RHEL 9.0.0 Alpha bootstrap
The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/bind#293d93455e05945f11b4ee320db6a2fa4f31e43c
This commit is contained in:
parent
b080cb76e0
commit
49cf061d17
118
.gitignore
vendored
118
.gitignore
vendored
@ -0,0 +1,118 @@
|
||||
bind-9.7.1-P2.tar.gz
|
||||
config-8.tar.bz2
|
||||
bind-9.7.2b1.tar.gz
|
||||
/config-8.tar.bz2
|
||||
/bind-9.7.2rc1.tar.gz
|
||||
/bind-9.7.2.tar.gz
|
||||
/bind-9.7.2-P2.tar.gz
|
||||
/bind-9.7.2-P3.tar.gz
|
||||
/bind-9.7.3b1.tar.gz
|
||||
/bind-9.7.3rc1.tar.gz
|
||||
/bind-9.7.3.tar.gz
|
||||
/bind-9.8.0rc1.tar.gz
|
||||
/bind-9.8.0.tar.gz
|
||||
/bind-9.8.0-P1.tar.gz
|
||||
/bind-9.8.0-P2.tar.gz
|
||||
/bind-9.8.0-P4.tar.gz
|
||||
/bind-9.8.1rc1.tar.gz
|
||||
/bind-9.8.1.tar.gz
|
||||
/bind-9.9.0b1.tar.gz
|
||||
/bind-9.9.0b2.tar.gz
|
||||
/bind-9.9.0rc1.tar.gz
|
||||
/bind-9.9.0rc2.tar.gz
|
||||
/bind-9.9.0.tar.gz
|
||||
/bind-9.9.1.tar.gz
|
||||
/bind-9.9.1-P1.tar.gz
|
||||
/bind-9.9.1-P2.tar.gz
|
||||
/bind-9.9.1-P3.tar.gz
|
||||
/bind-9.9.2.tar.gz
|
||||
/bind-9.9.2-P1.tar.gz
|
||||
/config-9.tar.bz2
|
||||
/config-10.tar.bz2
|
||||
/bind-9.9.2-P2.tar.gz
|
||||
/bind-9.9.3rc1.tar.gz
|
||||
/config-11.tar.bz2
|
||||
/bind-9.9.3rc2.tar.gz
|
||||
/bind-9.9.3.tar.gz
|
||||
/bind-9.9.3-P1.tar.gz
|
||||
/bind-9.9.4b1.tar.gz
|
||||
/bind-9.9.4rc1.tar.gz
|
||||
/bind-9.9.4rc2.tar.gz
|
||||
/bind-9.9.4.tar.gz
|
||||
/config-12.tar.bz2
|
||||
/bind-9.9.5b1.tar.gz
|
||||
/bind-9.9.5rc2.tar.gz
|
||||
/bind-9.9.5.tar.gz
|
||||
/bind-9.9.5-P1.tar.gz
|
||||
/bind-9.9.6.tar.gz
|
||||
/bind-9.9.6-P1.tar.gz
|
||||
/bind-9.10.1b2.tar.gz
|
||||
/bind-9.10.1.tar.gz
|
||||
/bind-9.10.1-P1.tar.gz
|
||||
/bind-9.10.2rc1.tar.gz
|
||||
/bind-9.10.2rc2.tar.gz
|
||||
/bind-9.10.2.tar.gz
|
||||
/config-13.tar.bz2
|
||||
/config-14.tar.bz2
|
||||
/bind-9.10.2-P1.tar.gz
|
||||
/bind-9.10.2-P2.tar.gz
|
||||
/bind-9.10.2-P3.tar.gz
|
||||
/bind-9.10.3rc1.tar.gz
|
||||
/bind-9.10.3.tar.gz
|
||||
/bind-9.10.3-P2.tar.gz
|
||||
/config-15.tar.bz2
|
||||
/bind-9.10.3-P3.tar.gz
|
||||
/bind-9.10.3-P4.tar.gz
|
||||
/bind-9.10.4-P1.tar.gz
|
||||
/bind-9.10.4-P2.tar.gz
|
||||
/bind-9.10.4-P3.tar.gz
|
||||
/bind-9.10.4-P4.tar.gz
|
||||
/bind-9.11.0-P1.tar.gz
|
||||
/bind-9.11.0-P2.tar.gz
|
||||
/bind-9.11.0-P3.tar.gz
|
||||
/bind-9.11.0-P5.tar.gz
|
||||
/config-16.tar.bz2
|
||||
/bind-9.11.1-P1.tar.gz
|
||||
/bind-9.11.1-P2.tar.gz
|
||||
/bind-9.11.1-P3.tar.gz
|
||||
/bind-9.11.2b1.tar.gz
|
||||
/bind-9.11.2.tar.gz
|
||||
/config-17.tar.bz2
|
||||
/bind-9.11.2-P1.tar.gz
|
||||
/bind-9.11.3b1.tar.gz
|
||||
/bind-9.11.3.tar.gz
|
||||
/config-18.tar.bz2
|
||||
/bind-9.11.4rc1.tar.gz
|
||||
/bind-9.11.4.tar.gz
|
||||
/bind-9.11.4-P1.tar.gz
|
||||
/bind-9.11.4-P2.tar.gz
|
||||
/bind-9.11.5.tar.gz
|
||||
/bind-9.11.5-P1.tar.gz
|
||||
/config-19.tar.bz2
|
||||
/bind-9.11.5-P4.tar.gz
|
||||
/bind-9.11.6.tar.gz
|
||||
/bind-9.11.6-P1.tar.gz
|
||||
/bind-9.11.7.tar.gz
|
||||
/bind-9.11.8.tar.gz
|
||||
/bind-9.11.9.tar.gz
|
||||
/bind-9.11.10.tar.gz
|
||||
/bind-9.11.11.tar.gz
|
||||
/bind-9.11.12.tar.gz
|
||||
/bind-9.11.13.tar.gz
|
||||
/bind-9.11.13.tar.gz.asc
|
||||
/bind-9.11.14.tar.gz
|
||||
/bind-9.11.14.tar.gz.asc
|
||||
/bind-9.11.17.tar.gz
|
||||
/bind-9.11.17.tar.gz.asc
|
||||
/bind-9.11.18.tar.gz
|
||||
/bind-9.11.18.tar.gz.asc
|
||||
/bind-9.11.19.tar.gz
|
||||
/bind-9.11.19.tar.gz.asc
|
||||
/bind-9.11.20.tar.gz
|
||||
/bind-9.11.20.tar.gz.asc
|
||||
/bind-9.11.21.tar.gz
|
||||
/bind-9.11.21.tar.gz.asc
|
||||
/bind-9.11.22.tar.gz
|
||||
/bind-9.11.22.tar.gz.asc
|
||||
/bind-9.11.23.tar.gz
|
||||
/bind-9.11.23.tar.gz.asc
|
36
README.md
Normal file
36
README.md
Normal file
@ -0,0 +1,36 @@
|
||||
# BIND 9
|
||||
|
||||
[BIND (Berkeley Internet Name Domain)](https://www.isc.org/downloads/bind/doc/) is a complete, highly portable
|
||||
implementation of the DNS (Domain Name System) protocol.
|
||||
|
||||
Internet Systems Consortium
|
||||
([https://www.isc.org](https://www.isc.org)), a 501(c)(3) public benefit
|
||||
corporation dedicated to providing software and services in support of the
|
||||
Internet infrastructure, developed BIND 9 and is responsible for its
|
||||
ongoing maintenance and improvement.
|
||||
|
||||
More details about upstream project can be found on their
|
||||
[gitlab](https://gitlab.isc.org/isc-projects/bind9). This repository contains
|
||||
only upstream sources and packaging instructions for
|
||||
[Fedora Project](https://fedoraproject.org).
|
||||
|
||||
## Subpackages
|
||||
|
||||
The package contains several subpackages, some of them can be disabled on rebuild.
|
||||
|
||||
* **bind** -- *named* daemon providing DNS server
|
||||
* **bind-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
|
||||
* **bind-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
|
||||
* **bind-license** -- Shared license for all packages but bind-export-libs.
|
||||
* **bind-sdb** -- *named* daemon built with support for [Dynamically Loadable Zones](http://bind-dlz.sourceforge.net/), interface to serve DNS names from external databases like LDAP or SQL. Can be disabled by `--without SDB`.
|
||||
* **bind-pkcs11** -- *named* daemon built with native PKCS#11 support. Can be disabled by `--without PKCS11`.
|
||||
* **bind-libs** and **bind-libs-lite** -- Shared libraries used by some others programs
|
||||
* **bind-export-libs** -- Special subset of libraries without support for threads. Used by *dhcp* package. Can be disabled by `--without EXPORT_LIBS`
|
||||
* **bind-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
|
||||
|
||||
|
||||
## Optional features
|
||||
|
||||
* *GSSTSIG* -- Support for Kerberos authentication in BIND.
|
||||
* *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
|
||||
* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.
|
79
README.sdb_pgsql
Normal file
79
README.sdb_pgsql
Normal file
@ -0,0 +1,79 @@
|
||||
PGSQL BIND SDB driver
|
||||
|
||||
The postgresql BIND SDB driver is of experimental status and should not be
|
||||
used for production systems.
|
||||
|
||||
Usage:
|
||||
|
||||
o Use the named_sdb process ( put ENABLE_SDB=yes in /etc/sysconfig/named )
|
||||
|
||||
o Edit your named.conf to contain a database zone, eg. :
|
||||
|
||||
zone "pgdb.net." IN {
|
||||
type master;
|
||||
database "pgsql bind pgdb localhost pguser pgpasswd";
|
||||
# ^- DB name ^-Table ^-host ^-user ^-password
|
||||
};
|
||||
|
||||
o Create the database zone table
|
||||
The table must contain the columns "name", "rdtype", and "rdata", and
|
||||
is expected to contain a properly constructed zone. The program "zonetodb"
|
||||
creates such a table.
|
||||
|
||||
zonetodb usage:
|
||||
|
||||
zonetodb origin file dbname dbtable
|
||||
|
||||
where
|
||||
origin : zone origin, eg "pgdb.net."
|
||||
file : master zone database file, eg. pgdb.net.db
|
||||
dbname : name of postgresql database
|
||||
dbtable: name of table in database
|
||||
|
||||
Eg. to import this zone in the file 'pgdb.net.db' into the 'bind' database
|
||||
'pgdb' table:
|
||||
|
||||
---
|
||||
#pgdb.net.db:
|
||||
$TTL 1H
|
||||
@ SOA localhost. root.localhost. ( 1
|
||||
3H
|
||||
1H
|
||||
1W
|
||||
1H )
|
||||
NS localhost.
|
||||
host1 A 192.168.2.1
|
||||
host2 A 192.168.2.2
|
||||
host3 A 192.168.2.3
|
||||
host4 A 192.168.2.4
|
||||
host5 A 192.168.2.5
|
||||
host6 A 192.168.2.6
|
||||
host7 A 192.168.2.7
|
||||
---
|
||||
|
||||
Issue this command as the pgsql user authorized to update the bind database:
|
||||
|
||||
# zonetodb pgdb.net. pgdb.net.db bind pgdb
|
||||
|
||||
will create / update the pgdb table in the 'bind' db:
|
||||
|
||||
$ psql -dbind -c 'select * from pgdb;'
|
||||
name | ttl | rdtype | rdata
|
||||
----------------+------+--------+-----------------------------------------------------
|
||||
pgdb.net | 3600 | SOA | localhost. root.localhost. 1 10800 3600 604800 3600
|
||||
pgdb.net | 3600 | NS | localhost.
|
||||
host1.pgdb.net | 3600 | A | 192.168.2.1
|
||||
host2.pgdb.net | 3600 | A | 192.168.2.2
|
||||
host3.pgdb.net | 3600 | A | 192.168.2.3
|
||||
host4.pgdb.net | 3600 | A | 192.168.2.4
|
||||
host5.pgdb.net | 3600 | A | 192.168.2.5
|
||||
host6.pgdb.net | 3600 | A | 192.168.2.6
|
||||
host7.pgdb.net | 3600 | A | 192.168.2.7
|
||||
(9 rows)
|
||||
|
||||
I've tested exactly the above configuration with bind-sdb-9.3.1+ and it works OK.
|
||||
|
||||
NOTE: If you use pgsqldb SDB, ensure the postgresql service is started before the named
|
||||
service .
|
||||
|
||||
USE AT YOUR OWN RISK!
|
620
bind-9.10-dist-native-pkcs11.patch
Normal file
620
bind-9.10-dist-native-pkcs11.patch
Normal file
@ -0,0 +1,620 @@
|
||||
diff --git a/bin/Makefile.in b/bin/Makefile.in
|
||||
index f0c504a..ce7a2da 100644
|
||||
--- a/bin/Makefile.in
|
||||
+++ b/bin/Makefile.in
|
||||
@@ -11,8 +11,8 @@ srcdir = @srcdir@
|
||||
VPATH = @srcdir@
|
||||
top_srcdir = @top_srcdir@
|
||||
|
||||
-SUBDIRS = named rndc dig delv dnssec tools nsupdate check confgen \
|
||||
- @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
|
||||
+SUBDIRS = named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
|
||||
+ check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
|
||||
TARGETS =
|
||||
|
||||
@BIND9_MAKE_RULES@
|
||||
diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
|
||||
index 4b8ca13..32f4470 100644
|
||||
--- a/bin/dnssec-pkcs11/Makefile.in
|
||||
+++ b/bin/dnssec-pkcs11/Makefile.in
|
||||
@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
|
||||
|
||||
@BIND9_MAKE_INCLUDES@
|
||||
|
||||
-CINCLUDES = ${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
|
||||
+CINCLUDES = ${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES}
|
||||
|
||||
-CDEFINES = -DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
|
||||
- @CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
|
||||
+CDEFINES = -DVERSION=\"${VERSION}\" @PKCS11_ENGINE@ \
|
||||
+ @CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
|
||||
CWARNINGS =
|
||||
|
||||
-DNSLIBS = ../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
-ISCLIBS = ../../lib/isc/libisc.@A@
|
||||
-ISCNOSYMLIBS = ../../lib/isc/libisc-nosymtbl.@A@
|
||||
+DNSLIBS = ../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
+ISCLIBS = ../../lib/isc-pkcs11/libisc-pkcs11.@A@
|
||||
+ISCNOSYMLIBS = ../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
|
||||
|
||||
-DNSDEPLIBS = ../../lib/dns/libdns.@A@
|
||||
-ISCDEPLIBS = ../../lib/isc/libisc.@A@
|
||||
+DNSDEPLIBS = ../../lib/dns-pkcs11/libdns-pkcs11.@A@
|
||||
+ISCDEPLIBS = ../../lib/isc-pkcs11/libisc-pkcs11.@A@
|
||||
|
||||
DEPLIBS = ${DNSDEPLIBS} ${ISCDEPLIBS}
|
||||
|
||||
@@ -35,10 +35,10 @@ LIBS = ${DNSLIBS} ${ISCLIBS} @LIBS@
|
||||
NOSYMLIBS = ${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
|
||||
|
||||
# Alphabetically
|
||||
-TARGETS = dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
|
||||
- dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
|
||||
- dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \
|
||||
- dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@
|
||||
+TARGETS = dnssec-keygen-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
|
||||
+ dnssec-keyfromlabel-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
|
||||
+ dnssec-revoke-pkcs11@EXEEXT@ dnssec-settime-pkcs11@EXEEXT@ \
|
||||
+ dnssec-verify-pkcs11@EXEEXT@ dnssec-importkey-pkcs11@EXEEXT@
|
||||
|
||||
OBJS = dnssectool.@O@
|
||||
|
||||
@@ -59,15 +59,15 @@ MANOBJS = ${MANPAGES} ${HTMLPAGES}
|
||||
|
||||
@BIND9_MAKE_RULES@
|
||||
|
||||
-dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
|
||||
+dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
|
||||
export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
|
||||
${FINALBUILDCMD}
|
||||
|
||||
-dnssec-keyfromlabel@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
|
||||
+dnssec-keyfromlabel-pkcs11@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
|
||||
export BASEOBJS="dnssec-keyfromlabel.@O@ ${OBJS}"; \
|
||||
${FINALBUILDCMD}
|
||||
|
||||
-dnssec-keygen@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
|
||||
+dnssec-keygen-pkcs11@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
|
||||
export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
|
||||
${FINALBUILDCMD}
|
||||
|
||||
@@ -75,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
|
||||
${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
|
||||
-c ${srcdir}/dnssec-signzone.c
|
||||
|
||||
-dnssec-signzone@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
|
||||
+dnssec-signzone-pkcs11@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
|
||||
export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
|
||||
${FINALBUILDCMD}
|
||||
|
||||
@@ -83,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
|
||||
${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
|
||||
-c ${srcdir}/dnssec-verify.c
|
||||
|
||||
-dnssec-verify@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
|
||||
+dnssec-verify-pkcs11@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
|
||||
export BASEOBJS="dnssec-verify.@O@ ${OBJS}"; \
|
||||
${FINALBUILDCMD}
|
||||
|
||||
-dnssec-revoke@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
|
||||
+dnssec-revoke-pkcs11@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
|
||||
dnssec-revoke.@O@ ${OBJS} ${LIBS}
|
||||
|
||||
-dnssec-settime@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
|
||||
+dnssec-settime-pkcs11@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
|
||||
dnssec-settime.@O@ ${OBJS} ${LIBS}
|
||||
|
||||
-dnssec-importkey@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
|
||||
+dnssec-importkey-pkcs11@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
|
||||
dnssec-importkey.@O@ ${OBJS} ${LIBS}
|
||||
|
||||
@@ -106,16 +106,14 @@ docclean manclean maintainer-clean::
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
- $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
install-man8: ${MANPAGES}
|
||||
${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
|
||||
-install:: ${TARGETS} installdirs install-man8
|
||||
+install:: ${TARGETS} installdirs
|
||||
for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
|
||||
|
||||
uninstall::
|
||||
- for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
|
||||
for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
|
||||
|
||||
clean distclean::
|
||||
diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
|
||||
index 4b8ca13..4175996 100644
|
||||
--- a/bin/dnssec/Makefile.in
|
||||
+++ b/bin/dnssec/Makefile.in
|
||||
@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
|
||||
|
||||
CINCLUDES = ${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
|
||||
|
||||
-CDEFINES = -DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
|
||||
+CDEFINES = -DVERSION=\"${VERSION}\" \
|
||||
@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
|
||||
CWARNINGS =
|
||||
|
||||
diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
|
||||
index 70e5571..b5a4a6b 100644
|
||||
--- a/bin/named-pkcs11/Makefile.in
|
||||
+++ b/bin/named-pkcs11/Makefile.in
|
||||
@@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES = @DLZ_DRIVER_INCLUDES@
|
||||
DLZDRIVER_LIBS = @DLZ_DRIVER_LIBS@
|
||||
|
||||
CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include -I. \
|
||||
- ${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
|
||||
- ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
|
||||
+ ${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
|
||||
+ ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
|
||||
${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
|
||||
@DST_OPENSSL_INC@
|
||||
|
||||
-CDEFINES = @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
|
||||
+CDEFINES = @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@ @USE_GSSAPI@
|
||||
|
||||
CWARNINGS =
|
||||
|
||||
-DNSLIBS = ../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
+DNSLIBS = ../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
ISCCFGLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
ISCCCLIBS = ../../lib/isccc/libisccc.@A@
|
||||
-ISCLIBS = ../../lib/isc/libisc.@A@
|
||||
-ISCNOSYMLIBS = ../../lib/isc/libisc-nosymtbl.@A@
|
||||
+ISCLIBS = ../../lib/isc-pkcs11/libisc-pkcs11.@A@
|
||||
+ISCNOSYMLIBS = ../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
|
||||
LWRESLIBS = ../../lib/lwres/liblwres.@A@
|
||||
BIND9LIBS = ../../lib/bind9/libbind9.@A@
|
||||
|
||||
-DNSDEPLIBS = ../../lib/dns/libdns.@A@
|
||||
+DNSDEPLIBS = ../../lib/dns-pkcs11/libdns-pkcs11.@A@
|
||||
ISCCFGDEPLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
ISCCCDEPLIBS = ../../lib/isccc/libisccc.@A@
|
||||
-ISCDEPLIBS = ../../lib/isc/libisc.@A@
|
||||
+ISCDEPLIBS = ../../lib/isc-pkcs11/libisc-pkcs11.@A@
|
||||
LWRESDEPLIBS = ../../lib/lwres/liblwres.@A@
|
||||
BIND9DEPLIBS = ../../lib/bind9/libbind9.@A@
|
||||
|
||||
@@ -72,15 +72,15 @@ DEPLIBS = ${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
|
||||
|
||||
LIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
|
||||
- ${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
|
||||
+ @LIBS@
|
||||
|
||||
NOSYMLIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
|
||||
- ${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
|
||||
+ @LIBS@
|
||||
|
||||
SUBDIRS = unix
|
||||
|
||||
-TARGETS = named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
|
||||
+TARGETS = named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
|
||||
|
||||
GEOIPLINKOBJS = geoip.@O@
|
||||
GEOIP2LINKOBJS = geoip.@O@
|
||||
@@ -94,8 +94,7 @@ OBJS = builtin.@O@ client.@O@ config.@O@ control.@O@ \
|
||||
tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
|
||||
zoneconf.@O@ \
|
||||
lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
|
||||
- lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
|
||||
- ${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
|
||||
+ lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
|
||||
|
||||
UOBJS = unix/os.@O@ unix/dlz_dlopen_driver.@O@
|
||||
|
||||
@@ -113,8 +112,7 @@ SRCS = builtin.c client.c config.c control.c \
|
||||
tkeyconf.c tsigconf.c update.c xfrout.c \
|
||||
zoneconf.c \
|
||||
lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
|
||||
- lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
|
||||
- ${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
|
||||
+ lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
|
||||
|
||||
MANPAGES = named.8 lwresd.8 named.conf.5
|
||||
|
||||
@@ -154,21 +152,21 @@ server.@O@: server.c
|
||||
-DPRODUCT=\"${PRODUCT}\" \
|
||||
-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
|
||||
|
||||
-named@EXEEXT@: ${OBJS} ${DEPLIBS}
|
||||
+named-pkcs11@EXEEXT@: ${OBJS} ${DEPLIBS}
|
||||
export MAKE_SYMTABLE="yes"; \
|
||||
export BASEOBJS="${OBJS} ${UOBJS}"; \
|
||||
${FINALBUILDCMD}
|
||||
|
||||
-lwresd@EXEEXT@: named@EXEEXT@
|
||||
+lwresd@EXEEXT@: named-pkcs11@EXEEXT@
|
||||
rm -f lwresd@EXEEXT@
|
||||
- @LN@ named@EXEEXT@ lwresd@EXEEXT@
|
||||
+ @LN@ named-pkcs11@EXEEXT@ lwresd@EXEEXT@
|
||||
|
||||
# Bit of hack, do not produce intermediate .o object for featuretest
|
||||
feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
|
||||
${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
|
||||
-c ${top_srcdir}/bin/tests/system/feature-test.c
|
||||
|
||||
-feature-test@EXEEXT@: feature-test.@O@
|
||||
+feature-test-pkcs11@EXEEXT@: feature-test.@O@
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
|
||||
-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
|
||||
|
||||
@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
|
||||
|
||||
install-man: install-man5 install-man8
|
||||
|
||||
-install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
|
||||
- ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
- (cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
|
||||
+install:: named-pkcs11@EXEEXT@ installdirs
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
|
||||
uninstall::
|
||||
- rm -f ${DESTDIR}${mandir}/man5/named.conf.5
|
||||
- rm -f ${DESTDIR}${mandir}/man8/lwresd.8
|
||||
- rm -f ${DESTDIR}${mandir}/man8/named.8
|
||||
- rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
|
||||
- ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
|
||||
+ ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
|
||||
|
||||
@DLZ_DRIVER_RULES@
|
||||
|
||||
diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
|
||||
index 70e5571..4cfed4d 100644
|
||||
--- a/bin/named/Makefile.in
|
||||
+++ b/bin/named/Makefile.in
|
||||
@@ -48,7 +48,7 @@ CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include -I. \
|
||||
${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
|
||||
@DST_OPENSSL_INC@
|
||||
|
||||
-CDEFINES = @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
|
||||
+CDEFINES = @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
|
||||
|
||||
CWARNINGS =
|
||||
|
||||
diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
|
||||
index a058c91..d4b689a 100644
|
||||
--- a/bin/pkcs11/Makefile.in
|
||||
+++ b/bin/pkcs11/Makefile.in
|
||||
@@ -15,13 +15,13 @@ top_srcdir = @top_srcdir@
|
||||
|
||||
@BIND9_MAKE_INCLUDES@
|
||||
|
||||
-CINCLUDES = ${ISC_INCLUDES}
|
||||
+CINCLUDES = ${ISC_PKCS11_INCLUDES}
|
||||
|
||||
CDEFINES =
|
||||
|
||||
-ISCLIBS = ../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
|
||||
+ISCLIBS = ../../lib/isc-pkcs11/libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
|
||||
|
||||
-ISCDEPLIBS = ../../lib/isc/libisc.@A@
|
||||
+ISCDEPLIBS = ../../lib/isc-pkcs11/libisc-pkcs11.@A@
|
||||
|
||||
DEPLIBS = ${ISCDEPLIBS}
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 9b7d778..59ba20b 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
|
||||
AC_SUBST(DST_GSSAPI_INC)
|
||||
AC_SUBST(DNS_GSSAPI_LIBS)
