Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/external/bsd/nsd/dist 3 December 2019: Wouter
details: https://anonhg.NetBSD.org/src/rev/66dac6217dcd
branches: trunk
changeset: 847238:66dac6217dcd
user: christos <christos%NetBSD.org@localhost>
date: Sun Dec 15 16:00:52 2019 +0000
description:
3 December 2019: Wouter
- Fix #52: do not log transient network full errors unless higher
verbosity is set.
- Fix checkconf test for new error output string.
- tag for 4.2.4rc1 release.
27 November 2017 Jeroen
- Fix regressions in configparser.y
22 November 2019: Wouter
- Fix #48: Add make distclean that removes config.h made by configure.
And add maintainer-clean that removes bison and flex output.
18 November 2019: Wouter
- Detect fixed time memcmp for openssl 0.9.8 compatibility.
- Detect EC_KEY_new_by_curve_name for openssl 0.9.8.
- include limits.h for UINT_MAX.
- If no recvmmsg, dont use msg_flags member, but errno for error,
where our fallback function left it, msg_flags also does not exist
on some systems.
- Remove unused variable warning for portability.
14 November 2019: Wouter
- Fix checkconf test with filenames that sort in the same order.
- Tag for 4.2.3rc1. Branch master is 4.2.4 in development.
11 November 2019: Wouter
- Fix #44: document that remote-control is a top-level nsd.conf
attribute.
- Fix compile on OSX.
- Fix for #44: nicer top-level clause documentation.
22 October 2019: Jeroen
- Number of different UDP handlers has been reduced to one. recvmmsg
and sendmmsg implementations are now used on all platforms.
Compatible implementations are in place for systems that lack the
system calls.
- Socket options are now set in designated functions for easy reuse.
- Socket setup has been simplified for easy reuse.
- Configuration parser is now aware of the context in which an option
was specified.
21 October 2019: Wouter
- For #21 add
contrib/patch_for_s6_startup_and_other_service_supervisors.diff
that adds support for readiness notification with READY_FD from
Cameron Nemo.
17 October 2019: Jeroen
- Fix #40: Merge small fixes for confine-to-zone by Greg Bock.
15 October 2019: Jeroen
- For #39: Merge confine-to-zone feature contributes by Greg Bock.
26 September 2019: Wouter
- Fix #38: log address and failure reason with tls handshake errors,
squelches (the same as unbound) some unless high verbosity is used.
- Fixup clang analysis warning in xfrd_parse_received_xfr_packet
master dereference.
25 September 2019: Wouter
- The nsd.conf includes are sorted ascending, for include statements
with a '*' from glob.
16 September 2019: Wouter
- Fixup warnings during --disable-ipv6 compile.
- Fixup unit test executable to run without IPv6.
4 September 2019: Wouter
- Fix #35: excessive logging of ixfr failures, it stops the log when
fallback to axfr is possible. log is enabled at high verbosity.
2 September 2019: Wouter
- For #21: pidfile "" allows to run NSD without a pidfile, for
startup management tools like daemontools.
28 August 2019: Wouter
- In tests check for tls test tool availability.
19 August 2019: Wouter
- Tag for 4.2.2 release. Git master contains 4.2.3 in development.
13 August 2019: Wouter
- Fix error message for out of zone data to have more information.
- Tag for 4.2.2rc2.
12 August 2019: Wouter
- Fix #33: Fix segfault in service of remaining streams on exit.
6 August 2019: Wouter
- Tag for 4.2.2rc1.
5 August 2019: Wouter
- PR #31: nsd-control: Add missing stdio header.
- PR #32: tsig: Fix compilation without HAVE_SSL.
- Cleanup tls context on xfrd exit.
31 July 2019: Wouter
- Fix #29: SSHFP check NULL pointer dereference.
- Fix #30: SSHFP check failure due to missing domain name.
- Fix to timeval_add in minievent for remaining second in microseconds.
22 July 2019: Wouter
- Set timeout for refetch immediately, only spread load when there
are retries.
19 July 2019: Wouter
- Set no renegotiation on the SSL context to stop client
session renegotiation.
