <gssapi/gssapi_krb5.h> for how to
* include the GSSAPI KRB5 header.
*/
+#define ISC_PLATFORM_GSSAPI_KRB5_HEADER <gssapi/gssapi_krb5.h>
+
/*
* Defined to <krb5.h> or <krb5/krb5.h> for how to include
* the KRB5 header.
*/
+#define ISC_PLATFORM_KRB5HEADER <krb5/krb5.h>
/*
* Type used for resource limits.
diff --git a/external/bsd/bind/lib/libbind9/shlib_version b/external/bsd/bind/lib/libbind9/shlib_version
index f49a08f0c57..99425dc8c59 100644
--- a/external/bsd/bind/lib/libbind9/shlib_version
+++ b/external/bsd/bind/lib/libbind9/shlib_version
@@ -1,5 +1,5 @@
-# $NetBSD: shlib_version,v 1.6 2011/02/16 03:47:21 christos Exp $
+# $NetBSD: shlib_version,v 1.7 2011/09/11 18:55:44 christos Exp $
# Remember to update distrib/sets/lists/base/shl.* when changing
#
major=5
-minor=3
+minor=6
diff --git a/external/bsd/bind/lib/libdns/Makefile b/external/bsd/bind/lib/libdns/Makefile
index 76527a6a05e..a2ac4a4f234 100644
--- a/external/bsd/bind/lib/libdns/Makefile
+++ b/external/bsd/bind/lib/libdns/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.4 2011/06/20 07:43:57 mrg Exp $
+# $NetBSD: Makefile,v 1.5 2011/09/11 18:55:44 christos Exp $
LIB=dns
@@ -31,6 +31,6 @@ SRCS= acl.c acache.c adb.c byaddr.c cache.c callbacks.c compress.c \
request.c resolver.c result.c rootns.c rpz.c rriterator.c sdb.c soa.c \
ssu.c ssu_external.c stats.c tcpmsg.c time.c timer.c tkey.c tsig.c \
ttl.c private.c validator.c version.c view.c xfrin.c zone.c zonekey.c \
- zt.c ${DNSSEC_SRCS}
+ zt.c sdlz.c update.c ${DNSSEC_SRCS}
.include <bsd.lib.mk>
diff --git a/external/bsd/bind/lib/libdns/shlib_version b/external/bsd/bind/lib/libdns/shlib_version
index 1115befece0..fabfe8770e1 100644
--- a/external/bsd/bind/lib/libdns/shlib_version
+++ b/external/bsd/bind/lib/libdns/shlib_version
@@ -1,5 +1,5 @@
-# $NetBSD: shlib_version,v 1.8 2011/07/05 22:05:36 spz Exp $
+# $NetBSD: shlib_version,v 1.9 2011/09/11 18:55:44 christos Exp $
# Remember to update distrib/sets/lists/base/shl.* when changing
#
major=5
-minor=5
+minor=6
diff --git a/external/bsd/bind/lib/libisc/shlib_version b/external/bsd/bind/lib/libisc/shlib_version
index a3d5f5d2211..f61565a687d 100644
--- a/external/bsd/bind/lib/libisc/shlib_version
+++ b/external/bsd/bind/lib/libisc/shlib_version
@@ -1,5 +1,5 @@
-# $NetBSD: shlib_version,v 1.7 2011/05/29 15:17:10 spz Exp $
+# $NetBSD: shlib_version,v 1.8 2011/09/11 18:55:44 christos Exp $
# Remember to update distrib/sets/lists/base/shl.* when changing
#
major=5
-minor=4
+minor=6
diff --git a/external/bsd/bind/lib/libisccc/shlib_version b/external/bsd/bind/lib/libisccc/shlib_version
index 5aba22efb49..99425dc8c59 100644
--- a/external/bsd/bind/lib/libisccc/shlib_version
+++ b/external/bsd/bind/lib/libisccc/shlib_version
@@ -1,5 +1,5 @@
-# $NetBSD: shlib_version,v 1.6 2011/02/16 03:47:22 christos Exp $
+# $NetBSD: shlib_version,v 1.7 2011/09/11 18:55:44 christos Exp $
# Remember to update distrib/sets/lists/base/shl.* when changing
#
major=5
-minor=3
+minor=6
diff --git a/external/bsd/bind/lib/libisccfg/shlib_version b/external/bsd/bind/lib/libisccfg/shlib_version
index 5aba22efb49..99425dc8c59 100644
--- a/external/bsd/bind/lib/libisccfg/shlib_version
+++ b/external/bsd/bind/lib/libisccfg/shlib_version
@@ -1,5 +1,5 @@
-# $NetBSD: shlib_version,v 1.6 2011/02/16 03:47:22 christos Exp $
+# $NetBSD: shlib_version,v 1.7 2011/09/11 18:55:44 christos Exp $
# Remember to update distrib/sets/lists/base/shl.* when changing
#
major=5
-minor=3
+minor=6
diff --git a/external/bsd/bind/lib/liblwres/shlib_version b/external/bsd/bind/lib/liblwres/shlib_version
index 5aba22efb49..99425dc8c59 100644
--- a/external/bsd/bind/lib/liblwres/shlib_version
+++ b/external/bsd/bind/lib/liblwres/shlib_version
@@ -1,5 +1,5 @@
-# $NetBSD: shlib_version,v 1.6 2011/02/16 03:47:22 christos Exp $
+# $NetBSD: shlib_version,v 1.7 2011/09/11 18:55:44 christos Exp $
# Remember to update distrib/sets/lists/base/shl.* when changing
#
major=5
-minor=3
+minor=6