|
||||
DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
|
||||
+DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
|
||||
|
||||
#
|
||||
# Applications linking with libdns also need to link with these libraries.
|
||||
#
|
||||
|
||||
AC_SUBST(DNS_CRYPTO_LIBS)
|
||||
+AC_SUBST(DNS_CRYPTO_PK11_LIBS)
|
||||
|
||||
#
|
||||
# was --with-randomdev specified?
|
||||
@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
|
||||
AC_MSG_CHECKING(for OpenSSL library)
|
||||
OPENSSL_WARNING=
|
||||
openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
|
||||
-if test "yes" = "$want_native_pkcs11"
|
||||
-then
|
||||
- use_openssl="native_pkcs11"
|
||||
- AC_MSG_RESULT(use of native PKCS11 instead)
|
||||
-fi
|
||||
+# if test "yes" = "$want_native_pkcs11"
|
||||
+# then
|
||||
+# use_openssl="native_pkcs11"
|
||||
+# AC_MSG_RESULT(use of native PKCS11 instead)
|
||||
+# fi
|
||||
|
||||
if test "auto" = "$use_openssl"
|
||||
then
|
||||
@@ -1511,6 +1513,7 @@ then
|
||||
fi
|
||||
done
|
||||
fi
|
||||
+CRYPTO_PK11=""
|
||||
OPENSSL_ECDSA=""
|
||||
OPENSSL_GOST=""
|
||||
OPENSSL_ED25519=""
|
||||
@@ -1532,11 +1535,10 @@ case "$with_gost" in
|
||||
;;
|
||||
esac
|
||||
|
||||
-case "$use_openssl" in
|
||||
- native_pkcs11)
|
||||
- AC_MSG_RESULT(disabled because of native PKCS11)
|
||||
+if test "$want_native_pkcs11" = "yes"
|
||||
+then
|
||||
DST_OPENSSL_INC=""
|
||||
- CRYPTO="-DPKCS11CRYPTO"
|
||||
+ CRYPTO_PK11="-DPKCS11CRYPTO"
|
||||
CRYPTOLIB="pkcs11"
|
||||
OPENSSLECDSALINKOBJS=""
|
||||
OPENSSLECDSALINKSRCS=""
|
||||
@@ -1546,7 +1548,9 @@ case "$use_openssl" in
|
||||
OPENSSLGOSTLINKSRCS=""
|
||||
OPENSSLLINKOBJS=""
|
||||
OPENSSLLINKSRCS=""
|
||||
- ;;
|
||||
+fi
|
||||
+
|
||||
+case "$use_openssl" in
|
||||
no)
|
||||
AC_MSG_RESULT(no)
|
||||
DST_OPENSSL_INC=""
|
||||
@@ -1578,7 +1582,7 @@ case "$use_openssl" in
|
||||
If you do not want OpenSSL, use --without-openssl])
|
||||
;;
|
||||
*)
|
||||
- if test "yes" = "$want_native_pkcs11"
|
||||
+ if false # test "yes" = "$want_native_pkcs11"
|
||||
then
|
||||
AC_MSG_RESULT()
|
||||
AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
|
||||
@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
|
||||
AC_SUBST(OPENSSL_GOST)
|
||||
|
||||
DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
|
||||
+DNS_CRYPTO_PK11_LIBS="$DNS_CRYPTO_LIBS"
|
||||
|
||||
ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
|
||||
if test "yes" = "$with_aes"
|
||||
@@ -2291,6 +2296,7 @@ esac
|
||||
AC_SUBST(PKCS11LINKOBJS)
|
||||
AC_SUBST(PKCS11LINKSRCS)
|
||||
AC_SUBST(CRYPTO)
|
||||
+AC_SUBST(CRYPTO_PK11)
|
||||
AC_SUBST(PKCS11_ECDSA)
|
||||
AC_SUBST(PKCS11_GOST)
|
||||
AC_SUBST(PKCS11_ED25519)
|
||||
@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
|
||||
bin/delv/Makefile
|
||||
bin/dig/Makefile
|
||||
bin/dnssec/Makefile
|
||||
+ bin/dnssec-pkcs11/Makefile
|
||||
bin/named/Makefile
|
||||
bin/named/unix/Makefile
|
||||
+ bin/named-pkcs11/Makefile
|
||||
+ bin/named-pkcs11/unix/Makefile
|
||||
bin/nsupdate/Makefile
|
||||
bin/pkcs11/Makefile
|
||||
bin/python/Makefile
|
||||
@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
|
||||
lib/dns/include/dns/Makefile
|
||||
lib/dns/include/dst/Makefile
|
||||
lib/dns/tests/Makefile
|
||||
+ lib/dns-pkcs11/Makefile
|
||||
+ lib/dns-pkcs11/include/Makefile
|
||||
+ lib/dns-pkcs11/include/dns/Makefile
|
||||
+ lib/dns-pkcs11/include/dst/Makefile
|
||||
lib/irs/Makefile
|
||||
lib/irs/include/Makefile
|
||||
lib/irs/include/irs/Makefile
|
||||
@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
|
||||
lib/isc/unix/include/Makefile
|
||||
lib/isc/unix/include/isc/Makefile
|
||||
lib/isc/unix/include/pkcs11/Makefile
|
||||
+ lib/isc-pkcs11/$arch/Makefile
|
||||
+ lib/isc-pkcs11/$arch/include/Makefile
|
||||
+ lib/isc-pkcs11/$arch/include/isc/Makefile
|
||||
+ lib/isc-pkcs11/$thread_dir/Makefile
|
||||
+ lib/isc-pkcs11/$thread_dir/include/Makefile
|
||||
+ lib/isc-pkcs11/$thread_dir/include/isc/Makefile
|
||||
+ lib/isc-pkcs11/Makefile
|
||||
+ lib/isc-pkcs11/include/Makefile
|
||||
+ lib/isc-pkcs11/include/isc/Makefile
|
||||
+ lib/isc-pkcs11/include/isc/platform.h
|
||||
+ lib/isc-pkcs11/include/pk11/Makefile
|
||||
+ lib/isc-pkcs11/include/pkcs11/Makefile
|
||||
+ lib/isc-pkcs11/tests/Makefile
|
||||
+ lib/isc-pkcs11/nls/Makefile
|
||||
+ lib/isc-pkcs11/unix/Makefile
|
||||
+ lib/isc-pkcs11/unix/include/Makefile
|
||||
+ lib/isc-pkcs11/unix/include/isc/Makefile
|
||||
+ lib/isc-pkcs11/unix/include/pkcs11/Makefile
|
||||
lib/isccc/Makefile
|
||||
lib/isccc/include/Makefile
|
||||
lib/isccc/include/isccc/Makefile
|
||||
diff --git a/lib/Makefile.in b/lib/Makefile.in
|
||||
index 81270a0..bcb5312 100644
|
||||
--- a/lib/Makefile.in
|
||||
+++ b/lib/Makefile.in
|
||||
@@ -15,7 +15,7 @@ top_srcdir = @top_srcdir@
|
||||
# Attempt to disable parallel processing.
|
||||
.NOTPARALLEL:
|
||||
.NO_PARALLEL:
|
||||
-SUBDIRS = isc isccc dns isccfg bind9 lwres irs samples
|
||||
+SUBDIRS = isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs samples
|
||||
TARGETS =
|
||||
|
||||
@BIND9_MAKE_RULES@
|
||||
diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
|
||||
index 7f09bd6..c388d9e 100644
|
||||
--- a/lib/dns-pkcs11/Makefile.in
|
||||
+++ b/lib/dns-pkcs11/Makefile.in
|
||||
@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
|
||||
|
||||
USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
|
||||
|
||||
-CINCLUDES = -I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
|
||||
- ${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
|
||||
- @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
|
||||
+CINCLUDES = -I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
|
||||
+ ${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
|
||||
|
||||
-CDEFINES = -DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
|
||||
+CDEFINES = -DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
|
||||
|
||||
CWARNINGS =
|
||||
|
||||
-ISCLIBS = ../../lib/isc/libisc.@A@
|
||||
+ISCLIBS = ../../lib/isc-pkcs11/libisc-pkcs11.@A@
|
||||
|
||||
-ISCDEPLIBS = ../../lib/isc/libisc.@A@
|
||||
+ISCDEPLIBS = ../../lib/isc-pkcs11/libisc-pkcs11.@A@
|
||||
|
||||
LIBS = ${MAXMINDDB_LIBS} @LIBS@
|
||||
|
||||
@@ -150,15 +149,15 @@ version.@O@: version.c
|
||||
-DLIBAGE=${LIBAGE} \
|
||||
-c ${srcdir}/version.c
|
||||
|
||||
-libdns.@SA@: ${OBJS}
|
||||
+libdns-pkcs11.@SA@: ${OBJS}
|
||||
${AR} ${ARFLAGS} $@ ${OBJS}
|
||||
${RANLIB} $@
|
||||
|
||||
-libdns.la: ${OBJS}
|
||||
+libdns-pkcs11.la: ${OBJS}
|
||||
${LIBTOOL_MODE_LINK} \
|
||||
- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
|
||||
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
|
||||
-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
|
||||
- ${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
|
||||
+ ${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
|
||||
|
||||
include: gen
|
||||
${MAKE} include/dns/enumtype.h
|
||||
@@ -189,22 +188,22 @@ gen: gen.c
|
||||
${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
|
||||
${BUILD_LIBS} ${LFS_LIBS}
|
||||
|
||||
-timestamp: include libdns.@A@
|
||||
+timestamp: include libdns-pkcs11.@A@
|
||||
touch timestamp
|
||||
|
||||
-testdirs: libdns.@A@
|
||||
+testdirs: libdns-pkcs11.@A@
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
|
||||
|
||||
install:: timestamp installdirs
|
||||
- ${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns.@A@ ${DESTDIR}${libdir}
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns-pkcs11.@A@ ${DESTDIR}${libdir}
|
||||
|
||||
uninstall::
|
||||
- ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns.@A@
|
||||
+ ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns-pkcs11.@A@
|
||||
|
||||
clean distclean::
|
||||
- rm -f libdns.@A@ timestamp
|
||||
+ rm -f libdns-pkcs11.@A@ timestamp
|
||||
rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
|
||||
rm -f include/dns/rdatastruct.h
|
||||
rm -f dnstap.pb-c.c dnstap.pb-c.h
|
||||
diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
|
||||
index 8ad54bb..a3ecdfb 100644
|
||||
--- a/lib/isc-pkcs11/Makefile.in
|
||||
+++ b/lib/isc-pkcs11/Makefile.in
|
||||
@@ -23,8 +23,8 @@ CINCLUDES = -I${srcdir}/unix/include \
|
||||
-I${srcdir}/@ISC_THREAD_DIR@/include \
|
||||
-I${srcdir}/@ISC_ARCH_DIR@/include \
|
||||
-I./include \
|
||||
- -I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
|
||||
-CDEFINES = @CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
|
||||
+ -I${srcdir}/include ${DNS_PKCS11_INCLUDES}
|
||||
+CDEFINES = @CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
|
||||
CWARNINGS =
|
||||
|
||||
# Alphabetically
|
||||
@@ -103,40 +103,40 @@ version.@O@: version.c
|
||||
-DLIBAGE=${LIBAGE} \
|
||||
-c ${srcdir}/version.c
|
||||
|
||||
-libisc.@SA@: ${OBJS} ${SYMTBLOBJS}
|
||||
+libisc-pkcs11.@SA@: ${OBJS} ${SYMTBLOBJS}
|
||||
${AR} ${ARFLAGS} $@ ${OBJS} ${SYMTBLOBJS}
|
||||
${RANLIB} $@
|
||||
|
||||
-libisc-nosymtbl.@SA@: ${OBJS}
|
||||
+libisc-pkcs11-nosymtbl.@SA@: ${OBJS}
|
||||
${AR} ${ARFLAGS} $@ ${OBJS}
|
||||
${RANLIB} $@
|
||||
|
||||
-libisc.la: ${OBJS} ${SYMTBLOBJS}
|
||||
+libisc-pkcs11.la: ${OBJS} ${SYMTBLOBJS}
|
||||
${LIBTOOL_MODE_LINK} \
|
||||
- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la -rpath ${libdir} \
|
||||
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11.la -rpath ${libdir} \
|
||||
-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
|
||||
${OBJS} ${SYMTBLOBJS} ${LIBS}
|
||||
|
||||
-libisc-nosymtbl.la: ${OBJS}
|
||||
+libisc-pkcs11-nosymtbl.la: ${OBJS}
|
||||
${LIBTOOL_MODE_LINK} \
|
||||
- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-nosymtbl.la -rpath ${libdir} \
|
||||
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11-nosymtbl.la -rpath ${libdir} \
|
||||
-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
|
||||
${OBJS} ${LIBS}
|
||||
|
||||
-timestamp: libisc.@A@ libisc-nosymtbl.@A@
|
||||
+timestamp: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
|
||||
touch timestamp
|
||||
|
||||
-testdirs: libisc.@A@ libisc-nosymtbl.@A@
|
||||
+testdirs: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
|
||||
|
||||
install:: timestamp installdirs
|
||||
- ${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc.@A@ ${DESTDIR}${libdir}
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc-pkcs11.@A@ ${DESTDIR}${libdir}
|
||||
|
||||
uninstall::
|
||||
- ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc.@A@
|
||||
+ ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc-pkcs11.@A@
|
||||
|
||||
clean distclean::
|
||||
- rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
|
||||
- libisc-nosymtbl.la timestamp
|
||||
+ rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
|
||||
+ libisc-pkcs11-nosymtbl.la timestamp
|
||||
diff --git a/make/includes.in b/make/includes.in
|
||||
index fa86ad1..3cfbe9f 100644
|
||||
--- a/make/includes.in
|
||||
+++ b/make/includes.in
|
||||
@@ -43,3 +43,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
|
||||
|
||||
TEST_INCLUDES = \
|
||||
-I${top_srcdir}/lib/tests/include
|
||||
+
|
||||
+ISC_PKCS11_INCLUDES = @BIND9_ISC_BUILDINCLUDE@ \
|
||||
+ -I${top_srcdir}/lib/isc-pkcs11 \
|
||||
+ -I${top_srcdir}/lib/isc-pkcs11/include \
|
||||
+ -I${top_srcdir}/lib/isc-pkcs11/unix/include \
|
||||
+ -I${top_srcdir}/lib/isc-pkcs11/@ISC_THREAD_DIR@/include \
|
||||
+ -I${top_srcdir}/lib/isc-pkcs11/@ISC_ARCH_DIR@/include
|
||||
+
|
||||
+DNS_PKCS11_INCLUDES = @BIND9_DNS_BUILDINCLUDE@ \
|
||||
+ -I${top_srcdir}/lib/dns-pkcs11/include
|
319
bind-9.10-sdb.patch
Normal file
319
bind-9.10-sdb.patch
Normal file
@ -0,0 +1,319 @@
|
||||
diff --git a/bin/Makefile.in b/bin/Makefile.in
|
||||
index ce7a2da..4e6a824 100644
|
||||
--- a/bin/Makefile.in
|
||||
+++ b/bin/Makefile.in
|
||||
@@ -11,8 +11,8 @@ srcdir = @srcdir@
|
||||
VPATH = @srcdir@
|
||||
top_srcdir = @top_srcdir@
|
||||
|
||||
-SUBDIRS = named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
|
||||
- check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
|
||||
+SUBDIRS = named named-sdb named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
|
||||
+ check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ sdb_tools tests
|
||||
TARGETS =
|
||||
|
||||
@BIND9_MAKE_RULES@
|
||||
diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
|
||||
index 4cfed4d..c6b42b2 100644
|
||||
--- a/bin/named-sdb/Makefile.in
|
||||
+++ b/bin/named-sdb/Makefile.in
|
||||
@@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
|
||||
#
|
||||
# Add database drivers here.
|
||||
#
|
||||
-DBDRIVER_OBJS =
|
||||
-DBDRIVER_SRCS =
|
||||
+DBDRIVER_OBJS = ldapdb.@O@ pgsqldb.@O@ sqlitedb.@O@ dirdb.@O@
|
||||
+DBDRIVER_SRCS = ldapdb.c pgsqldb.c sqlitedb.c dirdb.c
|
||||
DBDRIVER_INCLUDES =
|
||||
-DBDRIVER_LIBS =
|
||||
+DBDRIVER_LIBS = -lldap -llber -lsqlite3 -lpq
|
||||
|
||||
DLZ_DRIVER_DIR = ${top_srcdir}/contrib/dlz/drivers
|
||||
|
||||
@@ -80,7 +80,7 @@ NOSYMLIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
|
||||
SUBDIRS = unix
|
||||
|
||||
-TARGETS = named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
|
||||
+TARGETS = named-sdb@EXEEXT@ feature-test-sdb@EXEEXT@
|
||||
|
||||
GEOIPLINKOBJS = geoip.@O@
|
||||
GEOIP2LINKOBJS = geoip.@O@
|
||||
@@ -154,7 +154,7 @@ server.@O@: server.c
|
||||
-DPRODUCT=\"${PRODUCT}\" \
|
||||
-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
|
||||
|
||||
-named@EXEEXT@: ${OBJS} ${DEPLIBS}
|
||||
+named-sdb@EXEEXT@: ${OBJS} ${DEPLIBS}
|
||||
export MAKE_SYMTABLE="yes"; \
|
||||
export BASEOBJS="${OBJS} ${UOBJS}"; \
|
||||
${FINALBUILDCMD}
|
||||
@@ -168,7 +168,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
|
||||
${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
|
||||
-c ${top_srcdir}/bin/tests/system/feature-test.c
|
||||
|
||||
-feature-test@EXEEXT@: feature-test.@O@
|
||||
+feature-test-sdb@EXEEXT@: feature-test.@O@
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
|
||||
-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
|
||||
|
||||
@@ -190,8 +190,6 @@ statschannel.@O@: bind9.xsl.h
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
- $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
|
||||
- $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
install-man5: named.conf.5
|
||||
${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
|
||||
@@ -201,16 +199,11 @@ install-man8: named.8 lwresd.8
|
||||
|
||||
install-man: install-man5 install-man8
|
||||
|
||||
-install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
|
||||
- ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
- (cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
|
||||
+install:: ${TARGETS} installdirs
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-sdb@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
|
||||
uninstall::
|
||||
- rm -f ${DESTDIR}${mandir}/man5/named.conf.5
|
||||
- rm -f ${DESTDIR}${mandir}/man8/lwresd.8
|
||||
- rm -f ${DESTDIR}${mandir}/man8/named.8
|
||||
- rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
|
||||
- ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
|
||||
+ ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-sdb@EXEEXT@
|
||||
|
||||
@DLZ_DRIVER_RULES@
|
||||
|
||||
diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
|
||||
index c9fc3cc..148ebb3 100644
|
||||
--- a/bin/named-sdb/main.c
|
||||
+++ b/bin/named-sdb/main.c
|
||||
@@ -97,6 +97,10 @@
|
||||
* Include header files for database drivers here.
|
||||
*/
|
||||
/* #include "xxdb.h" */
|
||||
+#include "ldapdb.h"
|
||||
+#include "pgsqldb.h"
|
||||
+#include "sqlitedb.h"
|
||||
+#include "dirdb.h"
|
||||
|
||||
#ifdef CONTRIB_DLZ
|
||||
/*
|
||||
@@ -1134,6 +1138,11 @@ setup(void) {
|
||||
ns_main_earlyfatal("isc_app_start() failed: %s",
|
||||
isc_result_totext(result));
|
||||
|
||||
+ ldapdb_clear();
|
||||
+ pgsqldb_clear();
|
||||
+ dirdb_clear();
|
||||
+ sqlitedb_clear();
|
||||
+
|
||||
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
ISC_LOG_NOTICE, "starting %s %s%s%s <id:%s>",
|
||||
ns_g_product, ns_g_version,
|
||||
@@ -1334,6 +1343,75 @@ setup(void) {
|
||||
isc_result_totext(result));
|
||||
#endif
|
||||
|
||||
+ result = ldapdb_init();
|
||||
+ if (result != ISC_R_SUCCESS)
|
||||
+ {
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_ERROR,
|
||||
+ "SDB ldap module initialisation failed: %s.",
|
||||
+ isc_result_totext(result)
|
||||
+ );
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_ERROR,
|
||||
+ "SDB ldap zone database will be unavailable."
|
||||
+ );
|
||||
+ }else
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_NOTICE, "SDB ldap zone database module loaded."
|
||||
+ );
|
||||
+
|
||||
+ result = pgsqldb_init();
|
||||
+ if (result != ISC_R_SUCCESS)
|
||||
+ {
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_ERROR,
|
||||
+ "SDB pgsql module initialisation failed: %s.",
|
||||
+ isc_result_totext(result)
|
||||
+ );
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_ERROR,
|
||||
+ "SDB pgsql zone database will be unavailable."
|
||||
+ );
|
||||
+ }else
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_NOTICE, "SDB postgreSQL DB zone database module loaded."
|
||||
+ );
|
||||
+
|
||||
+ result = sqlitedb_init();
|
||||
+ if (result != ISC_R_SUCCESS)
|
||||
+ {
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_ERROR,
|
||||
+ "SDB sqlite3 module initialisation failed: %s.",
|
||||
+ isc_result_totext(result)
|
||||
+ );
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_ERROR,
|
||||
+ "SDB sqlite3 zone database will be unavailable."
|
||||
+ );
|
||||
+ }else
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_NOTICE, "SDB sqlite3 DB zone database module loaded."
|
||||
+ );
|
||||
+
|
||||
+ result = dirdb_init();
|
||||
+ if (result != ISC_R_SUCCESS)
|
||||
+ {
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_ERROR,
|
||||
+ "SDB directory DB module initialisation failed: %s.",
|
||||
+ isc_result_totext(result)
|
||||
+ );
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_ERROR,
|
||||
+ "SDB directory DB zone database will be unavailable."
|
||||
+ );
|
||||
+ }else
|
||||
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
+ ISC_LOG_NOTICE, "SDB directory DB zone database module loaded."