18 July 2019: Wouter
- Fix #25: NSD doesn't refresh zones after extended downtime,
it refreshes the old zones, with a random delay of a couple of
seconds to spread the load.
- Fix so that expired zones stay expired when server is down a
long time.
17 July 2019: Wouter
- Fix that NSD warns for wrong length of the hash in SSHFP records.
15 July 2019: Wouter
- PR #23: Fix typo in nsd.conf man-page.
4 July 2019: Wouter
- Set version to 4.2.2 in development.
- clean memory on exit of nsd-checkzone for memory debug.
- Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the
dname_concatenate() function. Reported by Frederic Cambus.
It causes the zone parser to crash on a malformed zone file,
with assertions enabled, an assertion catches it.
- Fix #19: Out-of-bounds read caused by improper validation of
array index. Reported by Frederic Cambus. The zone parser
fails on type SIG because of mismatched definition with RRSIG.
2 July 2019: Wouter
- Tag for 4.2.1rc1
27 June 2019: Wouter
- Fix unit test for added options and no dot after zone updated
log message.
- Fix compile without accept4.
21 June 2019: Wouter
- Omit remaining tcp processing if the list is empty.
- Fix output of nsd-checkconf -h.
20 June 2019: Wouter
- Initialize event structures before event_set, to stop uninitialized
values from setting event library lists and assertions, that would
sometimes also show after event_del.
- Added num.tls and num.tls6 stat counters.
- PR #12: send-buffer-size, receive-buffer-size,
tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek.
- Do not use symbol from libc, instead use own replacement, if not
available, for accept4.
- Fix #14, tcp connections have 1/10 to be active and have to work
every second, and then they get time to complete during a reload,
this is a process that lingers with the old version during a version
update.
19 June 2019: Wouter
- Fix tls handshake event callback function mistake, reported
by Mykhailo Danylenko.
18 June 2019: Wouter
- Fix #15: crash in SSL library, initialize variables for TCP access
when TLS is configured.
14 June 2019: Wouter
- Fix to init event not pointer, in reassignment.
12 June 2019: Wouter
- Fix to init event structure for reassignment.
11 June 2019: Wouter
- NSD 4.2.0 release. Current development is 4.2.1.
- Fixup of RELNOTES, corrected RFC reference for 4892.
- Fix #13: Stray dot at the end of some log entries, removes dot
after updated serial number in log entry.
- Fix TLS cipher selection, the previous was redundant, prefers
CHACHA20-POLY1305 over AESGCM and was not as readable as it could be.
- Consolidate server tls context create and remote control context
create, with hardening for the remote control tls context too.
6 June 2019: Wouter
- NSD 4.2.0rc1 tag.
4 June 2019: Wouter
- Fix unit test for outgoing interface to use random port numbers for
the outgoing interface config.
29 May 2019: Wouter
- Fix to guard _OPENBSD_SOURCE from redefinition.
28 May 2019: Wouter
- Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.
16 May 2019: Wouter
- Fix #10: Fix memory leaks caused by duplicate rr and include
instructions.
6 May 2019: Wouter
- Note CII best practices badge for NSD on the README.md.
2 May 2019: Wouter
- Fix .gitignore for unit test generated files.
- Fix checkconf unit test for hide-identity and tls.
1 May 2019: Wouter
- Fix makedist.sh for use with git.
- Nicer output on travis for clang analysis.
- Add .gitignore file to exclude built files from version tracking.
- Add README.md file in repository with compile instructions.
- Fix .gitignore for dnstap files and aclocal temp.
- Add aclocal to README.md for pkgconfig for some configure options.
25 April 2019: Wouter
- Add tls.tpkg unit test for DNS over TLS functionality.
18 April 2019: Wouter
- Fix to avoid buffer alloc with global buffer in tls write handler.
- Fix to initialize event structure when accepting TCP connection.
- Use travis for build check, initial unit test and clang analysis.
- Disable SSLv2,3,TLSv1.0,1.1 if TLS1.2 is available in libssl.
- Disable weak ciphers, enable CIPHER_SERVER_PREFERENCE.
- further setup ssl ctx after the keys are loaded, for ECDH.