|
||||
+ );
|
||||
+
|
||||
+
|
||||
ns_server_create(ns_g_mctx, &ns_g_server);
|
||||
|
||||
#ifdef HAVE_LIBSECCOMP
|
||||
@@ -1376,6 +1454,11 @@ cleanup(void) {
|
||||
|
||||
dns_name_destroy();
|
||||
|
||||
+ ldapdb_clear();
|
||||
+ pgsqldb_clear();
|
||||
+ sqlitedb_clear();
|
||||
+ dirdb_clear();
|
||||
+
|
||||
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
|
||||
ISC_LOG_NOTICE, "exiting");
|
||||
ns_log_shutdown();
|
||||
diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
|
||||
index 4cfed4d..f4bce7b 100644
|
||||
--- a/bin/named/Makefile.in
|
||||
+++ b/bin/named/Makefile.in
|
||||
@@ -45,10 +45,10 @@ DLZDRIVER_LIBS = @DLZ_DRIVER_LIBS@
|
||||
CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include -I. \
|
||||
${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
|
||||
${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
|
||||
- ${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
|
||||
+ ${MAXMINDDB_CFLAGS} \
|
||||
@DST_OPENSSL_INC@
|
||||
|
||||
-CDEFINES = @CONTRIB_DLZ@ @USE_GSSAPI@ @CRYPTO@
|
||||
+CDEFINES = @USE_GSSAPI@ @CRYPTO@
|
||||
|
||||
CWARNINGS =
|
||||
|
||||
@@ -72,11 +72,11 @@ DEPLIBS = ${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
|
||||
|
||||
LIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
|
||||
- ${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
|
||||
+ @LIBS@
|
||||
|
||||
NOSYMLIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
|
||||
- ${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
|
||||
+ @LIBS@
|
||||
|
||||
SUBDIRS = unix
|
||||
|
||||
@@ -94,8 +94,7 @@ OBJS = builtin.@O@ client.@O@ config.@O@ control.@O@ \
|
||||
tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
|
||||
zoneconf.@O@ \
|
||||
lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
|
||||
- lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
|
||||
- ${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
|
||||
+ lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
|
||||
|
||||
UOBJS = unix/os.@O@ unix/dlz_dlopen_driver.@O@
|
||||
|
||||
@@ -113,8 +112,7 @@ SRCS = builtin.c client.c config.c control.c \
|
||||
tkeyconf.c tsigconf.c update.c xfrout.c \
|
||||
zoneconf.c \
|
||||
lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
|
||||
- lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
|
||||
- ${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
|
||||
+ lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
|
||||
|
||||
MANPAGES = named.8 lwresd.8 named.conf.5
|
||||
|
||||
@@ -212,7 +210,5 @@ uninstall::
|
||||
rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
|
||||
${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
|
||||
|
||||
-@DLZ_DRIVER_RULES@
|
||||
-
|
||||
named-symtbl.@O@: named-symtbl.c
|
||||
${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c named-symtbl.c
|
||||
diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
|
||||
index c7e0868..95ab742 100644
|
||||
--- a/bin/sdb_tools/Makefile.in
|
||||
+++ b/bin/sdb_tools/Makefile.in
|
||||
@@ -32,11 +32,11 @@ DEPLIBS = ${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
|
||||
LIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
|
||||
|
||||
-TARGETS = zone2ldap@EXEEXT@ zonetodb@EXEEXT@
|
||||
+TARGETS = zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
|
||||
|
||||
-OBJS = zone2ldap.@O@ zonetodb.@O@
|
||||
+OBJS = zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
|
||||
|
||||
-SRCS = zone2ldap.c zonetodb.c
|
||||
+SRCS = zone2ldap.c zonetodb.c zone2sqlite.c
|
||||
|
||||
MANPAGES = zone2ldap.1
|
||||
|
||||
@@ -50,6 +50,9 @@ zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
|
||||
zonetodb@EXEEXT@: zonetodb.@O@ ${DEPLIBS}
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
|
||||
|
||||
+zone2sqlite@EXEEXT@: zone2sqlite.@O@ ${DEPLIBS}
|
||||
+ ${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ zone2sqlite.@O@ -lsqlite3 -lssl ${LIBS}
|
||||
+
|
||||
clean distclean manclean maintainer-clean::
|
||||
rm -f ${TARGETS} ${OBJS}
|
||||
|
||||
@@ -60,4 +63,5 @@ installdirs:
|
||||
install:: ${TARGETS} installdirs
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index f85f45f..7d28c52 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -5400,6 +5400,8 @@ AC_CONFIG_FILES([
|
||||
bin/named/unix/Makefile
|
||||
bin/named-pkcs11/Makefile
|
||||
bin/named-pkcs11/unix/Makefile
|
||||
+ bin/named-sdb/Makefile
|
||||
+ bin/named-sdb/unix/Makefile
|
||||
bin/nsupdate/Makefile
|
||||
bin/pkcs11/Makefile
|
||||
bin/python/Makefile
|
||||
@@ -5424,6 +5426,7 @@ AC_CONFIG_FILES([
|
||||
bin/python/isc/tests/policy_test.py
|
||||
bin/python/isc/utils.py
|
||||
bin/rndc/Makefile
|
||||
+ bin/sdb_tools/Makefile
|
||||
bin/tests/Makefile
|
||||
bin/tests/headerdep_test.sh
|
||||
bin/tests/optional/Makefile
|
18
bind-9.10-use-of-strlcat.patch
Normal file
18
bind-9.10-use-of-strlcat.patch
Normal file
@ -0,0 +1,18 @@
|
||||
diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
|
||||
index d56bc56..99c3314 100644
|
||||
--- a/bin/sdb_tools/zone2ldap.c
|
||||
+++ b/bin/sdb_tools/zone2ldap.c
|
||||
@@ -817,11 +817,11 @@ build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
|
||||
}
|
||||
|
||||
|
||||
- strlcat (dn, tmp, sizeof (dn));
|
||||
+ strncat (dn, tmp, sizeof (dn) - strlen (dn));
|
||||
}
|
||||
|
||||
sprintf (tmp, "dc=%s", dc_list[0]);
|
||||
- strlcat (dn, tmp, sizeof (dn));
|
||||
+ strncat (dn, tmp, sizeof (dn) - strlen (dn));
|
||||
|
||||
fflush(NULL);
|
||||
return dn;
|
27
bind-9.11-engine-pkcs11.patch
Normal file
27
bind-9.11-engine-pkcs11.patch
Normal file
@ -0,0 +1,27 @@
|
||||
From 37f89ccfc439f8d86c401d9ae10e94e53b924961 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Tue, 27 Aug 2019 20:39:59 +0200
|
||||
Subject: [PATCH] Do not set engine for native PKCS11
|
||||
|
||||
It resets already set lib_path to pkcs11, which is invalid in native
|
||||
pkcs11 crypto. Engine has to be path to PKCS#11 module.
|
||||
---
|
||||
bin/named/include/named/globals.h | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
|
||||
index eda2214..2a611d5 100644
|
||||
--- a/bin/named/include/named/globals.h
|
||||
+++ b/bin/named/include/named/globals.h
|
||||
@@ -160,7 +160,7 @@ EXTERN const char * ns_g_defaultdnstap INIT(NULL);
|
||||
|
||||
EXTERN const char * ns_g_username INIT(NULL);
|
||||
|
||||
-#if defined(USE_PKCS11)
|
||||
+#if defined(USE_PKCS11) && !defined(PKCS11CRYPTO)
|
||||
EXTERN const char * ns_g_engine INIT(PKCS11_ENGINE);
|
||||
#else
|
||||
EXTERN const char * ns_g_engine INIT(NULL);
|
||||
--
|
||||
2.20.1
|
||||
|
39
bind-9.11-export-suffix.patch
Normal file
39
bind-9.11-export-suffix.patch
Normal file
@ -0,0 +1,39 @@
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index c1bfd62..7c5ad51 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -5333,6 +5333,8 @@ AC_SUBST(BUILD_CPPFLAGS)
|
||||
AC_SUBST(BUILD_LDFLAGS)
|
||||
AC_SUBST(BUILD_LIBS)
|
||||
|
||||
+AC_SUBST(LIBDIR_SUFFIX)
|
||||
+
|
||||
#
|
||||
# Commands to run at the end of config.status.
|
||||
# Don't just put these into configure, it won't work right if somebody
|
||||
diff --git a/isc-config.sh.in b/isc-config.sh.in
|
||||
index b5e94ed..d2857e0 100644
|
||||
--- a/isc-config.sh.in
|
||||
+++ b/isc-config.sh.in
|
||||
@@ -13,16 +13,17 @@ prefix=@prefix@
|
||||
exec_prefix=@exec_prefix@
|
||||
exec_prefix_set=
|
||||
includedir=@includedir@
|
||||
+libdir_suffix=@LIBDIR_SUFFIX@
|
||||
arch=$(uname -m)
|
||||
|
||||
case $arch in
|
||||
x86_64 | amd64 | sparc64 | s390x | ppc64)
|
||||
- libdir=/usr/lib64
|
||||
- sec_libdir=/usr/lib
|
||||
+ libdir=/usr/lib64${libdir_suffix}
|
||||
+ sec_libdir=/usr/lib${libdir_suffix}
|
||||
;;
|
||||
* )
|
||||
- libdir=/usr/lib
|
||||
- sec_libdir=/usr/lib64
|
||||
+ libdir=/usr/lib${libdir_suffix}
|
||||
+ sec_libdir=/usr/lib64${libdir_suffix}
|
||||
;;
|
||||
esac
|
||||
|
71
bind-9.11-feature-test-named.patch
Normal file
71
bind-9.11-feature-test-named.patch
Normal file
@ -0,0 +1,71 @@
|
||||
From 3f2fafe5368655225eddf0537e58e425bbc297be Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Wed, 30 Jan 2019 14:37:17 +0100
|
||||
Subject: [PATCH] Create feature-test in source directory
|
||||
|
||||
Feature-test tool is used in system tests to test compiled in changes.
|
||||
Because we build more variants of named with different configuration,
|
||||
compile feature-test for each of them this way.
|
||||
|
||||
Named variant specific feature-test does not have defined gss support,
|
||||
even when it was enabled by configure. bin/tests/system Makefile defines
|
||||
it, so define it also in named variants.
|
||||
---
|
||||
bin/named/Makefile.in | 13 +++++++++++--
|
||||
bin/tests/system/conf.sh.in | 2 +-
|
||||
2 files changed, 12 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
|
||||
index 3166368..70e5571 100644
|
||||
--- a/bin/named/Makefile.in
|
||||
+++ b/bin/named/Makefile.in
|
||||
@@ -48,7 +48,7 @@ CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include -I. \
|
||||
${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
|
||||
@DST_OPENSSL_INC@
|
||||
|
||||
-CDEFINES = @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
|
||||
+CDEFINES = @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @USE_GSSAPI@ @CRYPTO@
|
||||
|
||||
CWARNINGS =
|
||||
|
||||
@@ -80,7 +80,7 @@ NOSYMLIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
|
||||
SUBDIRS = unix
|
||||
|
||||
-TARGETS = named@EXEEXT@ lwresd@EXEEXT@
|
||||
+TARGETS = named@EXEEXT@ lwresd@EXEEXT@ feature-test@EXEEXT@
|
||||
|
||||
GEOIPLINKOBJS = geoip.@O@
|
||||
GEOIP2LINKOBJS = geoip.@O@
|
||||
@@ -163,6 +163,15 @@ lwresd@EXEEXT@: named@EXEEXT@
|
||||
rm -f lwresd@EXEEXT@
|
||||
@LN@ named@EXEEXT@ lwresd@EXEEXT@
|
||||
|
||||
+# Bit of hack, do not produce intermediate .o object for featuretest
|
||||
+feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
|
||||
+ ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
|
||||
+ -c ${top_srcdir}/bin/tests/system/feature-test.c
|
||||
+
|
||||
+feature-test@EXEEXT@: feature-test.@O@
|
||||
+ ${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
|
||||
+ -o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
|
||||
+
|
||||
doc man:: ${MANOBJS}
|
||||
|
||||
docclean manclean maintainer-clean::
|
||||
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
|
||||
index cedabbe..e1bf5da 100644
|
||||
--- a/bin/tests/system/conf.sh.in
|
||||
+++ b/bin/tests/system/conf.sh.in
|
||||
@@ -71,7 +71,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
|
||||
MDIG=$TOP/bin/tools/mdig
|
||||
NZD2NZF=$TOP/bin/tools/named-nzd2nzf
|
||||
FSTRM_CAPTURE=@FSTRM_CAPTURE@
|
||||
-FEATURETEST=$TOP/bin/tests/system/feature-test
|
||||
+FEATURETEST=$TOP/bin/named/feature-test
|
||||
|
||||
RANDFILE=$TOP/bin/tests/system/random.data
|
||||
|
||||
--
|
||||
2.20.1
|
||||
|
1459
bind-9.11-fips-code.patch
Normal file
1459
bind-9.11-fips-code.patch
Normal file
File diff suppressed because it is too large
Load Diff
121
bind-9.11-fips-disable.patch
Normal file
121
bind-9.11-fips-disable.patch
Normal file
@ -0,0 +1,121 @@
|
||||
From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Mon, 5 Aug 2019 11:54:03 +0200
|
||||
Subject: [PATCH] Allow explicit disabling of autodisabled MD5
|
||||
|
||||
Default security policy might include explicitly disabled RSAMD5
|
||||
algorithm. Current FIPS code automatically disables in FIPS mode. But if
|
||||
RSAMD5 is included in security policy, it fails to start, because that
|
||||
algorithm is not recognized. Allow it disabled, but fail on any
|
||||
other usage.
|
||||
---
|
||||
bin/named/server.c | 4 ++--
|
||||
lib/bind9/check.c | 4 ++++
|
||||
lib/dns/rcode.c | 33 +++++++++++++++------------------
|
||||
3 files changed, 21 insertions(+), 20 deletions(-)
|
||||
|
||||
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||
index 5b57371..51702ab 100644
|
||||
--- a/bin/named/server.c
|
||||
+++ b/bin/named/server.c
|
||||
@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
|
||||
r.length = strlen(r.base);
|
||||
|
||||
result = dns_secalg_fromtext(&alg, &r);
|
||||
- if (result != ISC_R_SUCCESS) {
|
||||
+ if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
|
||||
uint8_t ui;
|
||||
result = isc_parse_uint8(&ui, r.base, 10);
|
||||
alg = ui;
|
||||
}
|
||||
- if (result != ISC_R_SUCCESS) {
|
||||
+ if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
|
||||
cfg_obj_log(cfg_listelt_value(element),
|
||||
ns_g_lctx, ISC_LOG_ERROR,
|
||||
"invalid algorithm");
|
||||
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
|
||||
index e0803d4..8023784 100644
|
||||
--- a/lib/bind9/check.c
|
||||
+++ b/lib/bind9/check.c
|
||||
@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
|
||||
r.length = strlen(r.base);
|
||||
|
||||
tresult = dns_secalg_fromtext(&alg, &r);
|
||||
+ if (tresult == ISC_R_DISABLED) {
|
||||
+ // Recognize disabled algorithms, disable it explicitly
|
||||
+ tresult = ISC_R_SUCCESS;
|
||||
+ }
|
||||
if (tresult != ISC_R_SUCCESS) {
|
||||
cfg_obj_log(cfg_listelt_value(element), logctx,
|
||||
ISC_LOG_ERROR, "invalid algorithm '%s'",
|
||||
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
|
||||
index f51d548..c49b8d1 100644
|
||||
--- a/lib/dns/rcode.c
|
||||
+++ b/lib/dns/rcode.c
|
||||
@@ -126,7 +126,6 @@
|
||||
#endif
|
||||
|
||||
#define SECALGNAMES \
|
||||
- MD5_SECALGNAMES \
|
||||
DH_SECALGNAMES \
|
||||
DSA_SECALGNAMES \
|
||||
{ DNS_KEYALG_ECC, "ECC", 0 }, \
|
||||
@@ -178,6 +177,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
|
||||
static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
|
||||
static struct tbl certs[] = { CERTNAMES };
|
||||
static struct tbl secalgs[] = { SECALGNAMES };
|
||||
+static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
|
||||
static struct tbl secprotos[] = { SECPROTONAMES };
|
||||
static struct tbl hashalgs[] = { HASHALGNAMES };
|
||||
static struct tbl dsdigests[] = { DSDIGESTNAMES };
|
||||
@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
|
||||
return (dns_mnemonic_totext(cert, target, certs));
|
||||
}
|
||||
|
||||
-static inline struct tbl *
|
||||
-secalgs_tbl_start() {
|
||||
- struct tbl *algs = secalgs;
|
||||
-
|
||||
-#ifndef PK11_MD5_DISABLE
|
||||
- if (!isc_md5_available()) {
|
||||
- while (algs->name != NULL &&
|
||||
- algs->value == DNS_KEYALG_RSAMD5)
|
||||
- ++algs;
|
||||
- }
|
||||
-#endif
|
||||
- return algs;
|
||||
-}
|
||||
-
|
||||
isc_result_t
|
||||
dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
|
||||
unsigned int value;
|
||||
+ isc_result_t result;
|
||||
|
||||
- RETERR(dns_mnemonic_fromtext(&value, source,
|
||||
- secalgs_tbl_start(), 0xff));
|
||||
+ result = dns_mnemonic_fromtext(&value, source,
|
||||
+ secalgs, 0xff);
|
||||
+ if (result != ISC_R_SUCCESS) {
|
||||
+ result = dns_mnemonic_fromtext(&value, source,
|
||||
+ md5_secalgs, 0xff);
|
||||
+ if (result != ISC_R_SUCCESS) {
|
||||
+ return (result);
|
||||
+ } else if (!isc_md5_available()) {
|
||||
+ *secalgp = value;
|
||||
+ return (ISC_R_DISABLED);
|
||||
+ }
|
||||
+ }
|
||||
*secalgp = value;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
|
||||
- return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
|
||||
+ return (dns_mnemonic_totext(secalg, target, secalgs));
|
||||
}
|
||||
|
||||
void
|
||||
--
|
||||
2.20.1
|
||||
|
1397
bind-9.11-fips-tests.patch
Normal file
1397
bind-9.11-fips-tests.patch
Normal file
File diff suppressed because it is too large
Load Diff
92
bind-9.11-host-idn-disable.patch
Normal file
92
bind-9.11-host-idn-disable.patch
Normal file
@ -0,0 +1,92 @@
|
||||
From ec50eff97c259b5bfbfa4e050d69fe7b39b0f15a Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Tue, 25 Sep 2018 18:08:46 +0200
|
||||
Subject: [PATCH] Disable IDN from environment as documented
|
||||
|
||||
Manual page of host contained instructions to disable IDN processing
|
||||
when it was built with libidn2. When refactoring IDN support however,
|
||||
support for disabling IDN in host and nslookup was lost. Use also
|
||||
environment variable and document it for nslookup, host and dig.
|
||||
|
||||
Support variable CHARSET=ASCII to disable IDN, supported in downstream
|
||||
RH patch since RHEL 5.
|
||||
---
|
||||
bin/dig/dig.docbook | 4 +++-
|
||||
bin/dig/dighost.c | 5 +++++
|
||||
bin/dig/host.docbook | 2 +-
|
||||
bin/dig/nslookup.docbook | 15 +++++++++++++++
|
||||
4 files changed, 24 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
|
||||
index 5d19301..933af79 100644
|
||||
--- a/bin/dig/dig.docbook
|
||||
+++ b/bin/dig/dig.docbook
|
||||
@@ -1312,7 +1312,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
||||
reply from the server.
|
||||
If you'd like to turn off the IDN support for some reason, use
|
||||
parameters <parameter>+noidnin</parameter> and
|
||||
- <parameter>+noidnout</parameter>.
|
||||
+ <parameter>+noidnout</parameter> or define
|
||||
+ the <envar>IDN_DISABLE</envar> environment variable.
|
||||
+
|
||||
</para>
|
||||
</refsection>
|
||||
|
||||
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
|
||||
index 5eabc1f..73aaab8 100644
|
||||
--- a/bin/dig/dighost.c
|
||||
+++ b/bin/dig/dighost.c
|
||||
@@ -826,6 +826,11 @@ make_empty_lookup(void) {
|
||||
looknew->badcookie = true;
|
||||
#ifdef WITH_IDN_SUPPORT
|
||||
looknew->idnin = isatty(1)?(getenv("IDN_DISABLE") == NULL):false;
|
||||
+ if (looknew->idnin) {
|
||||
+ const char *charset = getenv("CHARSET");
|
||||
+ if (charset && !strcmp(charset, "ASCII"))
|
||||
+ looknew->idnin = false;
|
||||
+ }
|
||||
#else
|
||||
looknew->idnin = false;
|
||||
#endif
|
||||
diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook
|
||||
index da0f8fb..9689b5a 100644
|
||||
--- a/bin/dig/host.docbook
|
||||
+++ b/bin/dig/host.docbook
|
||||
@@ -379,7 +379,7 @@
|
||||
<command>host</command> appropriately converts character encoding of
|
||||
domain name before sending a request to DNS server or displaying a
|
||||
reply from the server.
|
||||
- If you'd like to turn off the IDN support for some reason, defines
|
||||
+ If you'd like to turn off the IDN support for some reason, define
|
||||
the <envar>IDN_DISABLE</envar> environment variable.
|
||||
The IDN support is disabled if the variable is set when
|
||||
<command>host</command> runs.
|
||||
diff --git a/bin/dig/nslookup.docbook b/bin/dig/nslookup.docbook
|
||||
index d46fc2d..6d7d181 100644
|
||||
--- a/bin/dig/nslookup.docbook
|
||||
+++ b/bin/dig/nslookup.docbook
|
||||
@@ -495,6 +495,21 @@ nslookup -query=hinfo -timeout=10
|
||||
</para>
|
||||
</refsection>
|
||||
|
||||
+ <refsection><info><title>IDN SUPPORT</title></info>
|
||||
+
|
||||
+ <para>
|
||||
+ If <command>nslookup</command> has been built with IDN (internationalized
|
||||
+ domain name) support, it can accept and display non-ASCII domain names.
|
||||
+ <command>nslookup</command> appropriately converts character encoding of
|
||||
+ domain name before sending a request to DNS server or displaying a
|
||||
+ reply from the server.
|
||||
+ If you'd like to turn off the IDN support for some reason, define
|
||||
+ the <envar>IDN_DISABLE</envar> environment variable.
|
||||
+ The IDN support is disabled if the variable is set when
|
||||
+ <command>nslookup</command> runs.
|
||||
+ </para>
|
||||
+ </refsection>
|
||||
+
|
||||
<refsection><info><title>FILES</title></info>
|
||||
|
||||
<para><filename>/etc/resolv.conf</filename>
|
||||
--
|
||||
2.20.1
|
||||
|
50
bind-9.11-json-c.patch
Normal file
50
bind-9.11-json-c.patch
Normal file
@ -0,0 +1,50 @@
|
||||
From cb6d2019766a6c8c5516fd8859cedf0052f03293 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Thu, 25 Jul 2019 11:37:57 +0200
|
||||
Subject: [PATCH] Skip support of jsoncpp
|
||||
|
||||
Bind cannot be compiled when jsoncpp-devel is installed. Remove support
|
||||
for jsoncpp, use only json-c-devel. Bind 9.15 has already support for
|
||||
--with-json-c, do not yet introduce it.
|
||||
---
|
||||
configure.ac | 17 ++---------------
|
||||
1 file changed, 2 insertions(+), 15 deletions(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 6d05337..5ce83b5 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -2594,15 +2594,7 @@ case "$use_libjson" in
|
||||
auto|yes)
|
||||
for d in /usr /usr/local /opt/local
|
||||
do
|
||||
- if test -f "${d}/include/json/json.h"
|
||||
- then
|
||||
- if test ${d} != /usr
|
||||
- then
|
||||
- libjson_cflags="-I ${d}/include"
|
||||
- LIBS="$LIBS -L${d}/lib"
|
||||
- fi
|
||||
- have_libjson="yes"
|
||||
- elif test -f "${d}/include/json-c/json.h"
|
||||
+ if test -f "${d}/include/json-c/json.h"
|
||||
then
|
||||
if test ${d} != /usr
|
||||
then
|
||||
@@ -2615,12 +2607,7 @@ case "$use_libjson" in
|
||||
done
|
||||
;;
|
||||
*)
|
||||
- if test -f "${use_libjson}/include/json/json.h"
|
||||
- then
|
||||
- libjson_cflags="-I${use_libjson}/include"
|
||||
- LIBS="$LIBS -L${use_libjson}/lib"
|
||||
- have_libjson="yes"
|
||||
- elif test -f "${use_libjson}/include/json-c/json.h"
|
||||
+ if test -f "${use_libjson}/include/json-c/json.h"
|
||||
then
|
||||
libjson_cflags="-I${use_libjson}/include"
|
||||
LIBS="$LIBS -L${use_libjson}/lib"
|
||||
--
|
||||
2.20.1
|
||||
|
192
bind-9.11-kyua-pkcs11.patch
Normal file
192
bind-9.11-kyua-pkcs11.patch
Normal file
@ -0,0 +1,192 @@
|
||||
From a9b5785f174cf7fd74891fa64f6b69b9a9b55466 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Tue, 2 Jan 2018 18:13:07 +0100
|
||||
Subject: [PATCH] Fix pkcs11 variants atf tests
|
||||
|
||||
Add dns-pkcs11 tests Makefile to configure
|
||||
|
||||
Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
|
||||
---
|
||||
configure.ac | 1 +
|
||||
lib/Kyuafile | 2 ++
|
||||
lib/dns-pkcs11/tests/Makefile.in | 10 +++++-----
|
||||
lib/dns-pkcs11/tests/dh_test.c | 3 ++-
|
||||
lib/isc-pkcs11/tests/Makefile.in | 6 +++---
|
||||
lib/isc-pkcs11/tests/hash_test.c | 32 +++++++++++++++++++++++++-------
|
||||
6 files changed, 38 insertions(+), 16 deletions(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 62ecf56..0940a7d 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -5476,6 +5476,7 @@ AC_CONFIG_FILES([
|
||||
lib/dns-pkcs11/include/Makefile
|
||||
lib/dns-pkcs11/include/dns/Makefile
|
||||
lib/dns-pkcs11/include/dst/Makefile
|
||||
+ lib/dns-pkcs11/tests/Makefile
|
||||
lib/irs/Makefile
|
||||
lib/irs/include/Makefile
|
||||
lib/irs/include/irs/Makefile
|
||||
diff --git a/lib/Kyuafile b/lib/Kyuafile
|
||||
index 7c8bab0..eec9564 100644
|
||||
--- a/lib/Kyuafile
|
||||
+++ b/lib/Kyuafile
|
||||
@@ -2,8 +2,10 @@ syntax(2)
|
||||
test_suite('bind9')
|
||||
|
||||
include('dns/Kyuafile')
|
||||
+include('dns-pkcs11/Kyuafile')
|
||||
include('irs/Kyuafile')
|
||||
include('isc/Kyuafile')
|
||||
+include('isc-pkcs11/Kyuafile')
|
||||
include('isccc/Kyuafile')
|
||||
include('isccfg/Kyuafile')
|
||||
include('lwres/Kyuafile')
|
||||
diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
|
||||
index 22a06a8..5df5b15 100644
|
||||
--- a/lib/dns-pkcs11/tests/Makefile.in
|
||||
+++ b/lib/dns-pkcs11/tests/Makefile.in
|
||||
@@ -17,12 +17,12 @@ VERSION=@BIND9_VERSION@
|
||||
|
||||
CINCLUDES = -I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
|
||||
@DST_OPENSSL_INC@ ${MAXMINDDB_CFLAGS}
|
||||
-CDEFINES = @CRYPTO@ -DTESTS="\"${top_builddir}/lib/dns/tests/\""
|
||||
+CDEFINES = @CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
|
||||
|
||||
-ISCLIBS = ../../isc/libisc.@A@
|
||||
-ISCDEPLIBS = ../../isc/libisc.@A@
|
||||
-DNSLIBS = ../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
-DNSDEPLIBS = ../libdns.@A@
|
||||
+ISCLIBS = ../../isc-pkcs11/libisc-pkcs11.@A@
|
||||
+ISCDEPLIBS = ../../isc-pkcs11/libisc-pkcs11.@A@
|
||||
+DNSLIBS = ../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
+DNSDEPLIBS = ../libdns-pkcs11.@A@
|
||||
|
||||
LIBS = @LIBS@ @CMOCKA_LIBS@
|
||||
CFLAGS = @CFLAGS@ @CMOCKA_CFLAGS@
|
||||
diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
|
||||
index a5bf46c..9ff2b76 100644
|
||||
--- a/lib/dns-pkcs11/tests/dh_test.c
|
||||
+++ b/lib/dns-pkcs11/tests/dh_test.c
|
||||
@@ -88,7 +88,8 @@ dh_computesecret(void **state) {
|
||||
result = dst_key_computesecret(key, key, &buf);
|
||||
assert_int_equal(result, DST_R_NOTPRIVATEKEY);
|
||||
result = key->func->computesecret(key, key, &buf);
|
||||
- assert_int_equal(result, DST_R_COMPUTESECRETFAILURE);
|
||||
+ /* PKCS11 variant gives different result, accept both */
|
||||
+ assert_true(result == DST_R_COMPUTESECRETFAILURE || result == DST_R_INVALIDPRIVATEKEY);
|
||||
|
||||
dst_key_free(&key);
|
||||
}
|
||||
diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
|
||||
index 36d2207..00dfbc9 100644
|
||||
--- a/lib/isc-pkcs11/tests/Makefile.in
|
||||
+++ b/lib/isc-pkcs11/tests/Makefile.in
|
||||
@@ -16,10 +16,10 @@ VERSION=@BIND9_VERSION@
|
||||
@BIND9_MAKE_INCLUDES@
|
||||
|
||||
CINCLUDES = -I. -Iinclude ${ISC_INCLUDES} @ISC_OPENSSL_INC@
|
||||
-CDEFINES = @CRYPTO@ -DTESTS="\"${top_builddir}/lib/isc/tests/\""
|
||||
+CDEFINES = @CRYPTO_PK11@ -DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
|
||||
|
||||
-ISCLIBS = ../libisc.@A@ @ISC_OPENSSL_LIBS@
|
||||
-ISCDEPLIBS = ../libisc.@A@
|
||||
+ISCLIBS = ../libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
|
||||
+ISCDEPLIBS = ../libisc-pkcs11.@A@
|
||||
|
||||
LIBS = @LIBS@ @CMOCKA_LIBS@
|
||||
CFLAGS = @CFLAGS@ @CMOCKA_CFLAGS@
|
||||
diff --git a/lib/isc-pkcs11/tests/hash_test.c b/lib/isc-pkcs11/tests/hash_test.c
|
||||
index 4fafc38..5eb2be2 100644
|
||||
--- a/lib/isc-pkcs11/tests/hash_test.c
|
||||
+++ b/lib/isc-pkcs11/tests/hash_test.c
|
||||
@@ -84,7 +84,7 @@ typedef struct hash_testcase {
|
||||
|
||||
typedef struct hash_test_key {
|
||||
const char *key;
|
||||
- const int len;
|
||||
+ const unsigned len;
|
||||
} hash_test_key_t;
|
||||
|
||||
/* non-hmac tests */
|
||||
@@ -955,8 +955,11 @@ isc_hmacsha1_test(void **state) {
|
||||
hash_test_key_t *test_key = test_keys;
|
||||
|
||||
while (testcase->input != NULL && testcase->result != NULL) {
|
||||
+ int len = ISC_MAX(test_key->len, ISC_SHA1_DIGESTLENGTH);
|
||||
+
|
||||
+ memset(buffer, 0, ISC_SHA1_DIGESTLENGTH);
|
||||
memmove(buffer, test_key->key, test_key->len);
|
||||
- isc_hmacsha1_init(&hmacsha1, buffer, test_key->len);
|
||||
+ isc_hmacsha1_init(&hmacsha1, buffer, len);
|
||||
isc_hmacsha1_update(&hmacsha1,
|
||||
(const uint8_t *) testcase->input,
|
||||
testcase->input_len);
|
||||
@@ -1115,8 +1118,11 @@ isc_hmacsha224_test(void **state) {
|
||||
hash_test_key_t *test_key = test_keys;
|
||||
|
||||
while (testcase->input != NULL && testcase->result != NULL) {
|
||||
+ int len = ISC_MAX(test_key->len, ISC_SHA224_DIGESTLENGTH);
|
||||
+
|
||||
+ memset(buffer, 0, ISC_SHA224_DIGESTLENGTH);
|
||||
memmove(buffer, test_key->key, test_key->len);
|
||||
- isc_hmacsha224_init(&hmacsha224, buffer, test_key->len);
|
||||
+ isc_hmacsha224_init(&hmacsha224, buffer, len);
|
||||
isc_hmacsha224_update(&hmacsha224,
|
||||
(const uint8_t *) testcase->input,
|
||||
testcase->input_len);
|
||||
@@ -1276,8 +1282,11 @@ isc_hmacsha256_test(void **state) {
|
||||
hash_test_key_t *test_key = test_keys;
|
||||
|
||||
while (testcase->input != NULL && testcase->result != NULL) {
|
||||
+ int len = ISC_MAX(test_key->len, ISC_SHA256_DIGESTLENGTH);
|
||||
+
|
||||
+ memset(buffer, 0, ISC_SHA256_DIGESTLENGTH);
|
||||
memmove(buffer, test_key->key, test_key->len);
|
||||
- isc_hmacsha256_init(&hmacsha256, buffer, test_key->len);
|
||||
+ isc_hmacsha256_init(&hmacsha256, buffer, len);
|
||||
isc_hmacsha256_update(&hmacsha256,
|
||||
(const uint8_t *) testcase->input,
|
||||
testcase->input_len);
|
||||
@@ -1443,8 +1452,11 @@ isc_hmacsha384_test(void **state) {
|
||||
hash_test_key_t *test_key = test_keys;
|
||||
|
||||
while (testcase->input != NULL && testcase->result != NULL) {
|
||||
+ int len = ISC_MAX(test_key->len, ISC_SHA384_DIGESTLENGTH);
|
||||
+
|
||||
+ memset(buffer, 0, ISC_SHA384_DIGESTLENGTH);
|
||||
memmove(buffer, test_key->key, test_key->len);
|
||||
- isc_hmacsha384_init(&hmacsha384, buffer, test_key->len);
|
||||
+ isc_hmacsha384_init(&hmacsha384, buffer, len);
|
||||
isc_hmacsha384_update(&hmacsha384,
|
||||
(const uint8_t *) testcase->input,
|
||||
testcase->input_len);
|
||||
@@ -1610,8 +1622,11 @@ isc_hmacsha512_test(void **state) {
|
||||
hash_test_key_t *test_key = test_keys;
|
||||
|
||||
while (testcase->input != NULL && testcase->result != NULL) {
|
||||
+ int len = ISC_MAX(test_key->len, ISC_SHA512_DIGESTLENGTH);
|
||||
+
|
||||
+ memset(buffer, 0, ISC_SHA512_DIGESTLENGTH);
|
||||
memmove(buffer, test_key->key, test_key->len);
|
||||
- isc_hmacsha512_init(&hmacsha512, buffer, test_key->len);
|
||||
+ isc_hmacsha512_init(&hmacsha512, buffer, len);
|
||||
isc_hmacsha512_update(&hmacsha512,
|
||||
(const uint8_t *) testcase->input,
|
||||
testcase->input_len);
|
||||
@@ -1754,8 +1769,11 @@ isc_hmacmd5_test(void **state) {
|
||||
hash_test_key_t *test_key = test_keys;
|
||||
|
||||
while (testcase->input != NULL && testcase->result != NULL) {
|
||||
+ int len = ISC_MAX(test_key->len, ISC_MD5_DIGESTLENGTH);
|
||||
+
|
||||
+ memset(buffer, 0, ISC_MD5_DIGESTLENGTH);
|
||||
memmove(buffer, test_key->key, test_key->len);
|
||||
- isc_hmacmd5_init(&hmacmd5, buffer, test_key->len);
|
||||
+ isc_hmacmd5_init(&hmacmd5, buffer, len);
|
||||
isc_hmacmd5_update(&hmacmd5,
|
||||
(const uint8_t *) testcase->input,
|
||||
testcase->input_len);
|
||||
--
|
||||
2.21.1
|
||||
|
256
bind-9.11-oot-manual.patch
Normal file
256
bind-9.11-oot-manual.patch
Normal file
@ -0,0 +1,256 @@
|
||||
From 8ca95f47231822df2b9c171a4da1e93ca5b748eb Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Wed, 25 Jul 2018 12:24:16 +0200
|
||||
Subject: [PATCH] Use make automatic variables to install updated manuals
|
||||
|
||||
Make will choose modified manual from build directory or original from source
|
||||
directory automagically. Take advantage of install tool feature.
|
||||
Install all files in single command instead of iterating on each of them.
|
||||
---
|
||||
bin/check/Makefile.in | 8 +++++---
|
||||
bin/confgen/Makefile.in | 9 +++++----
|
||||
bin/delv/Makefile.in | 6 ++++--
|
||||
bin/dig/Makefile.in | 8 ++++----
|
||||
bin/dnssec/Makefile.in | 6 ++++--
|
||||
bin/named/Makefile.in | 13 +++++++++----
|
||||
bin/pkcs11/Makefile.in | 9 ++++-----
|
||||
bin/python/Makefile.in | 8 ++++----
|
||||
bin/tools/Makefile.in | 25 +++++++++++++++----------
|
||||
9 files changed, 54 insertions(+), 38 deletions(-)
|
||||
|
||||
diff --git a/bin/check/Makefile.in b/bin/check/Makefile.in
|
||||
index c124e80..1174f8d 100644
|
||||
--- a/bin/check/Makefile.in
|
||||
+++ b/bin/check/Makefile.in
|
||||
@@ -83,12 +83,14 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
-install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
|
||||
+install-man8: ${MANPAGES}
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
+ (cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
|
||||
+
|
||||
+install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs install-man8
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
|
||||
- for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
|
||||
- (cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
|
||||
|
||||
uninstall::
|
||||
rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
|
||||
diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
|
||||
index 87f13dd..7865c0c 100644
|
||||
--- a/bin/confgen/Makefile.in
|
||||
+++ b/bin/confgen/Makefile.in
|
||||
@@ -95,13 +95,14 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
-install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs
|
||||
+install-man8: rndc-confgen.8 ddns-confgen.8
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
+ (cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
|
||||
+
|
||||
+install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs install-man8
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} rndc-confgen@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ddns-confgen@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
- ${INSTALL_DATA} ${srcdir}/rndc-confgen.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/ddns-confgen.8 ${DESTDIR}${mandir}/man8
|
||||
(cd ${DESTDIR}${sbindir}; rm -f tsig-keygen@EXEEXT@; ${LINK_PROGRAM} ddns-confgen@EXEEXT@ tsig-keygen@EXEEXT@)
|
||||
- (cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
|
||||
|
||||
uninstall::
|
||||
rm -f ${DESTDIR}${mandir}/man8/tsig-keygen.8
|
||||
diff --git a/bin/delv/Makefile.in b/bin/delv/Makefile.in
|
||||
index e2d2802..19361a8 100644
|
||||
--- a/bin/delv/Makefile.in
|
||||
+++ b/bin/delv/Makefile.in
|
||||
@@ -63,10 +63,12 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
|
||||
|
||||
-install:: delv@EXEEXT@ installdirs
|
||||
+install-man1: delv.1
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
|
||||
+
|
||||
+install:: delv@EXEEXT@ installdirs install-man1
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
|
||||
delv@EXEEXT@ ${DESTDIR}${bindir}
|
||||
- ${INSTALL_DATA} ${srcdir}/delv.1 ${DESTDIR}${mandir}/man1
|
||||
|
||||
uninstall::
|
||||
rm -f ${DESTDIR}${mandir}/man1/delv.1
|
||||
diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
|
||||
index a9830a9..d7ac0b6 100644
|
||||
--- a/bin/dig/Makefile.in
|
||||
+++ b/bin/dig/Makefile.in
|
||||
@@ -91,16 +91,16 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
|
||||
|
||||
-install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
|
||||
+install-man1: ${MANPAGES}
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
|
||||
+
|
||||
+install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs install-man1
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
|
||||
dig@EXEEXT@ ${DESTDIR}${bindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
|
||||
host@EXEEXT@ ${DESTDIR}${bindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
|
||||
nslookup@EXEEXT@ ${DESTDIR}${bindir}
|
||||
- for m in ${MANPAGES}; do \
|
||||
- ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
|
||||
- done
|
||||
|
||||
uninstall::
|
||||
for m in ${MANPAGES}; do \
|
||||
diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
|
||||
index 2239ad1..ce0a177 100644
|
||||
--- a/bin/dnssec/Makefile.in
|
||||
+++ b/bin/dnssec/Makefile.in
|
||||
@@ -110,9 +110,11 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
-install:: ${TARGETS} installdirs
|
||||
+install-man8: ${MANPAGES}
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
+
|
||||
+install:: ${TARGETS} installdirs install-man8
|
||||
for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
|
||||
- for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
|
||||
|
||||
uninstall::
|
||||
for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
|
||||
diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
|
||||
index e1f85a9..d92bc9a 100644
|
||||
--- a/bin/named/Makefile.in
|
||||
+++ b/bin/named/Makefile.in
|
||||
@@ -176,12 +176,17 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
-install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs
|
||||
+install-man5: named.conf.5
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man5
|
||||
+
|
||||
+install-man8: named.8 lwresd.8
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
+
|
||||
+install-man: install-man5 install-man8
|
||||
+
|
||||
+install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
|
||||
- ${INSTALL_DATA} ${srcdir}/named.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/lwresd.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/named.conf.5 ${DESTDIR}${mandir}/man5
|
||||
|
||||
uninstall::
|
||||
rm -f ${DESTDIR}${mandir}/man5/named.conf.5
|
||||
diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
|
||||
index ae90616..a058c91 100644
|
||||
--- a/bin/pkcs11/Makefile.in
|
||||
+++ b/bin/pkcs11/Makefile.in
|
||||
@@ -71,7 +71,10 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
-install:: ${TARGETS} installdirs
|
||||
+install-man8: ${MANPAGES}
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
+
|
||||
+install:: ${TARGETS} installdirs install-man8
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-list@EXEEXT@ \
|
||||
${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-destroy@EXEEXT@ \
|
||||
@@ -80,10 +83,6 @@ install:: ${TARGETS} installdirs
|
||||
${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-tokens@EXEEXT@ \
|
||||
${DESTDIR}${sbindir}
|
||||
- ${INSTALL_DATA} ${srcdir}/pkcs11-list.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/pkcs11-destroy.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/pkcs11-keygen.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/pkcs11-tokens.8 ${DESTDIR}${mandir}/man8
|
||||
|
||||
uninstall::
|
||||
rm -f ${DESTDIR}${mandir}/man8/pkcs11-tokens.8
|
||||
diff --git a/bin/python/Makefile.in b/bin/python/Makefile.in
|
||||
index aa678d4..064c404 100644
|
||||
--- a/bin/python/Makefile.in
|
||||
+++ b/bin/python/Makefile.in
|
||||
@@ -47,13 +47,13 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
-install:: ${TARGETS} installdirs
|
||||
+install-man8: ${MANPAGES}
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
+
|
||||
+install:: ${TARGETS} installdirs install-man8
|
||||
${INSTALL_SCRIPT} dnssec-checkds ${DESTDIR}${sbindir}
|
||||
${INSTALL_SCRIPT} dnssec-coverage ${DESTDIR}${sbindir}
|
||||
${INSTALL_SCRIPT} dnssec-keymgr ${DESTDIR}${sbindir}
|
||||
- ${INSTALL_DATA} ${srcdir}/dnssec-checkds.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/dnssec-coverage.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/dnssec-keymgr.8 ${DESTDIR}${mandir}/man8
|
||||
if test -n "${PYTHON}" ; then \
|
||||
if test -n "${DESTDIR}" ; then \
|
||||
${PYTHON} ${srcdir}/setup.py install --root=${DESTDIR} --prefix=${prefix} @PYTHON_INSTALL_LIB@ ; \
|
||||
diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in
|
||||
index 7bf2af4..c395bc7 100644
|
||||
--- a/bin/tools/Makefile.in
|
||||
+++ b/bin/tools/Makefile.in
|
||||
@@ -119,17 +119,27 @@ installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
-nzd:
|
||||
+nzd-man: named-nzd2nzf.8
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
+
|
||||
+nzd: nzd-man
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-nzd2nzf@EXEEXT@ \
|
||||
${DESTDIR}${sbindir}
|
||||
- ${INSTALL_DATA} ${srcdir}/named-nzd2nzf.8 ${DESTDIR}${mandir}/man8
|
||||
|
||||
-dnstap:
|
||||
+dnstap-man: dnstap-read.1
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
|
||||
+
|
||||
+dnstap: dnstap-man
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} dnstap-read@EXEEXT@ \
|
||||
${DESTDIR}${bindir}
|
||||
- ${INSTALL_DATA} ${srcdir}/dnstap-read.1 ${DESTDIR}${mandir}/man1
|
||||
|
||||
-install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
|
||||
+install-man1: arpaname.1 named-rrchecker.1 mdig.1
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man1
|
||||
+
|
||||
+install-man8: named-journalprint.8 nsec3hash.8
|
||||
+ ${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
|
||||
+
|
||||
+install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@ install-man1 install-man8
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} arpaname@EXEEXT@ \
|
||||
${DESTDIR}${bindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-journalprint@EXEEXT@ \
|
||||
@@ -144,13 +154,8 @@ install:: ${TARGETS} installdirs @DNSTAP@ @NZD_TOOLS@
|
||||
${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} mdig@EXEEXT@ \
|
||||
${DESTDIR}${bindir}
|
||||
- ${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
|
||||
${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/named-rrchecker.1 ${DESTDIR}${mandir}/man1
|
||||
- ${INSTALL_DATA} ${srcdir}/nsec3hash.8 ${DESTDIR}${mandir}/man8
|
||||
${INSTALL_DATA} ${srcdir}/genrandom.8 ${DESTDIR}${mandir}/man8
|
||||
- ${INSTALL_DATA} ${srcdir}/mdig.1 ${DESTDIR}${mandir}/man1
|
||||
|
||||
uninstall::
|
||||
rm -f ${DESTDIR}${mandir}/man1/mdig.1
|
||||
--
|
||||
2.14.4
|
||||
|
27
bind-9.11-pk11.patch
Normal file
27
bind-9.11-pk11.patch
Normal file
@ -0,0 +1,27 @@
|
||||
diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
|
||||
index 640519a..fc40472 100644
|
||||
--- a/lib/dns/dst_internal.h
|
||||
+++ b/lib/dns/dst_internal.h
|
||||
@@ -59,6 +59,9 @@
|
||||
#include <openssl/objects.h>
|
||||
#include <openssl/rsa.h>
|
||||
#endif
|
||||
+#if PKCS11CRYPTO
|
||||
+#include <pk11/pk11.h>
|
||||
+#endif
|
||||
|
||||
ISC_LANG_BEGINDECLS
|
||||
|
||||
diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h
|
||||
index aa8907a..603712a 100644
|
||||
--- a/lib/isc/include/pk11/internal.h
|
||||
+++ b/lib/isc/include/pk11/internal.h
|
||||
@@ -13,6 +13,8 @@
|
||||
#ifndef PK11_INTERNAL_H
|
||||
#define PK11_INTERNAL_H 1
|
||||
|
||||
+#include <pk11/pk11.h>
|
||||
+
|
||||
/*! \file pk11/internal.h */
|
||||
|
||||
ISC_LANG_BEGINDECLS
|
120
bind-9.11-rh1205168.patch
Normal file
120
bind-9.11-rh1205168.patch
Normal file
@ -0,0 +1,120 @@
|
||||
From 90416594843a56550e40b11561807786219ce1c4 Mon Sep 17 00:00:00 2001
|
||||
From: Evan Hunt <each@isc.org>
|
||||
Date: Mon, 11 Sep 2017 15:01:36 -0700
|
||||
Subject: [PATCH] remap getaddrinfo() to irs_getgetaddrinfo()
|
||||
|
||||
The libirs version of getaddrinfo() cannot be called from within BIND9.
|
||||
|
||||
fix prototypes
|
||||
---
|
||||
lib/irs/include/irs/netdb.h.in | 94 ++++++++++++++++++++++++++++++++++++++++++
|
||||
1 file changed, 94 insertions(+)
|
||||
|
||||
diff --git a/lib/irs/include/irs/netdb.h.in b/lib/irs/include/irs/netdb.h.in
|
||||
index 23dcd37..f36113d 100644
|
||||
--- a/lib/irs/include/irs/netdb.h.in
|
||||
+++ b/lib/irs/include/irs/netdb.h.in
|
||||
@@ -150,6 +150,100 @@ struct addrinfo {
|
||||
#define NI_DGRAM 0x00000010
|
||||
|
||||
/*
|
||||
+ * Define to map into irs_ namespace.
|
||||
+ */
|
||||
+
|
||||
+#define IRS_NAMESPACE
|
||||
+
|
||||
+#ifdef IRS_NAMESPACE
|
||||
+
|
||||
+/*
|
||||
+ * Use our versions not the ones from the C library.
|
||||
+ */
|
||||
+
|
||||
+#ifdef getnameinfo
|
||||
+#undef getnameinfo
|
||||
+#endif
|
||||
+#define getnameinfo irs_getnameinfo
|
||||
+
|
||||
+#ifdef getaddrinfo
|
||||
+#undef getaddrinfo
|
||||
+#endif
|
||||
+#define getaddrinfo irs_getaddrinfo
|
||||
+
|
||||
+#ifdef freeaddrinfo
|
||||
+#undef freeaddrinfo
|
||||
+#endif
|
||||
+#define freeaddrinfo irs_freeaddrinfo
|
||||
+
|
||||
+#ifdef gai_strerror
|
||||
+#undef gai_strerror
|
||||
+#endif
|
||||
+#define gai_strerror irs_gai_strerror
|
||||
+
|
||||
+#endif
|
||||
+
|
||||
+extern int getaddrinfo (const char *name,
|
||||
+ const char *service,
|
||||
+ const struct addrinfo *req,
|
||||
+ struct addrinfo **pai);
|
||||
+extern int getnameinfo (const struct sockaddr *sa,
|
||||
+ socklen_t salen, char *host,
|
||||
+ socklen_t hostlen, char *serv,
|
||||
+ socklen_t servlen, int flags);
|
||||
+extern void freeaddrinfo (struct addrinfo *ai);
|
||||
+extern const char *gai_strerror (int ecode);
|
||||
+
|
||||
+/*
|
||||
+ * Define to map into irs_ namespace.
|
||||
+ */
|
||||
+
|
||||
+#define IRS_NAMESPACE
|
||||
+
|
||||
+#ifdef IRS_NAMESPACE
|
||||
+
|
||||
+/*
|
||||
+ * Use our versions not the ones from the C library.
|
||||
+ */
|
||||
+
|
||||
+#ifdef getnameinfo
|
||||
+#undef getnameinfo
|
||||
+#endif
|
||||
+#define getnameinfo irs_getnameinfo
|
||||
+
|
||||
+#ifdef getaddrinfo
|
||||
+#undef getaddrinfo
|
||||
+#endif
|
||||
+#define getaddrinfo irs_getaddrinfo
|
||||
+
|
||||
+#ifdef freeaddrinfo
|
||||
+#undef freeaddrinfo
|
||||
+#endif
|
||||
+#define freeaddrinfo irs_freeaddrinfo
|
||||
+
|
||||
+#ifdef gai_strerror
|
||||
+#undef gai_strerror
|
||||
+#endif
|
||||
+#define gai_strerror irs_gai_strerror
|
||||
+
|
||||
+int
|
||||
+getaddrinfo(const char *hostname, const char *servname,
|
||||
+ const struct addrinfo *hints, struct addrinfo **res);
|
||||
+
|
||||
+int
|
||||
+getnameinfo(const struct sockaddr *sa, IRS_GETNAMEINFO_SOCKLEN_T salen,
|
||||
+ char *host, IRS_GETNAMEINFO_BUFLEN_T hostlen,
|
||||
+ char *serv, IRS_GETNAMEINFO_BUFLEN_T servlen,
|
||||
+ IRS_GETNAMEINFO_FLAGS_T flags);
|
||||
+
|
||||
+void freeaddrinfo (struct addrinfo *ai);
|
||||
+
|
||||
+IRS_GAISTRERROR_RETURN_T
|
||||
+gai_strerror(int ecode);
|
||||
+
|
||||
+#endif
|
||||
+
|
||||
+/*
|
||||
* Tell Emacs to use C mode on this file.