- TLS OCSP stapling support, enabled with tls-service-ocsp: filename,
patch from Andreas Schulze.
17 April 2019: Wouter
- Fix to share openssl init code, and perform it once.
16 April 2019: Andreas via Sara
- Patch to add support for TCP Fast Open
- Patch to add support for tls service on a specified tls port
16 April 2019: Wouter
- Fix #4249: The option hide-identity: yes stops NSD from responding
with the hostname for chaos class queries. Implements the RFC4829
security considerations.
- Remove starttls, this signalling method was not standardized.
- Remove TO bit, this signalling method was not standardized.
- Remove unused first_query and tls_ok states.
- Remove sign-compare warning in tls packet send code.
- Fix spelling in comment and log printout.
- Fix potential uninitialized variable.
- Fix documentation for DNS over TLS, and set default port 853.
- Fix to add missing comment.
- Fix that the TLS handshake routine sets the correct event to
continue when done.
- Fix that TLS renegotiation calls the read and write routines again
with the same parameters when the desired event has been satisfied.
- Fix that TCP Fastopen has better error message and supports OSX.
- Fix log for fastopen with verbosity.
- Squelch TLS handshake failure log until verbosity 3.
- Add per-zone statistics for TLS queries, and dnstap for TLS queries,
and rcode and TCflag statistics for TCP and TLS queries.
25 March 2019: Wouter
- Print IP address when bind socket fails with error.
21 March 2019: Wouter
- Fix spelling error in release notes.
- Fix to delete unused zparser.default_apex member.
diffstat:
external/bsd/nsd/dist/.buildkite/pipeline.yml | 7 +
external/bsd/nsd/dist/.travis.yml | 66 +
external/bsd/nsd/dist/Makefile.in | 8 +-
external/bsd/nsd/dist/README.md | 42 +
external/bsd/nsd/dist/config.h.in | 34 +-
external/bsd/nsd/dist/configlexer.lex | 29 +-
external/bsd/nsd/dist/configparser.y | 1761 ++++-----
external/bsd/nsd/dist/configure | 207 +-
external/bsd/nsd/dist/contrib/README | 4 +
external/bsd/nsd/dist/contrib/patch_for_s6_startup_and_other_service_supervisors.diff | 89 +
external/bsd/nsd/dist/dns.c | 8 +-
external/bsd/nsd/dist/doc/CREDITS | 1 +
external/bsd/nsd/dist/doc/ChangeLog | 268 +-
external/bsd/nsd/dist/doc/README | 10 +-
external/bsd/nsd/dist/doc/RELNOTES | 144 +-
external/bsd/nsd/dist/doc/REQUIREMENTS | 4 +-
external/bsd/nsd/dist/doc/TODO | 2 +-
external/bsd/nsd/dist/doc/differences.tex | 2 +-
external/bsd/nsd/dist/ipc.c | 9 +-
external/bsd/nsd/dist/mini_event.c | 5 +-
external/bsd/nsd/dist/mkinstalldirs | 2 +-
external/bsd/nsd/dist/nsd-checkconf.8.in | 2 +-
external/bsd/nsd/dist/nsd-checkconf.c | 24 +-
external/bsd/nsd/dist/nsd-checkzone.8.in | 2 +-
external/bsd/nsd/dist/nsd-checkzone.c | 4 +
external/bsd/nsd/dist/nsd-control.8.in | 10 +-
external/bsd/nsd/dist/nsd-control.c | 10 +-
external/bsd/nsd/dist/nsd.8.in | 4 +-
external/bsd/nsd/dist/nsd.c | 350 +-
external/bsd/nsd/dist/nsd.conf.5.in | 80 +-
external/bsd/nsd/dist/nsd.conf.sample.in | 31 +-
external/bsd/nsd/dist/nsd.h | 35 +-
external/bsd/nsd/dist/options.c | 193 +-
external/bsd/nsd/dist/options.h | 38 +-
external/bsd/nsd/dist/query.c | 21 +-