|
||||
* Local variables:
|
||||
* mode: c
|
||||
--
|
||||
2.9.5
|
||||
|
16
bind-9.11-rh1410433.patch
Normal file
16
bind-9.11-rh1410433.patch
Normal file
@ -0,0 +1,16 @@
|
||||
diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
|
||||
index 15561ce..e4449b0 100644
|
||||
--- a/lib/dns/dyndb.c
|
||||
+++ b/lib/dns/dyndb.c
|
||||
@@ -133,8 +133,11 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
|
||||
instname, filename);
|
||||
|
||||
flags = RTLD_NOW|RTLD_LOCAL;
|
||||
+#if 0
|
||||
+ /* Shared global namespace is required for dns-pkcs11 library */
|
||||
#if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
|
||||
flags |= RTLD_DEEPBIND;
|
||||
+#endif
|
||||
#endif
|
||||
|
||||
handle = dlopen(filename, flags);
|
288
bind-9.11-rh1624100.patch
Normal file
288
bind-9.11-rh1624100.patch
Normal file
@ -0,0 +1,288 @@
|
||||
From f27598743ab6e03271e26f23da4beba748d19c60 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
|
||||
Date: Wed, 25 Apr 2018 14:04:31 +0200
|
||||
Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
|
||||
|
||||
(cherry picked from commit 66ba2fdad583d962a1f4971c85d58381f0849e4d)
|
||||
|
||||
Remove isc_safe_memcompare, it's not needed anywhere and can't be replaced with CRYPTO_memcmp()
|
||||
|
||||
(cherry picked from commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c)
|
||||
|
||||
Fix the isc_safe_memwipe() usage with (NULL, >0)
|
||||
|
||||
(cherry picked from commit 083461d3329ff6f2410745848a926090586a9846)
|
||||
---
|
||||
bin/dnssec/dnssec-signzone.c | 2 +-
|
||||
lib/dns/nsec3.c | 4 +-
|
||||
lib/dns/spnego.c | 4 +-
|
||||
lib/isc/Makefile.in | 8 +---
|
||||
lib/isc/include/isc/safe.h | 18 ++------
|
||||
lib/isc/safe.c | 83 ------------------------------------
|
||||
lib/isc/tests/safe_test.c | 18 --------
|
||||
7 files changed, 11 insertions(+), 126 deletions(-)
|
||||
delete mode 100644 lib/isc/safe.c
|
||||
|
||||
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
|
||||
index 6dded0c..a9c5557 100644
|
||||
--- a/bin/dnssec/dnssec-signzone.c
|
||||
+++ b/bin/dnssec/dnssec-signzone.c
|
||||
@@ -784,7 +784,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
|
||||
|
||||
static int
|
||||
hashlist_comp(const void *a, const void *b) {
|
||||
- return (isc_safe_memcompare(a, b, hash_length + 1));
|
||||
+ return (memcmp(a, b, hash_length + 1));
|
||||
}
|
||||
|
||||
static void
|
||||
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
|
||||
index 6ae7ca8..01426d6 100644
|
||||
--- a/lib/dns/nsec3.c
|
||||
+++ b/lib/dns/nsec3.c
|
||||
@@ -1963,7 +1963,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
|
||||
* Work out what this NSEC3 covers.
|
||||
* Inside (<0) or outside (>=0).
|
||||
*/
|
||||
- scope = isc_safe_memcompare(owner, nsec3.next, nsec3.next_length);
|
||||
+ scope = memcmp(owner, nsec3.next, nsec3.next_length);
|
||||
|
||||
/*
|
||||
* Prepare to compute all the hashes.
|
||||
@@ -1987,7 +1987,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
|
||||
return (ISC_R_IGNORE);
|
||||
}
|
||||
|
||||
- order = isc_safe_memcompare(hash, owner, length);
|
||||
+ order = memcmp(hash, owner, length);
|
||||
if (first && order == 0) {
|
||||
/*
|
||||
* The hashes are the same.
|
||||
diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
|
||||
index ad77f24..670982a 100644
|
||||
--- a/lib/dns/spnego.c
|
||||
+++ b/lib/dns/spnego.c
|
||||
@@ -371,7 +371,7 @@ gssapi_spnego_decapsulate(OM_uint32 *,
|
||||
|
||||
/* mod_auth_kerb.c */
|
||||
|
||||
-static int
|
||||
+static isc_boolean_t
|
||||
cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
|
||||
{
|
||||
unsigned char *p;
|
||||
@@ -395,7 +395,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
|
||||
if (((OM_uint32) *p++) != gssoid->length)
|
||||
return (GSS_S_DEFECTIVE_TOKEN);
|
||||
|
||||
- return (isc_safe_memcompare(p, gssoid->elements, gssoid->length));
|
||||
+ return (!isc_safe_memequal(p, gssoid->elements, gssoid->length));
|
||||
}
|
||||
|
||||
/* accept_sec_context.c */
|
||||
diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
|
||||
index 149552a..8529a86 100644
|
||||
--- a/lib/isc/Makefile.in
|
||||
+++ b/lib/isc/Makefile.in
|
||||
@@ -60,7 +60,7 @@ OBJS = @ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
|
||||
parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
|
||||
ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
|
||||
rwlock.@O@ \
|
||||
- safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
|
||||
+ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
|
||||
string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
|
||||
tm.@O@ timer.@O@ utf8.@O@ version.@O@ \
|
||||
${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
|
||||
@@ -79,7 +79,7 @@ SRCS = @ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
|
||||
netaddr.c netscope.c pool.c ondestroy.c \
|
||||
parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
|
||||
ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
|
||||
- safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
|
||||
+ serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
|
||||
strtoul.c symtab.c task.c taskpool.c timer.c \
|
||||
tm.c utf8.c version.c
|
||||
|
||||
@@ -95,10 +95,6 @@ TESTDIRS = @UNITTESTS@
|
||||
|
||||
@BIND9_MAKE_RULES@
|
||||
|
||||
-safe.@O@: safe.c
|
||||
- ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} @CCNOOPT@ \
|
||||
- -c ${srcdir}/safe.c
|
||||
-
|
||||
version.@O@: version.c
|
||||
${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
|
||||
-DVERSION=\"${VERSION}\" \
|
||||
diff --git a/lib/isc/include/isc/safe.h b/lib/isc/include/isc/safe.h
|
||||
index 66ed08b..88b8f47 100644
|
||||
--- a/lib/isc/include/isc/safe.h
|
||||
+++ b/lib/isc/include/isc/safe.h
|
||||
@@ -15,29 +15,19 @@
|
||||
|
||||
/*! \file isc/safe.h */
|
||||
|
||||
-#include <stdbool.h>
|
||||
-
|
||||
-#include <isc/types.h>
|
||||
-#include <stdlib.h>
|
||||
+#include <isc/lang.h>
|
||||
+#include <openssl/crypto.h>
|
||||
|
||||
ISC_LANG_BEGINDECLS
|
||||
|
||||
-bool
|
||||
-isc_safe_memequal(const void *s1, const void *s2, size_t n);
|
||||
+#define isc_safe_memequal(s1, s2, n) !CRYPTO_memcmp(s1, s2, n)
|
||||
/*%<
|
||||
* Returns true iff. two blocks of memory are equal, otherwise
|
||||
* false.
|
||||
*
|
||||
*/
|
||||
|
||||
-int
|
||||
-isc_safe_memcompare(const void *b1, const void *b2, size_t len);
|
||||
-/*%<
|
||||
- * Clone of libc memcmp() which is safe to differential timing attacks.
|
||||
- */
|
||||
-
|
||||
-void
|
||||
-isc_safe_memwipe(void *ptr, size_t len);
|
||||
+#define isc_safe_memwipe(ptr, len) OPENSSL_cleanse(ptr, len)
|
||||
/*%<
|
||||
* Clear the memory of length `len` pointed to by `ptr`.
|
||||
*
|
||||
diff --git a/lib/isc/safe.c b/lib/isc/safe.c
|
||||
deleted file mode 100644
|
||||
index 7a464b6..0000000
|
||||
--- a/lib/isc/safe.c
|
||||
+++ /dev/null
|
||||
@@ -1,83 +0,0 @@
|
||||
-/*
|
||||
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
- *
|
||||
- * This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- * License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
- *
|
||||
- * See the COPYRIGHT file distributed with this work for additional
|
||||
- * information regarding copyright ownership.
|
||||
- */
|
||||
-
|
||||
-/*! \file */
|
||||
-
|
||||
-#include <config.h>
|
||||
-
|
||||
-#include <stdbool.h>
|
||||
-
|
||||
-#include <isc/safe.h>
|
||||
-#include <isc/string.h>
|
||||
-#include <isc/util.h>
|
||||
-
|
||||
-#ifdef WIN32
|
||||
-#include <windows.h>
|
||||
-#endif
|
||||
-
|
||||
-#ifdef _MSC_VER
|
||||
-#pragma optimize("", off)
|
||||
-#endif
|
||||
-
|
||||
-bool
|
||||
-isc_safe_memequal(const void *s1, const void *s2, size_t n) {
|
||||
- uint8_t acc = 0;
|
||||
-
|
||||
- if (n != 0U) {
|
||||
- const uint8_t *p1 = s1, *p2 = s2;
|
||||
-
|
||||
- do {
|
||||
- acc |= *p1++ ^ *p2++;
|
||||
- } while (--n != 0U);
|
||||
- }
|
||||
- return (acc == 0);
|
||||
-}
|
||||
-
|
||||
-
|
||||
-int
|
||||
-isc_safe_memcompare(const void *b1, const void *b2, size_t len) {
|
||||
- const unsigned char *p1 = b1, *p2 = b2;
|
||||
- size_t i;
|
||||
- int res = 0, done = 0;
|
||||
-
|
||||
- for (i = 0; i < len; i++) {
|
||||
- /* lt is -1 if p1[i] < p2[i]; else 0. */
|
||||
- int lt = (p1[i] - p2[i]) >> CHAR_BIT;
|
||||
-
|
||||
- /* gt is -1 if p1[i] > p2[i]; else 0. */
|
||||
- int gt = (p2[i] - p1[i]) >> CHAR_BIT;
|
||||
-
|
||||
- /* cmp is 1 if p1[i] > p2[i]; -1 if p1[i] < p2[i]; else 0. */
|
||||
- int cmp = lt - gt;
|
||||
-
|
||||
- /* set res = cmp if !done. */
|
||||
- res |= cmp & ~done;
|
||||
-
|
||||
- /* set done if p1[i] != p2[i]. */
|
||||
- done |= lt | gt;
|
||||
- }
|
||||
-
|
||||
- return (res);
|
||||
-}
|
||||
-
|
||||
-void
|
||||
-isc_safe_memwipe(void *ptr, size_t len) {
|
||||
- if (ISC_UNLIKELY(ptr == NULL || len == 0))
|
||||
- return;
|
||||
-
|
||||
-#ifdef WIN32
|
||||
- SecureZeroMemory(ptr, len);
|
||||
-#elif HAVE_EXPLICIT_BZERO
|
||||
- explicit_bzero(ptr, len);
|
||||
-#else
|
||||
- memset(ptr, 0, len);
|
||||
-#endif
|
||||
-}
|
||||
diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
|
||||
index 266ac75..60e9181 100644
|
||||
--- a/lib/isc/tests/safe_test.c
|
||||
+++ b/lib/isc/tests/safe_test.c
|
||||
@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
|
||||
"\x00\x00\x00\x00", 4));
|
||||
}
|
||||
|
||||
-/* test isc_safe_memcompare() */
|
||||
-static void
|
||||
-isc_safe_memcompare_test(void **state) {
|
||||
- UNUSED(state);
|
||||
-
|
||||
- assert_int_equal(isc_safe_memcompare("test", "test", 4), 0);
|
||||
- assert_true(isc_safe_memcompare("test", "tesc", 4) > 0);
|
||||
- assert_true(isc_safe_memcompare("test", "tesy", 4) < 0);
|
||||
- assert_int_equal(isc_safe_memcompare("\x00\x00\x00\x00",
|
||||
- "\x00\x00\x00\x00", 4), 0);
|
||||
- assert_true(isc_safe_memcompare("\x00\x00\x00\x00",
|
||||
- "\x00\x00\x00\x01", 4) < 0);
|
||||
- assert_true(isc_safe_memcompare("\x00\x00\x00\x02",
|
||||
- "\x00\x00\x00\x00", 4) > 0);
|
||||
-}
|
||||
-
|
||||
/* test isc_safe_memwipe() */
|
||||
static void
|
||||
isc_safe_memwipe_test(void **state) {
|
||||
@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
|
||||
/* These should pass. */
|
||||
isc_safe_memwipe(NULL, 0);
|
||||
isc_safe_memwipe((void *) -1, 0);
|
||||
- isc_safe_memwipe(NULL, 42);
|
||||
|
||||
/*
|
||||
* isc_safe_memwipe(ptr, size) should function same as
|
||||
@@ -108,7 +91,6 @@ main(void) {
|
||||
const struct CMUnitTest tests[] = {
|
||||
cmocka_unit_test(isc_safe_memequal_test),
|
||||
cmocka_unit_test(isc_safe_memwipe_test),
|
||||
- cmocka_unit_test(isc_safe_memcompare_test),
|
||||
};
|
||||
|
||||
return (cmocka_run_group_tests(tests, NULL, NULL));
|
||||
--
|
||||
2.26.2
|
||||
|
48
bind-9.11-rh1663318.patch
Normal file
48
bind-9.11-rh1663318.patch
Normal file
@ -0,0 +1,48 @@
|
||||
From b16a1ff25644bb075f454afe68ee63f6f385ca9c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Wed, 23 Jan 2019 21:11:07 +0100
|
||||
Subject: [PATCH] Made RAND_status check optional (broke --disable-crypto-rand)
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Unlike upstream, skip it also for DHCP.
|
||||
|
||||
Disable RAND_status also in non-threaded builds. DHCP is built without
|
||||
threads and should not check RAND_status on dns library initialization.
|
||||
Lack of entropy is possible state for dhclient, but it must not fail
|
||||
even in this case. Because DHCP itself does not require custom random
|
||||
generator, leave default RAND_OpenSSL configured. It should help TLS
|
||||
connection to LDAP in single DHCP binary, while keeping secure random
|
||||
data if needed.
|
||||
|
||||
(modified upstream commit 8a98277811ea50035ff37b744fa3dc5b75bee099)
|
||||
|
||||
Signed-off-by: Petr Menšík <pemensik@redhat.com>
|
||||
---
|
||||
lib/dns/openssl_link.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
|
||||
index 7a233dd..941eb17 100644
|
||||
--- a/lib/dns/openssl_link.c
|
||||
+++ b/lib/dns/openssl_link.c
|
||||
@@ -289,6 +289,7 @@ dst__openssl_init(const char *engine) {
|
||||
#endif
|
||||
#endif /* !defined(OPENSSL_NO_ENGINE) */
|
||||
|
||||
+#if defined(ISC_PLATFORM_CRYPTORANDOM) && defined(ISC_PLATFORM_USETHREADS)
|
||||
/* Protect ourselves against unseeded PRNG */
|
||||
if (RAND_status() != 1) {
|
||||
FATAL_ERROR(__FILE__, __LINE__,
|
||||
@@ -296,6 +297,7 @@ dst__openssl_init(const char *engine) {
|
||||
"cannot be initialized (see the `PRNG not "
|
||||
"seeded' message in the OpenSSL FAQ)");
|
||||
}
|
||||
+#endif
|
||||
|
||||
return (ISC_R_SUCCESS);
|
||||
|
||||
--
|
||||
2.20.1
|
||||
|
37
bind-9.11-rh1666814.patch
Normal file
37
bind-9.11-rh1666814.patch
Normal file
@ -0,0 +1,37 @@
|
||||
From 3bb29f45604ac6890f4ea5cdcbd1a62e6dad14a7 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Wed, 16 Jan 2019 16:27:33 +0100
|
||||
Subject: [PATCH 2/2] Fix possible crash when loading corrupted file
|
||||
|
||||
Some values passes internal triggers by coincidence. Fix the check and
|
||||
check also first_node_offset before even passing it further.
|
||||
---
|
||||
lib/dns/rbt.c | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
|
||||
index 62d0826..b029b7d 100644
|
||||
--- a/lib/dns/rbt.c
|
||||
+++ b/lib/dns/rbt.c
|
||||
@@ -787,7 +787,7 @@ treefix(dns_rbt_t *rbt, void *base, size_t filesize, dns_rbtnode_t *n,
|
||||
return (ISC_R_SUCCESS);
|
||||
|
||||
CONFIRM((void *) n >= base);
|
||||
- CONFIRM((char *) n - (char *) base <= (int) nodemax);
|
||||
+ CONFIRM((size_t)((char *) n - (char *) base) <= nodemax);
|
||||
CONFIRM(DNS_RBTNODE_VALID(n));
|
||||
|
||||
dns_name_init(&nodename, NULL);
|
||||
@@ -939,7 +939,8 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
|
||||
rbt->root = (dns_rbtnode_t *)((char *)base_address +
|
||||
header_offset + header->first_node_offset);
|
||||
|
||||
- if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
|
||||
+ if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize
|
||||
+ || header->first_node_offset > filesize) {
|
||||
result = ISC_R_INVALIDFILE;
|
||||
goto cleanup;
|
||||
}
|
||||
--
|
||||
2.20.1
|
||||
|
194
bind-9.11-rh1732883.patch
Normal file
194
bind-9.11-rh1732883.patch
Normal file
@ -0,0 +1,194 @@
|
||||
From 6010876e561b4345e569ffd11eaec9ea52725817 Mon Sep 17 00:00:00 2001
|
||||
From: Pavel Zhukov <pzhukov@redhat.com>
|
||||
Date: Wed, 24 Jul 2019 17:15:55 +0200
|
||||
Subject: [PATCH] Detect system time jumps
|
||||
|
||||
In case if system time was changed backward it's possible to have ip
|
||||
address dropped by the kernel due to lifetime expirity. Try to detect
|
||||
this situation using either monotonic time or saved timestamp and execute
|
||||
go_reboot() procedure to request lease extention
|
||||
---
|
||||
lib/isc/include/isc/result.h | 3 ++-
|
||||
lib/isc/include/isc/util.h | 3 +++
|
||||
lib/isc/result.c | 2 ++
|
||||
lib/isc/unix/app.c | 39 +++++++++++++++++++++++++++++----
|
||||
lib/isc/unix/include/isc/time.h | 20 +++++++++++++++++
|
||||
lib/isc/unix/time.c | 22 +++++++++++++++++++
|
||||
6 files changed, 84 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
|
||||
index 0389efa..149cde5 100644
|
||||
--- a/lib/isc/include/isc/result.h
|
||||
+++ b/lib/isc/include/isc/result.h
|
||||
@@ -89,7 +89,8 @@
|
||||
#define ISC_R_DISCFULL 67 /*%< disc full */
|
||||
#define ISC_R_DEFAULT 68 /*%< default */
|
||||
#define ISC_R_IPV4PREFIX 69 /*%< IPv4 prefix */
|
||||
-#define ISC_R_NRESULTS 70
|
||||
+#define ISC_R_TIMESHIFTED 70 /*%< system time changed */
|
||||
+#define ISC_R_NRESULTS 71
|
||||
|
||||
ISC_LANG_BEGINDECLS
|
||||
|
||||
diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
|
||||
index 973c348..8160dd3 100644
|
||||
--- a/lib/isc/include/isc/util.h
|
||||
+++ b/lib/isc/include/isc/util.h
|
||||
@@ -289,6 +289,9 @@ extern void mock_assert(const int result, const char* const expression,
|
||||
* Time
|
||||
*/
|
||||
#define TIME_NOW(tp) RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
|
||||
+#ifdef CLOCK_BOOTTIME
|
||||
+#define TIME_MONOTONIC(tp) RUNTIME_CHECK(isc_time_boottime((tp)) == ISC_R_SUCCESS)
|
||||
+#endif
|
||||
|
||||
/*%
|
||||
* Alignment
|
||||
diff --git a/lib/isc/result.c b/lib/isc/result.c
|
||||
index a9db132..7c04831 100644
|
||||
--- a/lib/isc/result.c
|
||||
+++ b/lib/isc/result.c
|
||||
@@ -105,6 +105,7 @@ static const char *description[ISC_R_NRESULTS] = {
|
||||
"disc full", /*%< 67 */
|
||||
"default", /*%< 68 */
|
||||
"IPv4 prefix", /*%< 69 */
|
||||
+ "time changed", /*%< 70 */
|
||||
};
|
||||
|
||||
static const char *identifier[ISC_R_NRESULTS] = {
|
||||
@@ -178,6 +179,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
|
||||
"ISC_R_DISCFULL",
|
||||
"ISC_R_DEFAULT",
|
||||
"ISC_R_IPV4PREFIX",
|
||||
+ "ISC_R_TIMESHIFTED",
|
||||
};
|
||||
|
||||
#define ISC_RESULT_RESULTSET 2
|
||||
diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
|
||||
index a6e9882..52eb3e0 100644
|
||||
--- a/lib/isc/unix/app.c
|
||||
+++ b/lib/isc/unix/app.c
|
||||
@@ -442,15 +442,48 @@ isc__app_ctxonrun(isc_appctx_t *ctx0, isc_mem_t *mctx, isc_task_t *task,
|
||||
static isc_result_t
|
||||
evloop(isc__appctx_t *ctx) {
|
||||
isc_result_t result;
|
||||
+ isc_time_t now;
|
||||
+#ifdef CLOCK_BOOTTIME
|
||||
+ isc_time_t monotonic;
|
||||
+ uint64_t diff = 0;
|
||||
+#else
|
||||
+ isc_time_t prev;
|
||||
+ TIME_NOW(&prev);
|
||||
+#endif
|
||||
+
|
||||
+
|
||||
|
||||
while (!ctx->want_shutdown) {
|
||||
int n;
|
||||
- isc_time_t when, now;
|
||||
+ isc_time_t when;
|
||||
struct timeval tv, *tvp;
|
||||
isc_socketwait_t *swait;
|
||||
bool readytasks;
|
||||
bool call_timer_dispatch = false;
|
||||
-
|
||||
+ uint64_t us;
|
||||
+
|
||||
+#ifdef CLOCK_BOOTTIME
|
||||
+ // TBD macros for following three lines
|
||||
+ TIME_NOW(&now);
|
||||
+ TIME_MONOTONIC(&monotonic);
|
||||
+ INSIST(now.seconds > monotonic.seconds)
|
||||
+ us = isc_time_microdiff (&now, &monotonic);
|
||||
+ if (us < diff){
|
||||
+ us = diff - us;
|
||||
+ if (us > 1000000){ // ignoring shifts less than one second
|
||||
+ return ISC_R_TIMESHIFTED;
|
||||
+ };
|
||||
+ diff = isc_time_microdiff (&now, &monotonic);
|
||||
+ } else {
|
||||
+ diff = isc_time_microdiff (&now, &monotonic);
|
||||
+ // not implemented
|
||||
+ }
|
||||
+#else
|
||||
+ TIME_NOW(&now);
|
||||
+ if (isc_time_compare (&now, &prev) < 0)
|
||||
+ return ISC_R_TIMESHIFTED;
|
||||
+ TIME_NOW(&prev);
|
||||
+#endif
|
||||
/*
|
||||
* Check the reload (or suspend) case first for exiting the
|
||||
* loop as fast as possible in case:
|
||||
@@ -475,8 +508,6 @@ evloop(isc__appctx_t *ctx) {
|
||||
if (result != ISC_R_SUCCESS)
|
||||
tvp = NULL;
|
||||
else {
|
||||
- uint64_t us;
|
||||
-
|
||||
TIME_NOW(&now);
|
||||
us = isc_time_microdiff(&when, &now);
|
||||
if (us == 0)
|
||||
diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h
|
||||
index b864c29..5dd43c9 100644
|
||||
--- a/lib/isc/unix/include/isc/time.h
|
||||
+++ b/lib/isc/unix/include/isc/time.h
|
||||
@@ -132,6 +132,26 @@ isc_time_isepoch(const isc_time_t *t);
|
||||
*\li 't' is a valid pointer.
|
||||
*/
|
||||
|
||||
+#ifdef CLOCK_BOOTTIME
|
||||
+isc_result_t
|
||||
+isc_time_boottime(isc_time_t *t);
|
||||
+/*%<
|
||||
+ * Set 't' to monotonic time from previous boot
|
||||
+ * it's not affected by system time change. It also
|
||||
+ * includes the time system was suspended
|
||||
+ *
|
||||
+ * Requires:
|
||||
+ *\li 't' is a valid pointer.
|
||||
+ *
|
||||
+ * Returns:
|
||||
+ *
|
||||
+ *\li Success
|
||||
+ *\li Unexpected error
|
||||
+ * Getting the time from the system failed.
|
||||
+ */
|
||||
+#endif /* CLOCK_BOOTTIME */
|
||||
+
|
||||
+
|
||||
isc_result_t
|
||||
isc_time_now(isc_time_t *t);
|
||||
/*%<
|
||||
diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
|
||||
index 8edc9df..fe0bb91 100644
|
||||
--- a/lib/isc/unix/time.c
|
||||
+++ b/lib/isc/unix/time.c
|
||||
@@ -498,3 +498,25 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
|
||||
t->nanoseconds / NS_PER_MS);
|
||||
}
|
||||
}
|
||||
+
|
||||
+
|
||||
+#ifdef CLOCK_BOOTTIME
|
||||
+isc_result_t
|
||||
+isc_time_boottime(isc_time_t *t) {
|
||||
+ struct timespec ts;
|
||||
+
|
||||
+ char strbuf[ISC_STRERRORSIZE];
|
||||
+
|
||||
+ if (clock_gettime (CLOCK_BOOTTIME, &ts) != 0){
|
||||
+ isc__strerror(errno, strbuf, sizeof(strbuf));
|
||||
+ UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
|
||||
+ return (ISC_R_UNEXPECTED);
|
||||
+ }
|
||||
+
|
||||
+ t->seconds = ts.tv_sec;
|
||||
+ t->nanoseconds = ts.tv_nsec;
|
||||
+
|
||||
+ return (ISC_R_SUCCESS);
|
||||
+
|
||||
+};
|
||||
+#endif
|
||||
--
|
||||
2.20.1
|
||||
|
59
bind-9.11-rh1736762-5.patch
Normal file
59
bind-9.11-rh1736762-5.patch
Normal file
@ -0,0 +1,59 @@
|
||||
From 6257d829c9d7e71ac51bcdc6b5b981c7a19200e2 Mon Sep 17 00:00:00 2001
|
||||
From: Mark Andrews <marka@isc.org>
|
||||
Date: Mon, 25 Nov 2019 05:46:55 +0000
|
||||
Subject: [PATCH] Merge branch
|
||||
'1373-threadsanitizer-data-race-rbtdb-c-5193-in-detachnode' into 'master'
|
||||
|
||||
Resolve "ThreadSanitizer: data race rbtdb.c:5193 in detachnode"
|
||||
|
||||
Closes #1373
|
||||
|
||||
See merge request isc-projects/bind9!2598
|
||||
---
|
||||
lib/dns/include/dns/rbt.h | 22 +++++++++-------------
|
||||
1 file changed, 9 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
|
||||
index 67ac3e4d8a..a084bd6193 100644
|
||||
--- a/lib/dns/include/dns/rbt.h
|
||||
+++ b/lib/dns/include/dns/rbt.h
|
||||
@@ -49,10 +49,7 @@ ISC_LANG_BEGINDECLS
|
||||
|
||||
#define DNS_RBT_USEMAGIC 1
|
||||
|
||||
-/*
|
||||
- * These should add up to 30.
|
||||
- */
|
||||
-#define DNS_RBT_LOCKLENGTH 10
|
||||
+#define DNS_RBT_LOCKLENGTH (sizeof(((dns_rbtnode_t *)0)->locknum)*8)
|
||||
#define DNS_RBT_REFLENGTH 20
|
||||
|
||||
#define DNS_RBTNODE_MAGIC ISC_MAGIC('R','B','N','O')
|
||||
@@ -159,16 +156,15 @@ struct dns_rbtnode {
|
||||
* separate region of memory.
|
||||
*/
|
||||
void *data;
|
||||
- unsigned int :0; /* start of bitfields c/o node lock */
|
||||
- unsigned int dirty:1;
|
||||
- unsigned int wild:1;
|
||||
- unsigned int locknum:DNS_RBT_LOCKLENGTH;
|
||||
-#ifndef DNS_RBT_USEISCREFCOUNT
|
||||
- unsigned int references:DNS_RBT_REFLENGTH;
|
||||
-#endif
|
||||
- unsigned int :0; /* end of bitfields c/o node lock */
|
||||
+ uint8_t :0; /* start of bitfields c/o node lock */
|
||||
+ uint8_t dirty:1;
|
||||
+ uint8_t wild:1;
|
||||
+ uint8_t :0; /* end of bitfields c/o node lock */
|
||||
+ uint16_t locknum; /* note that this is not in the bitfield */
|
||||
#ifdef DNS_RBT_USEISCREFCOUNT
|
||||
- isc_refcount_t references; /* note that this is not in the bitfield */
|
||||
+ isc_refcount_t references;
|
||||
+#else
|
||||
+ unsigned int references:DNS_RBT_REFLENGTH;
|
||||
#endif
|
||||
/*@}*/
|
||||
};
|
||||
--
|
||||
2.21.0
|
||||
|
2122
bind-9.11-rt31459.patch
Normal file
2122
bind-9.11-rt31459.patch
Normal file
File diff suppressed because it is too large
Load Diff
789
bind-9.11-rt46047.patch
Normal file
789
bind-9.11-rt46047.patch
Normal file
@ -0,0 +1,789 @@
|
||||
From 8a064944dc10421a387725a365650d656d2a97f1 Mon Sep 17 00:00:00 2001
|
||||
From: Evan Hunt <each@isc.org>
|
||||
Date: Thu, 28 Sep 2017 10:09:22 -0700
|
||||
Subject: [PATCH] completed and corrected the crypto-random change
|
||||
|
||||
4724. [func] By default, BIND now uses the random number
|
||||
functions provided by the crypto library (i.e.,
|
||||
OpenSSL or a PKCS#11 provider) as a source of
|
||||
randomness rather than /dev/random. This is
|
||||
suitable for virtual machine environments
|
||||
which have limited entropy pools and lack
|
||||
hardware random number generators.
|
||||
|
||||
This can be overridden by specifying another
|
||||
entropy source via the "random-device" option
|
||||
in named.conf, or via the -r command line option;
|
||||
however, for functions requiring full cryptographic
|
||||
strength, such as DNSSEC key generation, this
|
||||
cannot be overridden. In particular, the -r
|
||||
command line option no longer has any effect on
|
||||
dnssec-keygen.
|
||||
|
||||
This can be disabled by building with
|
||||
"configure --disable-crypto-rand".
|
||||
[RT #31459] [RT #46047]
|
||||
---
|
||||
bin/confgen/keygen.c | 12 +++---
|
||||
bin/dnssec/dnssec-keygen.docbook | 24 +++++++----
|
||||
bin/dnssec/dnssectool.c | 12 +++---
|
||||
bin/named/client.c | 3 +-
|
||||
bin/named/config.c | 4 +-
|
||||
bin/named/controlconf.c | 19 +++++---
|
||||
bin/named/include/named/server.h | 2 +
|
||||
bin/named/interfacemgr.c | 1 +
|
||||
bin/named/query.c | 1 +
|
||||
bin/named/server.c | 52 ++++++++++++++--------
|
||||
bin/nsupdate/nsupdate.c | 4 +-
|
||||
bin/tests/system/pipelined/pipequeries.c | 4 +-
|
||||
bin/tests/system/tkey/keycreate.c | 4 +-
|
||||
bin/tests/system/tkey/keydelete.c | 5 +--
|
||||
doc/arm/Bv9ARM-book.xml | 55 +++++++++++++++++-------
|
||||
doc/arm/notes-rh-changes.xml | 42 ++++++++++++++++++
|
||||
doc/arm/notes.xml | 1 +
|
||||
lib/dns/dst_api.c | 4 +-
|
||||
lib/dns/include/dst/dst.h | 14 +++++-
|
||||
lib/dns/openssl_link.c | 3 +-
|
||||
lib/isc/include/isc/entropy.h | 48 +++++++++++++++------
|
||||
lib/isc/include/isc/random.h | 28 +++++++-----
|
||||
lib/isccfg/namedconf.c | 2 +-
|
||||
23 files changed, 240 insertions(+), 104 deletions(-)
|
||||
create mode 100644 doc/arm/notes-rh-changes.xml
|
||||
|
||||
diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
|
||||
index 295e16f..0f79aa8 100644
|
||||
--- a/bin/confgen/keygen.c
|
||||
+++ b/bin/confgen/keygen.c
|
||||
@@ -161,17 +161,15 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
|
||||
|
||||
DO("create entropy context", isc_entropy_create(mctx, &ectx));
|
||||
|
||||
- if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
|
||||
- randomfile = NULL;
|
||||
- open_keyboard = ISC_ENTROPY_KEYBOARDYES;
|
||||
- }
|
||||
#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
- if (randomfile != NULL &&
|
||||
- strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
|
||||
- randomfile = NULL;
|
||||
+ if (randomfile == NULL) {
|
||||
isc_entropy_usehook(ectx, true);
|
||||
}
|
||||
#endif
|
||||
+ if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
|
||||
+ randomfile = NULL;
|
||||
+ open_keyboard = ISC_ENTROPY_KEYBOARDYES;
|
||||
+ }
|
||||
DO("start entropy source", isc_entropy_usebestsource(ectx,
|
||||
&entropy_source,
|
||||
randomfile,
|
||||
diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
|
||||
index 1826919..96543fc 100644
|
||||
--- a/bin/dnssec/dnssec-keygen.docbook
|
||||
+++ b/bin/dnssec/dnssec-keygen.docbook
|
||||
@@ -349,15 +349,23 @@
|
||||
<term>-r <replaceable class="parameter">randomdev</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
- Specifies the source of randomness. If the operating
|
||||
- system does not provide a <filename>/dev/random</filename>
|
||||
- or equivalent device, the default source of randomness
|
||||
- is keyboard input. <filename>randomdev</filename>
|
||||
- specifies
|
||||
+ Specifies a source of randomness. Normally, when generating
|
||||
+ DNSSEC keys, this option has no effect; the random number
|
||||
+ generation function provided by the cryptographic library will
|
||||
+ be used.
|
||||
+ </para>
|
||||
+ <para>
|
||||
+ If that behavior is disabled at compile time, however,
|
||||
+ the specified file will be used as entropy source
|
||||
+ for key generation. <filename>randomdev</filename> is
|
||||
the name of a character device or file containing random
|
||||
- data to be used instead of the default. The special value
|
||||
- <filename>keyboard</filename> indicates that keyboard
|
||||
- input should be used.
|
||||
+ data to be used. The special value <filename>keyboard</filename>
|
||||
+ indicates that keyboard input should be used.
|
||||
+ </para>
|
||||
+ <para>
|
||||
+ The default is <filename>/dev/random</filename> if the
|
||||
+ operating system provides it or an equivalent device;
|
||||
+ if not, the default source of randomness is keyboard input.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
|
||||
index 5654435..24c0d5a 100644
|
||||
--- a/bin/dnssec/dnssectool.c
|
||||
+++ b/bin/dnssec/dnssectool.c
|
||||
@@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
|
||||
ISC_LIST_INIT(sources);
|
||||
}
|
||||
|
||||
+#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
+ if (randomfile == NULL) {
|
||||
+ isc_entropy_usehook(*ectx, true);
|
||||
+ }
|
||||
+#endif
|
||||
if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
|
||||
usekeyboard = ISC_ENTROPY_KEYBOARDYES;
|
||||
randomfile = NULL;
|
||||
}
|
||||
|
||||
-#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
- if (randomfile != NULL &&
|
||||
- strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
|
||||
- randomfile = NULL;
|
||||
- isc_entropy_usehook(*ectx, true);
|
||||
- }
|
||||
-#endif
|
||||
result = isc_entropy_usebestsource(*ectx, &source, randomfile,
|
||||
usekeyboard);
|
||||
|
||||
diff --git a/bin/named/client.c b/bin/named/client.c
|
||||
index f4a5ff9..58549d3 100644
|
||||
--- a/bin/named/client.c
|
||||
+++ b/bin/named/client.c
|
||||
@@ -1765,7 +1765,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
|
||||
|
||||
isc_buffer_init(&buf, cookie, sizeof(cookie));
|
||||
isc_stdtime_get(&now);
|
||||
- isc_random_get(&nonce);
|
||||
+ nonce = ((isc_rng_random(ns_g_server->rngctx) << 16) |
|
||||
+ isc_rng_random(ns_g_server->rngctx));
|
||||
|
||||
compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
|
||||
|
||||
diff --git a/bin/named/config.c b/bin/named/config.c
|
||||
index eef8181..ff868b8 100644
|
||||
--- a/bin/named/config.c
|
||||
+++ b/bin/named/config.c
|
||||
@@ -98,7 +98,9 @@ options {\n\
|
||||
# pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
|
||||
port 53;\n\
|
||||
prefetch 2 9;\n"
|
||||
-#ifdef PATH_RANDOMDEV
|
||||
+#if defined(ISC_PLATFORM_CRYPTORANDOM)
|
||||
+" random-device none;\n"
|
||||
+#elif defined(PATH_RANDOMDEV)
|
||||
" random-device \"" PATH_RANDOMDEV "\";\n"
|
||||
#endif
|
||||
" recursing-file \"named.recursing\";\n\
|
||||
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
|
||||
index d955c2f..40621f2 100644
|
||||
--- a/bin/named/controlconf.c
|
||||
+++ b/bin/named/controlconf.c
|
||||
@@ -325,9 +325,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
|
||||
|
||||
static void
|
||||
control_recvmessage(isc_task_t *task, isc_event_t *event) {
|
||||
- controlconnection_t *conn;
|
||||
- controllistener_t *listener;
|
||||
- controlkey_t *key;
|
||||
+ controlconnection_t *conn = NULL;
|
||||
+ controllistener_t *listener = NULL;
|
||||
+ ns_server_t *server = NULL;
|
||||
+ controlkey_t *key = NULL;
|
||||
isccc_sexpr_t *request = NULL;
|
||||
isccc_sexpr_t *response = NULL;
|
||||
uint32_t algorithm;
|
||||
@@ -338,16 +339,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
|
||||
isc_buffer_t *text;
|
||||
isc_result_t result;
|
||||
isc_result_t eresult;
|
||||
- isccc_sexpr_t *_ctrl;
|
||||
+ isccc_sexpr_t *_ctrl = NULL;
|
||||
isccc_time_t sent;
|
||||
isccc_time_t exp;
|
||||
uint32_t nonce;
|
||||
- isccc_sexpr_t *data;
|
||||
+ isccc_sexpr_t *data = NULL;
|
||||
|
||||
REQUIRE(event->ev_type == ISCCC_EVENT_CCMSG);
|
||||
|
||||
conn = event->ev_arg;
|
||||
listener = conn->listener;
|
||||
+ server = listener->controls->server;
|
||||
algorithm = DST_ALG_UNKNOWN;
|
||||
secret.rstart = NULL;
|
||||
text = NULL;
|
||||
@@ -458,8 +460,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
|
||||
* Establish nonce.
|
||||
*/
|
||||
if (conn->nonce == 0) {
|
||||
- while (conn->nonce == 0)
|
||||
- isc_random_get(&conn->nonce);
|
||||
+ while (conn->nonce == 0) {
|
||||
+ uint16_t r1 = isc_rng_random(server->rngctx);
|
||||
+ uint16_t r2 = isc_rng_random(server->rngctx);
|
||||
+ conn->nonce = (r1 << 16) | r2;
|
||||
+ }
|
||||
eresult = ISC_R_SUCCESS;
|
||||
} else
|
||||
eresult = ns_control_docommand(request, listener->readonly, &text);
|
||||
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
|
||||
index 3f96b7b..c92922e 100644
|
||||
--- a/bin/named/include/named/server.h
|
||||
+++ b/bin/named/include/named/server.h
|
||||
@@ -20,6 +20,7 @@
|
||||
#include <isc/log.h>
|
||||
#include <isc/magic.h>
|
||||
#include <isc/quota.h>
|
||||
+#include <isc/random.h>
|
||||
#include <isc/sockaddr.h>
|
||||
#include <isc/types.h>
|
||||
#include <isc/xml.h>
|
||||
@@ -134,6 +135,7 @@ struct ns_server {
|
||||
char * lockfile;
|
||||
|
||||
uint16_t transfer_tcp_message_size;
|
||||
+ isc_rng_t * rngctx;
|
||||
};
|
||||
|
||||
struct ns_altsecret {
|
||||
diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
|
||||
index 9dea7c1..272d300 100644
|
||||
--- a/bin/named/interfacemgr.c
|
||||
+++ b/bin/named/interfacemgr.c
|
||||
@@ -17,6 +17,7 @@
|
||||
|
||||
#include <isc/interfaceiter.h>
|
||||
#include <isc/os.h>
|
||||
+#include <isc/random.h>
|
||||
#include <isc/string.h>
|
||||
#include <isc/task.h>
|
||||
#include <isc/util.h>
|
||||
diff --git a/bin/named/query.c b/bin/named/query.c
|
||||
index 203f1e6..25eeced 100644
|
||||
--- a/bin/named/query.c
|
||||
+++ b/bin/named/query.c
|
||||
@@ -19,6 +19,7 @@
|
||||
#include <isc/hex.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/print.h>
|
||||
+#include <isc/random.h>
|
||||
#include <isc/rwlock.h>
|
||||
#include <isc/serial.h>
|
||||
#include <isc/stats.h>
|
||||
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||
index 7b3b736..4aaa92f 100644
|
||||
--- a/bin/named/server.c
|
||||
+++ b/bin/named/server.c
|
||||
@@ -8234,21 +8234,32 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
* Open the source of entropy.
|
||||
*/
|
||||
if (first_time) {
|
||||
+ const char *randomdev = NULL;
|
||||
+ int level = ISC_LOG_ERROR;
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "random-device", &obj);
|
||||
- if (result != ISC_R_SUCCESS) {
|
||||
+ if (result == ISC_R_SUCCESS) {
|
||||
+ if (!cfg_obj_isvoid(obj)) {
|
||||
+ level = ISC_LOG_INFO;
|
||||
+ randomdev = cfg_obj_asstring(obj);
|
||||
+ }
|
||||
+ }
|
||||
+ if (randomdev == NULL) {
|
||||
+#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
+ isc_entropy_usehook(ns_g_entropy, true);
|
||||
+#else
|
||||
+ if ((obj != NULL) && !cfg_obj_isvoid(obj))
|
||||
+ level = ISC_LOG_INFO;
|
||||
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
|
||||
- NS_LOGMODULE_SERVER, ISC_LOG_INFO,
|
||||
+ NS_LOGMODULE_SERVER, level,
|
||||
"no source of entropy found");
|
||||
+ if ((obj == NULL) || cfg_obj_isvoid(obj)) {
|
||||
+ CHECK(ISC_R_FAILURE);
|
||||
+ }
|
||||
+#endif
|
||||
} else {
|
||||
- const char *randomdev = cfg_obj_asstring(obj);
|
||||
-#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
- if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)
|
||||
- isc_entropy_usehook(ns_g_entropy, true);
|
||||
-#else
|
||||
- int level = ISC_LOG_ERROR;
|
||||
result = isc_entropy_createfilesource(ns_g_entropy,
|
||||
- randomdev);
|
||||
+ randomdev);
|
||||
#ifdef PATH_RANDOMDEV
|
||||
if (ns_g_fallbackentropy != NULL) {
|
||||
level = ISC_LOG_INFO;
|
||||
@@ -8259,8 +8270,8 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
NS_LOGCATEGORY_GENERAL,
|
||||
NS_LOGMODULE_SERVER,
|
||||
level,
|
||||
- "could not open entropy source "
|
||||
- "%s: %s",
|
||||
+ "could not open "
|
||||
+ "entropy source %s: %s",
|
||||
randomdev,
|
||||
isc_result_totext(result));
|
||||
}
|
||||
@@ -8280,7 +8291,6 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
}
|
||||
isc_entropy_detach(&ns_g_fallbackentropy);
|
||||
}
|
||||
-#endif
|
||||
#endif
|
||||
}
|
||||
|
||||
@@ -9049,6 +9059,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
|
||||
server->in_roothints = NULL;
|
||||
server->blackholeacl = NULL;
|
||||
server->keepresporder = NULL;
|
||||
+ server->rngctx = NULL;
|
||||
|
||||
/* Must be first. */
|
||||
CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
|
||||
@@ -9075,6 +9086,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
|
||||
CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
|
||||
&server->tkeyctx),
|
||||
"creating TKEY context");
|
||||
+ server->rngctx = NULL;
|
||||
+ CHECKFATAL(isc_rng_create(ns_g_mctx, ns_g_entropy, &server->rngctx),
|
||||
+ "creating random numbers context");
|
||||
|
||||
/*
|
||||
* Setup the server task, which is responsible for coordinating
|
||||
@@ -9281,7 +9295,8 @@ ns_server_destroy(ns_server_t **serverp) {
|
||||
|
||||
if (server->zonemgr != NULL)
|
||||
dns_zonemgr_detach(&server->zonemgr);
|
||||
-
|
||||
+ if (server->rngctx != NULL)
|
||||
+ isc_rng_detach(&server->rngctx);
|
||||
if (server->tkeyctx != NULL)
|
||||
dns_tkeyctx_destroy(&server->tkeyctx);
|
||||
|
||||
@@ -13316,10 +13331,10 @@ newzone_cfgctx_destroy(void **cfgp) {
|
||||
|
||||
static isc_result_t
|
||||
generate_salt(unsigned char *salt, size_t saltlen) {
|
||||
- int i, n;
|
||||
+ size_t i, n;
|
||||
union {
|
||||
unsigned char rnd[256];
|
||||
- uint32_t rnd32[64];
|
||||
+ uint16_t rnd16[128];
|
||||
} rnd;
|
||||
unsigned char text[512 + 1];
|
||||
isc_region_t r;
|
||||
@@ -13329,9 +13344,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
|
||||
if (saltlen > 256U)
|
||||
return (ISC_R_RANGE);
|
||||
|
||||
- n = (int) (saltlen + sizeof(uint32_t) - 1) / sizeof(uint32_t);
|
||||
- for (i = 0; i < n; i++)
|
||||
- isc_random_get(&rnd.rnd32[i]);
|
||||
+ n = (saltlen + sizeof(uint16_t) - 1) / sizeof(uint16_t);
|
||||
+ for (i = 0; i < n; i++) {
|
||||
+ rnd.rnd16[i] = isc_rng_random(ns_g_server->rngctx);
|
||||
+ }
|
||||
|
||||
memmove(salt, rnd.rnd, saltlen);
|
||||
|
||||
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
|
||||
index 2436731..6f59456 100644
|
||||
--- a/bin/nsupdate/nsupdate.c
|
||||
+++ b/bin/nsupdate/nsupdate.c
|
||||
@@ -284,9 +284,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
|
||||
}
|
||||
|
||||
#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
- if (randomfile != NULL &&
|
||||
- strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
|
||||
- randomfile = NULL;
|
||||
+ if (randomfile == NULL) {
|
||||
isc_entropy_usehook(*ectx, true);
|
||||
}
|
||||
#endif
|
||||
diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
|
||||
index f0a6ff2..55064f6 100644
|
||||
--- a/bin/tests/system/pipelined/pipequeries.c
|
||||
+++ b/bin/tests/system/pipelined/pipequeries.c
|
||||
@@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
|
||||
ectx = NULL;
|
||||
RUNCHECK(isc_entropy_create(mctx, &ectx));
|
||||
#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
- if (randomfile != NULL &&
|
||||
- strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
|
||||
- randomfile = NULL;
|
||||
+ if (randomfile == NULL) {
|
||||
isc_entropy_usehook(ectx, true);
|
||||
}
|
||||
#endif
|
||||
diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
|
||||
index fe8698e..937fcc3 100644
|
||||
--- a/bin/tests/system/tkey/keycreate.c
|
||||
+++ b/bin/tests/system/tkey/keycreate.c
|
||||
@@ -255,9 +255,7 @@ main(int argc, char *argv[]) {
|
||||
ectx = NULL;
|
||||
RUNCHECK(isc_entropy_create(mctx, &ectx));
|
||||
#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
- if (randomfile != NULL &&
|
||||
- strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
|
||||
- randomfile = NULL;
|
||||
+ if (randomfile == NULL) {
|
||||
isc_entropy_usehook(ectx, true);
|
||||
}
|
||||
#endif
|
||||
diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
|
||||
index 2146f9b..64b8e74 100644
|
||||
--- a/bin/tests/system/tkey/keydelete.c
|
||||
+++ b/bin/tests/system/tkey/keydelete.c
|
||||
@@ -171,6 +171,7 @@ main(int argc, char **argv) {
|
||||
randomfile = argv[2];
|
||||
argv += 2;
|
||||
argc -= 2;
|
||||
+ POST(argc);
|
||||
}
|
||||
keyname = argv[1];
|
||||
|
||||
@@ -182,9 +183,7 @@ main(int argc, char **argv) {
|
||||
ectx = NULL;
|
||||
RUNCHECK(isc_entropy_create(mctx, &ectx));
|
||||
#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
- if (randomfile != NULL &&
|
||||
- strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
|
||||
- randomfile = NULL;
|
||||
+ if (randomfile == NULL) {
|
||||
isc_entropy_usehook(ectx, true);
|
||||
}
|
||||
#endif
|
||||
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
|
||||
index 1da0565..7eef5b2 100644
|
||||
--- a/doc/arm/Bv9ARM-book.xml
|
||||
+++ b/doc/arm/Bv9ARM-book.xml
|
||||
@@ -5034,22 +5034,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
|
||||
<term><command>random-device</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
- This specifies a source of entropy to be used by the server. Entropy is
|
||||
- primarily needed
|
||||
- for DNSSEC operations, such as TKEY transactions and dynamic
|
||||
- update of signed
|
||||
- zones. This option specifies the device (or file) from which
|
||||
- to read
|
||||
- entropy. If it is a file, operations requiring entropy will
|
||||
- fail when the
|
||||
- file has been exhausted. If <command>random-device</command> is not specified, the default value
|
||||
- is
|
||||
- <filename>/dev/random</filename>
|
||||
- (or equivalent) when present, and none otherwise. The
|
||||
- <command>random-device</command> option takes
|
||||
- effect during
|
||||
- the initial configuration load at server startup time and
|
||||
- is ignored on subsequent reloads.
|
||||
+ Specifies a source of entropy to be used by the server.
|
||||
+ This is a device or file from which to read entropy.
|
||||
+ If it is a file, operations requiring entropy
|
||||
+ will fail when the file has been exhausted.
|
||||
+ </para>
|
||||
+ <para>
|
||||
+ Entropy is needed for cryptographic operations such as
|
||||
+ TKEY transactions, dynamic update of signed zones, and
|
||||
+ generation of TSIG session keys. It is also used for
|
||||
+ seeding and stirring the pseudo-random number generator,
|
||||
+ which is used for less critical functions requiring
|
||||
+ randomness such as generation of DNS message transaction
|
||||
+ ID's.
|
||||
+ </para>
|
||||
+ <para>
|
||||
+ If <command>random-device</command> is not specified, or
|
||||
+ if it is set to <literal>none</literal>, entropy will be
|
||||
+ read from the random number generation function supplied
|
||||
+ by the cryptographic library with which BIND was linked
|
||||
+ (i.e. OpenSSL or a PKCS#11 provider).