external/bsd/nsd/dist/remote.c | 87 +-
external/bsd/nsd/dist/tsig.c | 55 +
external/bsd/nsd/dist/util.c | 29 +
external/bsd/nsd/dist/xfrd-disk.c | 7 +
external/bsd/nsd/dist/xfrd-notify.c | 6 +
external/bsd/nsd/dist/xfrd-tcp.c | 2 +
external/bsd/nsd/dist/xfrd.c | 34 +-
external/bsd/nsd/dist/zlexer.lex | 4 +
external/bsd/nsd/dist/zonec.c | 49 +-
external/bsd/nsd/dist/zonec.h | 3 +-
external/bsd/nsd/dist/zparser.y | 9 +-
46 files changed, 2292 insertions(+), 1499 deletions(-)
diffs (truncated from 5369 to 300 lines):
diff -r af05d80bbfc5 -r 66dac6217dcd external/bsd/nsd/dist/.buildkite/pipeline.yml
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/external/bsd/nsd/dist/.buildkite/pipeline.yml Sun Dec 15 16:00:52 2019 +0000
@@ -0,0 +1,7 @@
+steps:
+ - label: Build
+ commands:
+ - autoconf && autoheader
+ - ./configure --enable-checking --disable-flto
+ - make
+ - make cutest && ./cutest
diff -r af05d80bbfc5 -r 66dac6217dcd external/bsd/nsd/dist/.travis.yml
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/external/bsd/nsd/dist/.travis.yml Sun Dec 15 16:00:52 2019 +0000
@@ -0,0 +1,66 @@
+sudo: false
+language: c
+
+linux_gcc: &linux_gcc
+ os: linux
+ dist: xenial
+ compiler: gcc
+ addons:
+ apt:
+ update: true
+ sources: [ ubuntu-toolchain-r-test ]
+ packages: [ autoconf bison flex libssl-dev libevent-dev clang gcc-9 ]
+ before_install:
+ - eval "export CC=gcc-9"
+ - eval "export COV_COMPTYPE=gcc COV_PLATFORM=linux64"
+
+install_coverity: &install_coverity
+ if [ "${COVERITY_SCAN}" = "true" ]; then
+ COV_DIR="/tmp/coverity-scan-analysis";
+ COV_ARC="/tmp/cov-analysis-${COV_PLATFORM}.tgz";
+ test ! -d "${COV_DIR}" &&
+ mkdir -p "${COV_DIR}" &&
+ curl -s -S -F project="${TRAVIS_REPO_SLUG}"
+ -F token="${COVERITY_SCAN_TOKEN}"
+ -o "${COV_ARC}"
+ "https://scan.coverity.com/download/cxx/${COV_PLATFORM}"; &&
+ tar -xzf "${COV_ARC}" -C "${COV_DIR}";
+ COV_ANALYSIS=$(find "${COV_DIR}" -type d -name "cov-analysis*");
+ eval "export PATH=\"${PATH}:${COV_ANALYSIS}/bin\"";
+ eval "export SCAN_BUILD=\"cov-build --dir cov-int\"";
+ cov-configure --comptype ${COV_COMPTYPE} --compiler ${CC} --template;
+ fi
+
+submit_to_coverity_scan: &submit_to_coverity_scan
+ if [ "${COVERITY_SCAN}" = "true" ]; then
+ tar -czf analysis-results.tgz cov-int &&
+ curl -s -S -F project="${TRAVIS_REPO_SLUG}"
+ -F token="${COVERITY_SCAN_TOKEN}"
+ -F file=@analysis-results.tgz
+ -F version=$(git rev-parse --short HEAD)
+ -F description="Travis CI build"
+ -F email="${COVERITY_EMAIL:=spam%nlnetlabs.nl@localhost}"
+ "https://scan.coverity.com/builds";;
+ fi
+
+install:
+ - *install_coverity
+
+script:
+ - autoconf && autoheader
+ - ./configure --enable-checking --disable-flto
+ - ${SCAN_BUILD} make
+ - make cutest && ./cutest
+ - (cd tpkg; cd clang-analysis.tdir; bash clang-analysis.test)
+
+after_success:
+ - *submit_to_coverity_scan
+
+jobs:
+ include:
+ - <<: *linux_gcc
+ env: [ COVERITY_SCAN=true ]
+ if: type = cron
+ - <<: *linux_gcc
+ env: [ COVERITY_SCAN=false ]
+
diff -r af05d80bbfc5 -r 66dac6217dcd external/bsd/nsd/dist/Makefile.in
--- a/external/bsd/nsd/dist/Makefile.in Sun Dec 15 15:28:12 2019 +0000
+++ b/external/bsd/nsd/dist/Makefile.in Sun Dec 15 16:00:52 2019 +0000