|
||||
+ </para>
|
||||
+ <para>
|
||||
+ The <command>random-device</command> option takes
|
||||
+ effect during the initial configuration load at server
|
||||
+ startup time and is ignored on subsequent reloads.
|
||||
+ </para>
|
||||
+ <para>
|
||||
+ If BIND is built with
|
||||
+ <command>configure --disable-crypto-rand</command>, then
|
||||
+ entropy is <emphasis>not</emphasis> sourced from the
|
||||
+ cryptographic library. In this case, if
|
||||
+ <command>random-device</command> is not specified, the
|
||||
+ default value is the system random device,
|
||||
+ <filename>/dev/random</filename> or the equivalent.
|
||||
+ This default can be overridden with
|
||||
+ <command>configure --with-randomdev</command>.
|
||||
+ If no system random device exists, then no entropy source
|
||||
+ will be configured, and <command>named</command> will only
|
||||
+ be able to use pseudo-random numbers.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
diff --git a/doc/arm/notes-rh-changes.xml b/doc/arm/notes-rh-changes.xml
|
||||
new file mode 100644
|
||||
index 0000000..89a4961
|
||||
--- /dev/null
|
||||
+++ b/doc/arm/notes-rh-changes.xml
|
||||
@@ -0,0 +1,42 @@
|
||||
+<!--
|
||||
+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
+ -
|
||||
+ - This Source Code Form is subject to the terms of the Mozilla Public
|
||||
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
+ -
|
||||
+ - See the COPYRIGHT file distributed with this work for additional
|
||||
+ - information regarding copyright ownership.
|
||||
+-->
|
||||
+
|
||||
+<section xml:id="relnotes_rh_changes"><info><title>Red Hat Specific Changes</title></info>
|
||||
+ <itemizedlist>
|
||||
+ <listitem>
|
||||
+ <para>
|
||||
+ By default, BIND now uses the random number generation functions
|
||||
+ in the cryptographic library (i.e., OpenSSL or a PKCS#11
|
||||
+ provider) as a source of high-quality randomness rather than
|
||||
+ <filename>/dev/random</filename>. This is suitable for virtual
|
||||
+ machine environments, which may have limited entropy pools and
|
||||
+ lack hardware random number generators.
|
||||
+ </para>
|
||||
+ <para>
|
||||
+ This can be overridden by specifying another entropy source via
|
||||
+ the <command>random-device</command> option in
|
||||
+ <filename>named.conf</filename>, or via the <command>-r</command>
|
||||
+ command line option. However, for functions requiring full
|
||||
+ cryptographic strength, such as DNSSEC key generation, this
|
||||
+ <emphasis>cannot</emphasis> be overridden. In particular, the
|
||||
+ <command>-r</command> command line option no longer has any
|
||||
+ effect on <command>dnssec-keygen</command>.
|
||||
+ </para>
|
||||
+ <para>
|
||||
+ This can be disabled by building with
|
||||
+ <command>configure --disable-crypto-rand</command>, in which
|
||||
+ case <filename>/dev/random</filename> will be the default
|
||||
+ entropy source. [RT #31459] [RT #46047]
|
||||
+ </para>
|
||||
+ </listitem>
|
||||
+ </itemizedlist>
|
||||
+</section>
|
||||
+
|
||||
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
|
||||
index adffaa0..2ffe344 100644
|
||||
--- a/doc/arm/notes.xml
|
||||
+++ b/doc/arm/notes.xml
|
||||
@@ -45,6 +45,7 @@
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
|
||||
|
||||
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-rh-changes.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
|
||||
</section>
|
||||
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
|
||||
index 1eccbe7..1933993 100644
|
||||
--- a/lib/dns/dst_api.c
|
||||
+++ b/lib/dns/dst_api.c
|
||||
@@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
|
||||
else
|
||||
flags |= ISC_ENTROPY_BLOCKING;
|
||||
#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
+ /* get entropy directly from crypto provider */
|
||||
return (dst_random_getdata(buf, len, NULL, flags));
|
||||
#else
|
||||
+ /* get entropy from entropy source or hook function */
|
||||
return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));
|
||||
-#endif
|
||||
+#endif /* ISC_PLATFORM_CRYPTORANDOM */
|
||||
#endif /* PKCS11CRYPTO */
|
||||
}
|
||||
|
||||
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
|
||||
index 6813c96..665574d 100644
|
||||
--- a/lib/dns/include/dst/dst.h
|
||||
+++ b/lib/dns/include/dst/dst.h
|
||||
@@ -163,8 +163,18 @@ isc_result_t
|
||||
dst_random_getdata(void *data, unsigned int length,
|
||||
unsigned int *returned, unsigned int flags);
|
||||
/*%<
|
||||
- * \brief Return data from the crypto random generator.
|
||||
- * Specialization of isc_entropy_getdata().
|
||||
+ * Gets random data from the random generator provided by the
|
||||
+ * crypto library, if BIND was built with --enable-crypto-rand.
|
||||
+ *
|
||||
+ * See isc_entropy_getdata() for parameter usage. Normally when
|
||||
+ * this function is available, it will be set up as a hook in the
|
||||
+ * entropy context, so that isc_entropy_getdata() is a front-end to
|
||||
+ * this function.
|
||||
+ *
|
||||
+ * Returns:
|
||||
+ * \li ISC_R_SUCCESS on success
|
||||
+ * \li ISC_R_NOTIMPLEMENTED if BIND is built with --disable-crypto-rand
|
||||
+ * \li DST_R_OPENSSLFAILURE, DST_R_CRYPTOFAILURE, or other codes on error
|
||||
*/
|
||||
|
||||
bool
|
||||
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
|
||||
index ffe0a69..5e48686 100644
|
||||
--- a/lib/dns/openssl_link.c
|
||||
+++ b/lib/dns/openssl_link.c
|
||||
@@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
|
||||
|
||||
isc_result_t
|
||||
dst_random_getdata(void *data, unsigned int length,
|
||||
- unsigned int *returned, unsigned int flags) {
|
||||
+ unsigned int *returned, unsigned int flags)
|
||||
+{
|
||||
#ifdef ISC_PLATFORM_CRYPTORANDOM
|
||||
#ifndef DONT_REQUIRE_DST_LIB_INIT
|
||||
INSIST(dst__memory_pool != NULL);
|
||||
diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
|
||||
index c40a18c..c7cb17d 100644
|
||||
--- a/lib/isc/include/isc/entropy.h
|
||||
+++ b/lib/isc/include/isc/entropy.h
|
||||
@@ -189,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
|
||||
/*!<
|
||||
* \brief Create an entropy source that is polled via a callback.
|
||||
*
|
||||
- * This would
|
||||
- * be used when keyboard input is used, or a GUI input method. It can
|
||||
- * also be used to hook in any external entropy source.
|
||||
+ * This would be used when keyboard input is used, or a GUI input method.
|
||||
+ * It can also be used to hook in any external entropy source.
|
||||
*
|
||||
* Samples are added via isc_entropy_addcallbacksample(), below.
|
||||
* _addcallbacksample() is the only function which may be called from
|
||||
@@ -232,15 +231,32 @@ isc_result_t
|
||||
isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
|
||||
unsigned int *returned, unsigned int flags);
|
||||
/*!<
|
||||
- * \brief Extract data from the entropy pool. This may load the pool from various
|
||||
- * sources.
|
||||
+ * \brief Get random data from entropy pool 'ent'.
|
||||
*
|
||||
- * Do this by stirring the pool and returning a part of hash as randomness.
|
||||
- * Note that no secrets are given away here since parts of the hash are
|
||||
- * xored together before returned.
|
||||
+ * If a hook has been set up using isc_entropy_sethook() and
|
||||
+ * isc_entropy_usehook(), then the hook function will be called to get
|
||||
+ * random data.
|
||||
*
|
||||
- * Honor the request from the caller to only return good data, any data,
|
||||
- * etc.
|
||||
+ * Otherwise, randomness is extracted from the entropy pool set up in BIND.
|
||||
+ * This may cause the pool to be loaded from various sources. Ths is done
|
||||
+ * by stirring the pool and returning a part of hash as randomness.
|
||||
+ * (Note that no secrets are given away here since parts of the hash are
|
||||
+ * XORed together before returning.)
|
||||
+ *
|
||||
+ * 'flags' may contain ISC_ENTROPY_GOODONLY, ISC_ENTROPY_PARTIAL, or
|
||||
+ * ISC_ENTROPY_BLOCKING. These will be honored if the hook function is
|
||||
+ * not in use. If it is, the flags will be passed to the hook function
|
||||
+ * but it may ignore them.
|
||||
+ *
|
||||
+ * Up to 'length' bytes of randomness are retrieved and copied into 'data'.
|
||||
+ * (If 'returned' is not NULL, and the number of bytes copied is less than
|
||||
+ * 'length' - which may happen if ISC_ENTROPY_PARTIAL was used - then the
|
||||
+ * number of bytes copied will be stored in *returned.)
|
||||
+ *
|
||||
+ * Returns:
|
||||
+ * \li ISC_R_SUCCESS on success
|
||||
+ * \li ISC_R_NOENTROPY if entropy pool is empty
|
||||
+ * \li other error codes are possible when a hook is in use
|
||||
*/
|
||||
|
||||
void
|
||||
@@ -305,13 +321,21 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
|
||||
void
|
||||
isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
|
||||
/*!<
|
||||
- * \brief Mark/unmark the given entropy structure as being hooked.
|
||||
+ * \brief Configure entropy context 'ectx' to use the hook function
|
||||
+ *
|
||||
+ * Sets the entropy context to call the hook function for random number
|
||||
+ * generation, if such a function has been configured via
|
||||
+ * isc_entropy_sethook(), whenever isc_entropy_getdata() is called.
|
||||
*/
|
||||
|
||||
void
|
||||
isc_entropy_sethook(isc_entropy_getdata_t myhook);
|
||||
/*!<
|
||||
- * \brief Set the getdata hook (e.g., for a crypto random generator).
|
||||
+ * \brief Set the hook function.
|
||||
+ *
|
||||
+ * The hook function is a global value: only one hook function
|
||||
+ * can be set in the system. Individual entropy contexts may be
|
||||
+ * configured to use it, or not, by calling isc_entropy_usehook().
|
||||
*/
|
||||
|
||||
ISC_LANG_ENDDECLS
|
||||
diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
|
||||
index f8aed34..17c551b 100644
|
||||
--- a/lib/isc/include/isc/random.h
|
||||
+++ b/lib/isc/include/isc/random.h
|
||||
@@ -9,8 +9,6 @@
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
-/* $Id: random.h,v 1.20 2009/01/17 23:47:43 tbox Exp $ */
|
||||
-
|
||||
#ifndef ISC_RANDOM_H
|
||||
#define ISC_RANDOM_H 1
|
||||
|
||||
@@ -21,13 +19,23 @@
|
||||
#include <isc/mutex.h>
|
||||
|
||||
/*! \file isc/random.h
|
||||
- * \brief Implements a random state pool which will let the caller return a
|
||||
- * series of possibly non-reproducible random values.
|
||||
+ * \brief Implements pseudo random number generators.
|
||||
+ *
|
||||
+ * Two pseudo-random number generators are implemented, in isc_random_*
|
||||
+ * and isc_rng_*. Neither one is very strong; they should not be used
|
||||
+ * in cryptography functions.
|
||||
+ *
|
||||
+ * isc_random_* is based on arc4random if it is available on the system.
|
||||
+ * Otherwise it is based on the posix srand() and rand() functions.
|
||||
+ * It is useful for jittering values a bit here and there, such as
|
||||
+ * timeouts, etc, but should not be relied upon to generate
|
||||
+ * unpredictable sequences (for example, when choosing transaction IDs).
|
||||
*
|
||||
- * Note that the
|
||||
- * strength of these numbers is not all that high, and should not be
|
||||
- * used in cryptography functions. It is useful for jittering values
|
||||
- * a bit here and there, such as timeouts, etc.
|
||||
+ * isc_rng_* is based on ChaCha20, and is seeded and stirred from the
|
||||
+ * system entropy source. It is stronger than isc_random_* and can
|
||||
+ * be used for generating unpredictable sequences. It is still not as
|
||||
+ * good as using system entropy directly (see entropy.h) and should not
|
||||
+ * be used for cryptographic functions such as key generation.
|
||||
*/
|
||||
|
||||
ISC_LANG_BEGINDECLS
|
||||
@@ -115,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
|
||||
uint16_t
|
||||
isc_rng_uniformrandom(isc_rng_t *rngctx, uint16_t upper_bound);
|
||||
/*%<
|
||||
- * Returns a uniformly distributed pseudo random 16-bit unsigned
|
||||
- * integer.
|
||||
+ * Returns a uniformly distributed pseudo-random 16-bit unsigned integer
|
||||
+ * less than 'upper_bound'.
|
||||
*/
|
||||
|
||||
ISC_LANG_ENDDECLS
|
||||
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
|
||||
index 1c45d5c..91693b5 100644
|
||||
--- a/lib/isccfg/namedconf.c
|
||||
+++ b/lib/isccfg/namedconf.c
|
||||
@@ -1109,7 +1109,7 @@ options_clauses[] = {
|
||||
{ "pid-file", &cfg_type_qstringornone, 0 },
|
||||
{ "port", &cfg_type_uint32, 0 },
|
||||
{ "querylog", &cfg_type_boolean, 0 },
|
||||
- { "random-device", &cfg_type_qstring, 0 },
|
||||
+ { "random-device", &cfg_type_qstringornone, 0 },
|
||||
{ "recursing-file", &cfg_type_qstring, 0 },
|
||||
{ "recursive-clients", &cfg_type_uint32, 0 },
|
||||
{ "reserved-sockets", &cfg_type_uint32, 0 },
|
||||
--
|
||||
2.26.2
|
||||
|
42
bind-9.11-serve-stale-dbfix.patch
Normal file
42
bind-9.11-serve-stale-dbfix.patch
Normal file
@ -0,0 +1,42 @@
|
||||
From 20848d8284951481051f6ebdeb8128c05c7e82e2 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Mon, 11 Nov 2019 16:56:52 +0100
|
||||
Subject: [PATCH] Move stale_ttl from middle to the end
|
||||
|
||||
bind-dyndb-ldap is using rdataset structure. Do not modify its body,
|
||||
move stale_ttl to the end. Make it binary compatible.
|
||||
---
|
||||
lib/dns/include/dns/rdataset.h | 10 +++++-----
|
||||
1 file changed, 5 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
|
||||
index 97071ed496..a0c6afe624 100644
|
||||
--- a/lib/dns/include/dns/rdataset.h
|
||||
+++ b/lib/dns/include/dns/rdataset.h
|
||||
@@ -137,11 +137,6 @@ struct dns_rdataset {
|
||||
dns_rdataclass_t rdclass;
|
||||
dns_rdatatype_t type;
|
||||
dns_ttl_t ttl;
|
||||
- /*
|
||||
- * Stale ttl is used to see how long this RRset can still be used
|
||||
- * to serve to clients, after the TTL has expired.
|
||||
- */
|
||||
- dns_ttl_t stale_ttl;
|
||||
dns_trust_t trust;
|
||||
dns_rdatatype_t covers;
|
||||
|
||||
@@ -178,6 +173,11 @@ struct dns_rdataset {
|
||||
void * private7;
|
||||
/*@}*/
|
||||
|
||||
+ /*
|
||||
+ * Stale ttl is used to see how long this RRset can still be used
|
||||
+ * to serve to clients, after the TTL has expired.
|
||||
+ */
|
||||
+ dns_ttl_t stale_ttl;
|
||||
};
|
||||
|
||||
/*!
|
||||
--
|
||||
2.20.1
|
||||
|
3862
bind-9.11-serve-stale.patch
Normal file
3862
bind-9.11-serve-stale.patch
Normal file
File diff suppressed because it is too large
Load Diff
39
bind-9.11-tests-pkcs11.patch
Normal file
39
bind-9.11-tests-pkcs11.patch
Normal file
@ -0,0 +1,39 @@
|
||||
From 66298a12b09784eab2c052ab22f87bb2b2f1267b Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Fri, 1 Mar 2019 15:55:46 +0100
|
||||
Subject: [PATCH] Detect correctly pkcs11 support
|
||||
|
||||
It fails now always, because oot builds are not supported by
|
||||
cleanpkcs11.sh.
|
||||
---
|
||||
bin/tests/system/cleanpkcs11.sh | 2 +-
|
||||
bin/tests/system/conf.sh.in | 1 +
|
||||
2 files changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/bin/tests/system/cleanpkcs11.sh b/bin/tests/system/cleanpkcs11.sh
|
||||
index b974708..3bbef4c 100644
|
||||
--- a/bin/tests/system/cleanpkcs11.sh
|
||||
+++ b/bin/tests/system/cleanpkcs11.sh
|
||||
@@ -12,6 +12,6 @@
|
||||
SYSTEMTESTTOP=.
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
-if [ ! -x ../../pkcs11/pkcs11-destroy ]; then exit 1; fi
|
||||
+if [ ! -x "$PK11DESTROY" ]; then exit 1; fi
|
||||
|
||||
$PK11DEL -w0 > /dev/null 2>&1
|
||||
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
|
||||
index a446c18..ede1203 100644
|
||||
--- a/bin/tests/system/conf.sh.in
|
||||
+++ b/bin/tests/system/conf.sh.in
|
||||
@@ -46,6 +46,7 @@ CHECKZONE=$TOP/bin/check/named-checkzone
|
||||
CHECKCONF=$TOP/bin/check/named-checkconf
|
||||
PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
|
||||
PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
|
||||
+PK11DESTROY=$TOP/bin/pkcs11/pkcs11-destroy
|
||||
PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
|
||||
JOURNALPRINT=$TOP/bin/tools/named-journalprint
|
||||
VERIFY=$TOP/bin/dnssec/dnssec-verify
|
||||
--
|
||||
2.20.1
|
||||
|
65
bind-9.11-tests-variants.patch
Normal file
65
bind-9.11-tests-variants.patch
Normal file
@ -0,0 +1,65 @@
|
||||
From 9576e960ad3719aa9c1707734ad7ba0eccf16e5f Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Fri, 1 Mar 2019 15:48:20 +0100
|
||||
Subject: [PATCH] Make alternative named builds testable in system tests
|
||||
|
||||
Red Hat has alternative variant builds of named, which are not ever
|
||||
tested by system tests. New variables make it relatively easy to test
|
||||
alternative variants.
|
||||
|
||||
For sdb variant use:
|
||||
export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
|
||||
|
||||
For pkcs variant use:
|
||||
export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
|
||||
---
|
||||
bin/tests/system/conf.sh.in | 18 +++++++++---------
|
||||
1 file changed, 9 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
|
||||
index 6f2dbcd..05605ae 100644
|
||||
--- a/bin/tests/system/conf.sh.in
|
||||
+++ b/bin/tests/system/conf.sh.in
|
||||
@@ -37,7 +37,7 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
|
||||
DISABLED_ALGORITHM_NUMBER=14
|
||||
DISABLED_BITS=384
|
||||
|
||||
-NAMED=$TOP/bin/named/named
|
||||
+NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
|
||||
# We must use "named -l" instead of "lwresd" because argv[0] is lost
|
||||
# if the program is libtoolized.
|
||||
LWRESD="$TOP/bin/named/named -l"
|
||||
@@ -48,14 +48,14 @@ NSUPDATE=$TOP/bin/nsupdate/nsupdate
|
||||
DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
|
||||
TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
|
||||
RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
|
||||
-KEYGEN=$TOP/bin/dnssec/dnssec-keygen
|
||||
-KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
|
||||
-SIGNER=$TOP/bin/dnssec/dnssec-signzone
|
||||
-REVOKE=$TOP/bin/dnssec/dnssec-revoke
|
||||
-SETTIME=$TOP/bin/dnssec/dnssec-settime
|
||||
-DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
|
||||
+KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
|
||||
+KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
|
||||
+SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
|
||||
+REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
|
||||
+SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-settime${DNSSEC_VARIANT}
|
||||
+DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
|
||||
HOST=$TOP/bin/dig/host
|
||||
-IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
|
||||
+IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
|
||||
CHECKDS=$TOP/bin/python/dnssec-checkds
|
||||
COVERAGE=$TOP/bin/python/dnssec-coverage
|
||||
KEYMGR=$TOP/bin/python/dnssec-keymgr
|
||||
@@ -75,7 +75,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
|
||||
MDIG=$TOP/bin/tools/mdig
|
||||
NZD2NZF=$TOP/bin/tools/named-nzd2nzf
|
||||
FSTRM_CAPTURE=@FSTRM_CAPTURE@
|
||||
-FEATURETEST=$TOP/bin/named/feature-test
|
||||
+FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
|
||||
|
||||
RANDFILE=$TOP/bin/tests/system/random.data
|
||||
|
||||
--
|
||||
2.21.1
|
||||
|
30
bind-9.11-unit-disable-random.patch
Normal file
30
bind-9.11-unit-disable-random.patch
Normal file
@ -0,0 +1,30 @@
|
||||
From 373f07148217a8e70e33446f5108fb42d1079ba6 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Thu, 21 Feb 2019 22:42:27 +0100
|
||||
Subject: [PATCH] Disable random_test
|
||||
|
||||
It fails too often on some architecture, failing the whole build along.
|
||||
Because it runs two times for pkcs11 and normal build and any of
|
||||
subtests can occasionally fail, stop it.
|
||||
|
||||
It can be used again by defining 'unstable' variable in Kyuafile.
|
||||
---
|
||||
lib/isc/tests/Kyuafile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/isc/tests/Kyuafile b/lib/isc/tests/Kyuafile
|
||||
index 4cd2574..9df2340 100644
|
||||
--- a/lib/isc/tests/Kyuafile
|
||||
+++ b/lib/isc/tests/Kyuafile
|
||||
@@ -19,7 +19,7 @@ tap_test_program{name='pool_test'}
|
||||
tap_test_program{name='print_test'}
|
||||
tap_test_program{name='queue_test'}
|
||||
tap_test_program{name='radix_test'}
|
||||
-tap_test_program{name='random_test'}
|
||||
+tap_test_program{name='random_test', required_configs='unstable'}
|
||||
tap_test_program{name='regex_test'}
|
||||
tap_test_program{name='result_test'}
|
||||
tap_test_program{name='safe_test'}
|
||||
--
|
||||
2.20.1
|
||||
|
16
bind-9.11.12.tar.gz.asc
Normal file
16
bind-9.11.12.tar.gz.asc
Normal file
@ -0,0 +1,16 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
|
||||
PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
|
||||
NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
|
||||
twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
|
||||
zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
|
||||
g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
|
||||
S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
|
||||
2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
|
||||
1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
|
||||
zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
|
||||
1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
|
||||
O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
|
||||
=GCy6
|
||||
-----END PGP SIGNATURE-----
|
178
bind-9.11.23-atomic.patch
Normal file
178
bind-9.11.23-atomic.patch
Normal file
@ -0,0 +1,178 @@
|
||||
From 1528f231b559670445cfc427937174535981917d Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Fri, 18 Sep 2020 14:46:02 +0200
|
||||
Subject: [PATCH] Fix isc_atomic_xadd symbol missing
|
||||
|
||||
Squashed commit of the following:
|
||||
|
||||
commit d8afe85342f05d8fec8ee0255451568e936b7eb2
|
||||
Author: Mark Andrews <marka@isc.org>
|
||||
Date: Mon Sep 7 16:12:31 2020 +1000
|
||||
|
||||
Update 'init_count' atomically to silence tsan errors.
|
||||
|
||||
(cherry picked from commit 90185b225f4c7acde2fbb04697d857fe496725a2)
|
||||
|
||||
commit f166c7fb7cc262a688ed511e40c9b0d551d5992d
|
||||
Author: Mark Andrews <marka@isc.org>
|
||||
Date: Thu Sep 3 12:53:53 2020 +1000
|
||||
|
||||
The node lock was released too early.
|
||||
|
||||
NEGATIVE needs to be call with the node lock held.