@@ -176,12 +176,16 @@
clean:
rm -f *.o $(TARGETS) $(MANUALS) cutest udb-inspect xfr-inspect nsd-mem
-realclean: clean
- rm -f Makefile config.h config.log config.status
+distclean: clean
+ rm -f Makefile config.h config.log config.status dnstap/dnstap_config.h
+
+realclean: distclean
rm -rf autom4te*
rm -f zlexer.c zparser.h zparser.c zparser.stamp
rm -f configlexer.c configparser.h configparser.c configparser.stamp
+maintainer-clean: realclean
+
devclean: realclean
rm -f config.h.in configure
diff -r af05d80bbfc5 -r 66dac6217dcd external/bsd/nsd/dist/README.md
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/external/bsd/nsd/dist/README.md Sun Dec 15 16:00:52 2019 +0000
@@ -0,0 +1,42 @@
+# NSD
+
+[](https://travis-ci.org/NLnetLabs/nsd)
+[](https://repology.org/project/nsd/versions)
+[](https://bestpractices.coreinfrastructure.org/projects/1462)
+
+The NLnet Labs Name Server Daemon (NSD) is an authoritative DNS name server.
+It has been developed for operations in environments where speed,
+reliability, stability and security are of high importance. If you
+have any feedback, we would love to hear from you. Donâ??t hesitate to
+[create an issue on Github](https://github.com/NLnetLabs/nsd/issues/new)
+or post a message on the
+[NSD mailing list](https://nlnetlabs.nl/mailman/listinfo/nsd-users).
+You can lean more about NSD by reading our
+[documentation](https://nlnetlabs.nl/documentation/nsd/).
+
+## Compiling
+
+Make sure you have the C toolchain, OpenSSL and its include files, and
+libevent with its include files and flex and bison installed.
+The repository does not contain ./configure and you can generate it like
+this (./configure is included in release tarballs, and then you do not
+have to generate it first):
+
+```
+aclocal && autoconf && autoheader
+```
+
+NSD can be compiled and installed using:
+
+```
+./configure && make && make install
+```
+
+## NSD configuration
+
+The configuration options for NSD are described in the man pages, which are
+installed (use `man nsd.conf`) and are available on the NSD
+[documentation page](https://nlnetlabs.nl/documentation/nsd/).
+
+An example configuration file is located in
+[nsd.conf.sample](https://github.com/NLnetLabs/nsd/blob/master/nsd.conf.sample.in).
diff -r af05d80bbfc5 -r 66dac6217dcd external/bsd/nsd/dist/config.h.in
--- a/external/bsd/nsd/dist/config.h.in Sun Dec 15 15:28:12 2019 +0000
+++ b/external/bsd/nsd/dist/config.h.in Sun Dec 15 16:00:52 2019 +0000
@@ -73,12 +73,26 @@
/* Define to 1 if you have the `clock_gettime' function. */
#undef HAVE_CLOCK_GETTIME
+/* Define to 1 if you have the `CRYPTO_memcmp' function. */
+#undef HAVE_CRYPTO_MEMCMP
+
/* if time.h provides ctime_r prototype */
#undef HAVE_CTIME_R_PROTO
+/* Define to 1 if you have the declaration of `SSL_CTX_set_ecdh_auto', and to
+ 0 if you don't. */
+#undef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
+
+/* Define to 1 if you have the declaration of `SSL_CTX_set_tmp_ecdh', and to 0
+ if you don't. */
+#undef HAVE_DECL_SSL_CTX_SET_TMP_ECDH
+
/* Define to 1 if you have the `dup2' function. */
#undef HAVE_DUP2
+/* Define to 1 if you have the `EC_KEY_new_by_curve_name' function. */
+#undef HAVE_EC_KEY_NEW_BY_CURVE_NAME
+
/* Define to 1 if you have the <endian.h> header file. */
#undef HAVE_ENDIAN_H
@@ -200,6 +214,9 @@
/* Define to 1 if you have the `mmap' function. */
#undef HAVE_MMAP
+/* If sys/socket.h has a struct mmsghdr. */
+#undef HAVE_MMSGHDR
+
/* Define to 1 if you have the `munmap' function. */
#undef HAVE_MUNMAP
@@ -221,6 +238,9 @@
/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
#undef HAVE_OPENSSL_INIT_SSL
+/* Define to 1 if you have the <openssl/ocsp.h> header file. */
+#undef HAVE_OPENSSL_OCSP_H
+
/* Define to 1 if you have the <openssl/rand.h> header file. */
#undef HAVE_OPENSSL_RAND_H
@@ -239,7 +259,7 @@
/* Define to 1 if you have the `pwrite' function. */
#undef HAVE_PWRITE
-/* Define to 1 if you have the `reallocarray' function. */
+/* If we have reallocarray(3) */
#undef HAVE_REALLOCARRAY
/* Define if recvmmsg is implemented */
@@ -281,6 +301,9 @@
/* Define if you have the SSL libraries installed. */
#undef HAVE_SSL
+/* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
+#undef HAVE_SSL_CTX_SET_SECURITY_LEVEL
+
/* Define to 1 if you have the <stdarg.h> header file. */
#undef HAVE_STDARG_H
@@ -507,6 +530,9 @@
/* Define to the default tcp timeout. */
#undef TCP_TIMEOUT
+/* Define to the default DNS over TLS port. */
+#undef TLS_PORT
+
/* Define to the default maximum udp message length. */
#undef UDP_MAX_MESSAGE_LEN
@@ -550,6 +576,9 @@
#endif
+/* Define this to enable TCP fast open. */
+#undef USE_TCP_FASTOPEN
+
/* Define this to enable per-zone statistics gathering. */
#undef USE_ZONE_STATS
@@ -688,6 +717,9 @@
# ifndef _BSD_SOURCE
# define _BSD_SOURCE 1
# endif
+# ifndef _OPENBSD_SOURCE
+# define _OPENBSD_SOURCE 1
+# endif
# ifndef _DEFAULT_SOURCE
# define _DEFAULT_SOURCE 1
# endif
diff -r af05d80bbfc5 -r 66dac6217dcd external/bsd/nsd/dist/configlexer.lex
--- a/external/bsd/nsd/dist/configlexer.lex Sun Dec 15 15:28:12 2019 +0000
+++ b/external/bsd/nsd/dist/configlexer.lex Sun Dec 15 16:00:52 2019 +0000
@@ -25,7 +25,6 @@
#include "options.h"
#include "configyyrename.h"
#include "configparser.h"
-void c_error(const char *message);
#if 0
#define LEXOUT(s) printf s /* used ONLY when debugging */
@@ -58,27 +57,27 @@
struct inc_state* s;
char* nm;
if(inc_depth++ > 10000000) {
- c_error_msg("too many include files");
+ yyerror("too many include files");
return;
}
if(strlen(filename) == 0) {
- c_error_msg("empty include file name");
+ yyerror("empty include file name");
return;
}
s = (struct inc_state*)malloc(sizeof(*s));
if(!s) {
- c_error_msg("include %s: malloc failure", filename);
+ yyerror("include %s: malloc failure", filename);
return;
}
nm = strdup(filename);
if(!nm) {
- c_error_msg("include %s: strdup failure", filename);
+ yyerror("include %s: strdup failure", filename);
free(s);
return;
}
input = fopen(filename, "r");
if(!input) {
- c_error_msg("cannot open include file '%s': %s",
+ yyerror("cannot open include file '%s': %s",
filename, strerror(errno));
free(s);
free(nm);
@@ -101,13 +100,12 @@
/* check for wildcards */
#ifdef HAVE_GLOB
glob_t g;
- size_t i;
- int r, flags;
+ int i, r, flags;
#endif /* HAVE_GLOB */
Home |
Main Index |
Thread Index |
Old Index