|
||||
|
||||
WARNING: ThreadSanitizer: data race
|
||||
Write of size 2 at 0x000000000001 by thread T1 (mutexes: write M1):
|
||||
#0 mark_stale_header lib/dns/rbtdb.c:1802:21
|
||||
#1 add32 lib/dns/rbtdb.c:6559:5
|
||||
#2 addrdataset lib/dns/rbtdb.c:6975:12
|
||||
#3 dns_db_addrdataset lib/dns/db.c:783:10
|
||||
#4 cache_name lib/dns/resolver.c:5829:13
|
||||
#5 cache_message lib/dns/resolver.c:5926:14
|
||||
#6 resquery_response lib/dns/resolver.c:8618:12
|
||||
#7 dispatch lib/isc/task.c:1157:7
|
||||
#8 run lib/isc/task.c:1331:2
|
||||
|
||||
Previous read of size 2 at 0x000000000001 by thread T2:
|
||||
#0 cache_findrdataset lib/dns/rbtdb.c:5932:6
|
||||
#1 dns_db_findrdataset lib/dns/db.c:739:10
|
||||
#2 query_addadditional2 bin/named/query.c:2196:11
|
||||
#3 additionaldata_ns lib/dns/./rdata/generic/ns_2.c:198:10
|
||||
#4 dns_rdata_additionaldata lib/dns/rdata.c:1246:2
|
||||
#5 dns_rdataset_additionaldata lib/dns/rdataset.c:629:12
|
||||
#6 query_addrdataset bin/named/query.c:2411:8
|
||||
#7 query_addrrset bin/named/query.c:2802:2
|
||||
#8 query_addbestns bin/named/query.c:3501:2
|
||||
#9 query_find bin/named/query.c:9165:4
|
||||
#10 query_resume bin/named/query.c:4164:12
|
||||
#11 dispatch lib/isc/task.c:1157:7
|
||||
#12 run lib/isc/task.c:1331:2
|
||||
|
||||
(cherry picked from commit a1dcb73f677969d99df3ccff2acf4737e18a72b1)
|
||||
|
||||
commit 591a80fa95b8f3f3e716c45ceb9c5e4ccfa551c8
|
||||
Author: Mark Andrews <marka@isc.org>
|
||||
Date: Mon Aug 24 17:34:58 2020 +1000
|
||||
|
||||
increment header->count atomically
|
||||
|
||||
(cherry picked from commit 121837aa75ced489e28f8ce1dd20315487d199fa)
|
||||
---
|
||||
lib/dns/rbtdb.c | 43 +++++++++++++++++++++++++++++++++++--------
|
||||
1 file changed, 35 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||
index 88c39bf714..31ced8e73a 100644
|
||||
--- a/lib/dns/rbtdb.c
|
||||
+++ b/lib/dns/rbtdb.c
|
||||
@@ -399,6 +399,23 @@ typedef isc_mutex_t nodelock_t;
|
||||
#define NODE_WEAKDOWNGRADE(l) ((void)0)
|
||||
#endif
|
||||
|
||||
+#if defined(ISC_PLATFORM_HAVESTDATOMIC)
|
||||
+#if defined(__cplusplus)
|
||||
+#include <isc/stdatomic.h>
|
||||
+#else
|
||||
+#include <stdatomic.h>
|
||||
+#endif
|
||||
+#define DNS_RBTDB_STDATOMIC 1
|
||||
+#define DNS_RBTDB_INC(x) atomic_fetch_add(&(x), (1))
|
||||
+#define DNS_RBTDB_LOAD(x) atomic_load(&(x))
|
||||
+#elif defined(ISC_PLATFORM_HAVEXADD)
|
||||
+#define DNS_RBTDB_INC(x) isc_atomic_xadd((int *)&(x), 1);
|
||||
+#define DNS_RBTDB_LOAD(x) isc_atomic_xadd((int *)&(x), 0);
|
||||
+#else
|
||||
+#define DNS_RBTDB_INC(x) ((x)++)
|
||||
+#define DNS_RBTDB_LOAD(x) (x)
|
||||
+#endif
|
||||
+
|
||||
/*%
|
||||
* Whether to rate-limit updating the LRU to avoid possible thread contention.
|
||||
* Our performance measurement has shown the cost is marginal, so it's defined
|
||||
@@ -457,7 +474,11 @@ typedef struct rdatasetheader {
|
||||
* this rdataset.
|
||||
*/
|
||||
|
||||
- uint32_t count;
|
||||
+#ifdef DNS_RBTDB_STDATOMIC
|
||||
+ _Atomic(uint32_t) count;
|
||||
+#else
|
||||
+ uint32_t count;
|
||||
+#endif
|
||||
/*%<
|
||||
* Monotonously increased every time this rdataset is bound so that
|
||||
* it is used as the base of the starting point in DNS responses
|
||||
@@ -952,7 +973,11 @@ static char FILE_VERSION[32] = "\0";
|
||||
* that indicates that the database does not implement cyclic
|
||||
* processing.
|
||||
*/
|
||||
+#ifdef DNS_RBTDB_STDATOMIC
|
||||
+static _Atomic(unsigned int) init_count;
|
||||
+#else
|
||||
static unsigned int init_count;
|
||||
+#endif
|
||||
|
||||
/*
|
||||
* Locking
|
||||
@@ -3322,7 +3347,7 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
|
||||
rdataset->private2 = node;
|
||||
raw = (unsigned char *)header + sizeof(*header);
|
||||
rdataset->private3 = raw;
|
||||
- rdataset->count = header->count++;
|
||||
+ rdataset->count = DNS_RBTDB_INC(header->count);
|
||||
if (rdataset->count == UINT32_MAX)
|
||||
rdataset->count = 0;
|
||||
|
||||
@@ -5924,10 +5949,10 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
||||
}
|
||||
}
|
||||
|
||||
- NODE_UNLOCK(lock, locktype);
|
||||
-
|
||||
- if (found == NULL)
|
||||
+ if (found == NULL) {
|
||||
+ NODE_UNLOCK(lock, locktype);
|
||||
return (ISC_R_NOTFOUND);
|
||||
+ }
|
||||
|
||||
if (NEGATIVE(found)) {
|
||||
/*
|
||||
@@ -5939,6 +5964,8 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
||||
result = DNS_R_NCACHENXRRSET;
|
||||
}
|
||||
|
||||
+ NODE_UNLOCK(lock, locktype);
|
||||
+
|
||||
update_cachestats(rbtdb, result);
|
||||
|
||||
return (result);
|
||||
@@ -6839,7 +6866,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
||||
newheader->attributes |= RDATASET_ATTR_ZEROTTL;
|
||||
newheader->noqname = NULL;
|
||||
newheader->closest = NULL;
|
||||
- newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
|
||||
+ newheader->count = DNS_RBTDB_INC(init_count);
|
||||
newheader->trust = rdataset->trust;
|
||||
newheader->additional_auth = NULL;
|
||||
newheader->additional_glue = NULL;
|
||||
@@ -7035,7 +7062,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
||||
newheader->trust = 0;
|
||||
newheader->noqname = NULL;
|
||||
newheader->closest = NULL;
|
||||
- newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
|
||||
+ newheader->count = DNS_RBTDB_INC(init_count);
|
||||
newheader->additional_auth = NULL;
|
||||
newheader->additional_glue = NULL;
|
||||
newheader->last_used = 0;
|
||||
@@ -7481,7 +7508,7 @@ loading_addrdataset(void *arg, dns_name_t *name, dns_rdataset_t *rdataset) {
|
||||
newheader->serial = 1;
|
||||
newheader->noqname = NULL;
|
||||
newheader->closest = NULL;
|
||||
- newheader->count = isc_atomic_xadd((int32_t*)&init_count, 1);
|
||||
+ newheader->count = DNS_RBTDB_INC(init_count);
|
||||
newheader->additional_auth = NULL;
|
||||
newheader->additional_glue = NULL;
|
||||
newheader->last_used = 0;
|
||||
--
|
||||
2.26.2
|
||||
|
63
bind-9.3.1rc1-sdb_tools-Makefile.in
Normal file
63
bind-9.3.1rc1-sdb_tools-Makefile.in
Normal file
@ -0,0 +1,63 @@
|
||||
srcdir = @srcdir@
|
||||
VPATH = @srcdir@
|
||||
top_srcdir = @top_srcdir@
|
||||
|
||||
VERSION=@BIND9_VERSION@
|
||||
|
||||
@BIND9_MAKE_INCLUDES@
|
||||
|
||||
CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include \
|
||||
${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
|
||||
${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES}
|
||||
|
||||
CDEFINES = -DBIND9
|
||||
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
ISCCFGLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
ISCCCLIBS = ../../lib/isccc/libisccc.@A@
|
||||
ISCLIBS = ../../lib/isc/libisc.@A@
|
||||
LWRESLIBS = ../../lib/lwres/liblwres.@A@
|
||||
BIND9LIBS = ../../lib/bind9/libbind9.@A@
|
||||
|
||||
DNSDEPLIBS = ../../lib/dns/libdns.@A@
|
||||
ISCCFGDEPLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
ISCCCDEPLIBS = ../../lib/isccc/libisccc.@A@
|
||||
ISCDEPLIBS = ../../lib/isc/libisc.@A@
|
||||
LWRESDEPLIBS = ../../lib/lwres/liblwres.@A@
|
||||
BIND9DEPLIBS = ../../lib/bind9/libbind9.@A@
|
||||
|
||||
DEPLIBS = ${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
|
||||
${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
|
||||
|
||||
LIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
|
||||
|
||||
TARGETS = zone2ldap@EXEEXT@ zonetodb@EXEEXT@
|
||||
|
||||
OBJS = zone2ldap.@O@ zonetodb.@O@
|
||||
|
||||
SRCS = zone2ldap.c zonetodb.c
|
||||
|
||||
MANPAGES = zone2ldap.1
|
||||
|
||||
EXT_CFLAGS =
|
||||
|
||||
@BIND9_MAKE_RULES@
|
||||
|
||||
zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
|
||||
|
||||
zonetodb@EXEEXT@: zonetodb.@O@ ${DEPLIBS}
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
|
||||
|
||||
clean distclean manclean maintainer-clean::
|
||||
rm -f ${TARGETS} ${OBJS}
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
|
||||
|
||||
install:: ${TARGETS} installdirs
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
|
68
bind-9.3.2-redhat_doc.patch
Normal file
68
bind-9.3.2-redhat_doc.patch
Normal file
@ -0,0 +1,68 @@
|
||||
diff --git a/bin/named/named.8 b/bin/named/named.8
|
||||
index ef10ef4..3150b22 100644
|
||||
--- a/bin/named/named.8
|
||||
+++ b/bin/named/named.8
|
||||
@@ -349,6 +349,63 @@ The default configuration file\&.
|
||||
/var/run/named/named\&.pid
|
||||
.RS 4
|
||||
The default process\-id file\&.
|
||||
+.PP
|
||||
+.SH "NOTES"
|
||||
+.PP
|
||||
+.TP
|
||||
+\fBRed Hat SELinux BIND Security Profile:\fR
|
||||
+.PP
|
||||
+By default, Red Hat ships BIND with the most secure SELinux policy
|
||||
+that will not prevent normal BIND operation and will prevent exploitation
|
||||
+of all known BIND security vulnerabilities . See the selinux(8) man page
|
||||
+for information about SElinux.
|
||||
+.PP
|
||||
+It is not necessary to run named in a chroot environment if the Red Hat
|
||||
+SELinux policy for named is enabled. When enabled, this policy is far
|
||||
+more secure than a chroot environment. Users are recommended to enable
|
||||
+SELinux and remove the bind-chroot package.
|
||||
+.PP
|
||||
+With this extra security comes some restrictions:
|
||||
+.PP
|
||||
+By default, the SELinux policy does not allow named to write any master
|
||||
+zone database files. Only the root user may create files in the $ROOTDIR/var/named
|
||||
+zone database file directory (the options { "directory" } option), where
|
||||
+$ROOTDIR is set in /etc/sysconfig/named.
|
||||
+.PP
|
||||
+The "named" group must be granted read privelege to
|
||||
+these files in order for named to be enabled to read them.
|
||||
+.PP
|
||||
+Any file created in the zone database file directory is automatically assigned
|
||||
+the SELinux file context named_zone_t .
|
||||
+.PP
|
||||
+By default, SELinux prevents any role from modifying named_zone_t files; this
|
||||
+means that files in the zone database directory cannot be modified by dynamic
|
||||
+DNS (DDNS) updates or zone transfers.
|
||||
+.PP
|
||||
+The Red Hat BIND distribution and SELinux policy creates three directories where
|
||||
+named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
|
||||
+/var/named/data. By placing files you want named to modify, such as
|
||||
+slave or DDNS updateable zone files and database / statistics dump files in
|
||||
+these directories, named will work normally and no further operator action is
|
||||
+required. Files in these directories are automatically assigned the 'named_cache_t'
|
||||
+file context, which SELinux allows named to write.
|
||||
+.PP
|
||||
+\fBRed Hat BIND SDB support:\fR
|
||||
+.PP
|
||||
+Red Hat ships named with compiled in Simplified Database Backend modules that ISC
|
||||
+provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them
|
||||
+.PP
|
||||
+The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into named-sdb.
|
||||
+.PP
|
||||
+See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
|
||||
+.br
|
||||
+.PP
|
||||
+\fBRed Hat system-config-bind:\fR
|
||||
+.PP
|
||||
+Red Hat provides the system-config-bind GUI to configure named.conf and zone
|
||||
+database files. Run the "system-config-bind" command and access the manual
|
||||
+by selecting the Help menu.
|
||||
+.PP
|
||||
.RE
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
511
bind-9.3.2b1-fix_sdb_ldap.patch
Normal file
511
bind-9.3.2b1-fix_sdb_ldap.patch
Normal file
@ -0,0 +1,511 @@
|
||||
diff --git a/bin/sdb_tools/Makefile.in b/bin/sdb_tools/Makefile.in
|
||||
index 95ab742..5059a17 100644
|
||||
--- a/bin/sdb_tools/Makefile.in
|
||||
+++ b/bin/sdb_tools/Makefile.in
|
||||
@@ -32,11 +32,11 @@ DEPLIBS = ${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
|
||||
LIBS = ${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
|
||||
${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} ${DBDRIVER_LIBS} @LIBS@
|
||||
|
||||
-TARGETS = zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@
|
||||
+TARGETS = zone2ldap@EXEEXT@ zonetodb@EXEEXT@ zone2sqlite@EXEEXT@ ldap2zone@EXEEXT@
|
||||
|
||||
-OBJS = zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@
|
||||
+OBJS = zone2ldap.@O@ zonetodb.@O@ zone2sqlite.@O@ ldap2zone.@O@
|
||||
|
||||
-SRCS = zone2ldap.c zonetodb.c zone2sqlite.c
|
||||
+SRCS = zone2ldap.c zonetodb.c zone2sqlite.c ldap2zone.c
|
||||
|
||||
MANPAGES = zone2ldap.1
|
||||
|
||||
@@ -47,6 +47,9 @@ EXT_CFLAGS =
|
||||
zone2ldap@EXEEXT@: zone2ldap.@O@ ${DEPLIBS}
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zone2ldap.@O@ -lldap -llber ${LIBS}
|
||||
|
||||
+ldap2zone@EXEEXT@: ldap2zone.@O@ ${DEPLIBS}
|
||||
+ ${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ldap2zone.@O@ -lldap -llber ${LIBS}
|
||||
+
|
||||
zonetodb@EXEEXT@: zonetodb.@O@ ${DEPLIBS}
|
||||
${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ zonetodb.@O@ -lpq ${LIBS}
|
||||
|
||||
@@ -64,4 +67,5 @@ install:: ${TARGETS} installdirs
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2ldap@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zonetodb@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ldap2zone@EXEEXT@ ${DESTDIR}${sbindir}
|
||||
${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
|
||||
diff --git a/bin/sdb_tools/zone2ldap.c b/bin/sdb_tools/zone2ldap.c
|
||||
index e0e9207..d59936c 100644
|
||||
--- a/bin/sdb_tools/zone2ldap.c
|
||||
+++ b/bin/sdb_tools/zone2ldap.c
|
||||
@@ -73,7 +73,7 @@ void add_ldap_values (ldap_info * ldinfo);
|
||||
void init_ldap_conn (void);
|
||||
|
||||
/* Ldap error checking */
|
||||
-void ldap_result_check (const char *msg, char *dn, int err);
|
||||
+void ldap_result_check (const char *msg, const char *dn, int err);
|
||||
|
||||
/* Put a hostname into a char ** array */
|
||||
char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
|
||||
@@ -82,7 +82,7 @@ char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
|
||||
int get_attr_list_size (char **tmp);
|
||||
|
||||
/* Get a DN */
|
||||
-char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag);
|
||||
+char *build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone);
|
||||
|
||||
/* Add to RR list */
|
||||
void add_to_rr_list (char *dn, char *name, char *type, char *data,
|
||||
@@ -104,11 +104,26 @@ void
|
||||
init_ldap_conn ();
|
||||
void usage();
|
||||
|
||||
-char *argzone, *ldapbase, *binddn, *bindpw = NULL;
|
||||
-const char *ldapsystem = "localhost";
|
||||
-static const char *objectClasses[] =
|
||||
- { "top", "dNSZone", NULL };
|
||||
-static const char *topObjectClasses[] = { "top", NULL };
|
||||
+static char *argzone, *ldapbase, *binddn, *bindpw = NULL;
|
||||
+
|
||||
+/* these are needed to placate gcc4's const-ness const-ernations : */
|
||||
+static char localhost[] = "localhost";
|
||||
+static char *ldapsystem=&(localhost[0]);
|
||||
+/* dnszone schema class names: */
|
||||
+static char topClass [] ="top";
|
||||
+static char dNSZoneClass[] ="dNSZone";
|
||||
+static char objectClass [] ="objectClass";
|
||||
+static char dcObjectClass[]="dcObject";
|
||||
+/* dnszone schema attribute names: */
|
||||
+static char relativeDomainName[]="relativeDomainName";
|
||||
+static char dNSTTL []="dNSTTL";
|
||||
+static char zoneName []="zoneName";
|
||||
+static char dc []="dc";
|
||||
+static char sameZone []="@";
|
||||
+/* LDAPMod mod_values: */
|
||||
+static char *objectClasses []= { &(topClass[0]), &(dNSZoneClass[0]), NULL };
|
||||
+static char *topObjectClasses []= { &(topClass[0]), &(dcObjectClass[0]), &(dNSZoneClass[0]), NULL };
|
||||
+static char *dn_buffer [64]={NULL};
|
||||
LDAP *conn;
|
||||
unsigned int debug = 0;
|
||||
|
||||
@@ -120,7 +135,7 @@ static void
|
||||
fatal(const char *msg) {
|
||||
perror(msg);
|
||||
if (conn != NULL)
|
||||
- ldap_unbind_s(conn);
|
||||
+ ldap_unbind_ext_s(conn, NULL, NULL);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
@@ -132,12 +147,13 @@ main (int argc, char **argv)
|
||||
isc_result_t result;
|
||||
char *basedn;
|
||||
ldap_info *tmp;
|
||||
- LDAPMod *base_attrs[2];
|
||||
- LDAPMod base;
|
||||
+ LDAPMod *base_attrs[5];
|
||||
+ LDAPMod base, dcBase, znBase, rdnBase;
|
||||
isc_buffer_t buff;
|
||||
char *zonefile=0L;
|
||||
char fullbasedn[1024];
|
||||
char *ctmp;
|
||||
+ char *zn, *dcp[2], *znp[2], *rdn[2];
|
||||
dns_fixedname_t fixedzone, fixedname;
|
||||
dns_rdataset_t rdataset;
|
||||
char **dc_list;
|
||||
@@ -150,7 +166,7 @@ main (int argc, char **argv)
|
||||
extern char *optarg;
|
||||
extern int optind, opterr, optopt;
|
||||
int create_base = 0;
|
||||
- int topt;
|
||||
+ int topt, dcn, zdn, znlen;
|
||||
|
||||
if (argc < 2)
|
||||
{
|
||||
@@ -158,7 +174,7 @@ main (int argc, char **argv)
|
||||
exit (-1);
|
||||
}
|
||||
|
||||
- while ((topt = getopt (argc, argv, "D:w:b:z:f:h:?dcv")) != -1)
|
||||
+ while ((topt = getopt (argc, argv, "D:Ww:b:z:f:h:?dcv")) != -1)
|
||||
{
|
||||
switch (topt)
|
||||
{
|
||||
@@ -181,6 +197,9 @@ main (int argc, char **argv)
|
||||
if (bindpw == NULL)
|
||||
fatal("strdup");
|
||||
break;
|
||||
+ case 'W':
|
||||
+ bindpw = getpass("Enter LDAP Password: ");
|
||||
+ break;
|
||||
case 'b':
|
||||
ldapbase = strdup (optarg);
|
||||
if (ldapbase == NULL)
|
||||
@@ -302,17 +321,51 @@ main (int argc, char **argv)
|
||||
printf ("Creating base zone DN %s\n", argzone);
|
||||
|
||||
dc_list = hostname_to_dn_list (argzone, argzone, DNS_TOP);
|
||||
- basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC);
|
||||
+ basedn = build_dn_from_dc_list (dc_list, 0, NO_SPEC, argzone);
|
||||
+ if (debug)
|
||||
+ printf ("base DN %s\n", basedn);
|
||||
|
||||
- for (ctmp = &basedn[strlen (basedn)]; ctmp >= &basedn[0]; ctmp--)
|
||||
+ for (ctmp = &basedn[strlen (basedn)], dcn=0; ctmp >= &basedn[0]; ctmp--)
|
||||
{
|
||||
if ((*ctmp == ',') || (ctmp == &basedn[0]))
|
||||
{
|
||||
base.mod_op = LDAP_MOD_ADD;
|
||||
- base.mod_type = (char*)"objectClass";
|
||||
+ base.mod_type = objectClass;
|
||||
base.mod_values = (char**)topObjectClasses;
|
||||
base_attrs[0] = (void*)&base;
|
||||
- base_attrs[1] = NULL;
|
||||
+
|
||||
+ dcBase.mod_op = LDAP_MOD_ADD;
|
||||
+ dcBase.mod_type = dc;
|
||||
+ dcp[0]=dc_list[dcn];
|
||||
+ dcp[1]=0L;
|
||||
+ dcBase.mod_values=dcp;
|
||||
+ base_attrs[1] = (void*)&dcBase;
|
||||
+
|
||||
+ znBase.mod_op = LDAP_MOD_ADD;
|
||||
+ znBase.mod_type = zoneName;
|
||||
+ for( zdn = dcn, znlen = 0; zdn >= 0; zdn-- )
|
||||
+ znlen += strlen(dc_list[zdn])+1;
|
||||
+ znp[0] = (char*)malloc(znlen+1);
|
||||
+ znp[1] = 0L;
|
||||
+ for( zdn = dcn, zn=znp[0]; zdn >= 0; zdn-- )
|
||||
+ zn+=sprintf(zn,"%s%s",dc_list[zdn],
|
||||
+ ((zdn > 0) && (*(dc_list[zdn-1])!='.')) ? "." : ""
|
||||
+ );
|
||||
+
|
||||
+ znBase.mod_values = znp;
|
||||
+ base_attrs[2] = (void*)&znBase;
|
||||
+
|
||||
+ rdnBase.mod_op = LDAP_MOD_ADD;
|
||||
+ rdnBase.mod_type = relativeDomainName;
|
||||
+ rdn[0] = strdup(sameZone);
|
||||
+ rdn[1] = 0L;
|
||||
+ rdnBase.mod_values = rdn;
|
||||
+ base_attrs[3] = (void*)&rdnBase;
|
||||
+
|
||||
+ dcn++;
|
||||
+
|
||||
+ base.mod_values = topObjectClasses;
|
||||
+ base_attrs[4] = NULL;
|
||||
|
||||
if (ldapbase)
|
||||
{
|
||||
@@ -329,6 +382,10 @@ main (int argc, char **argv)
|
||||
else
|
||||
sprintf (fullbasedn, "%s", ctmp);
|
||||
}
|
||||
+
|
||||
+ if( debug )
|
||||
+ printf("Full base dn: %s\n", fullbasedn);
|
||||
+
|
||||
result = ldap_add_s (conn, fullbasedn, base_attrs);
|
||||
ldap_result_check ("initial ldap_add_s", fullbasedn, result);
|
||||
}
|
||||
@@ -408,14 +465,14 @@ generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata, unsigned int ttl)
|
||||
isc_result_check (result, "dns_rdata_totext");
|
||||
data[isc_buffer_usedlength (&buff)] = 0;
|
||||
|
||||
- dc_list = hostname_to_dn_list (name, argzone, DNS_OBJECT);
|
||||
+ dc_list = hostname_to_dn_list ((char*)name, argzone, DNS_OBJECT);
|
||||
len = (get_attr_list_size (dc_list) - 2);
|
||||
- dn = build_dn_from_dc_list (dc_list, ttl, WI_SPEC);
|
||||
+ dn = build_dn_from_dc_list (dc_list, ttl, WI_SPEC, argzone);
|
||||
|
||||
if (debug)
|
||||
printf ("Adding %s (%s %s) to run queue list.\n", dn, type, data);
|
||||
|
||||
- add_to_rr_list (dn, dc_list[len], type, data, ttl, DNS_OBJECT);
|
||||
+ add_to_rr_list (dn, dc_list[len], (char*)type, (char*)data, ttl, DNS_OBJECT);
|
||||
}
|
||||
|
||||
|
||||
@@ -455,7 +512,8 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
int attrlist;
|
||||
char ldap_type_buffer[128];
|
||||
char charttl[64];
|
||||
-
|
||||
+ char *zn;
|
||||
+ int znlen;
|
||||
|
||||
if ((tmp = locate_by_dn (dn)) == NULL)
|
||||
{
|
||||
@@ -482,10 +540,10 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
fatal("malloc");
|
||||
}
|
||||
tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
|
||||
- tmp->attrs[0]->mod_type = (char*)"objectClass";
|
||||
+ tmp->attrs[0]->mod_type = objectClass;
|
||||
|
||||
if (flags == DNS_OBJECT)
|
||||
- tmp->attrs[0]->mod_values = (char**)objectClasses;
|
||||
+ tmp->attrs[0]->mod_values = objectClasses;
|
||||
else
|
||||
{
|
||||
tmp->attrs[0]->mod_values = (char**)topObjectClasses;
|
||||
@@ -497,7 +555,7 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
}
|
||||
|
||||
tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
|
||||
- tmp->attrs[1]->mod_type = (char*)"relativeDomainName";
|
||||
+ tmp->attrs[1]->mod_type = relativeDomainName;
|
||||
tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
|
||||
|
||||
if (tmp->attrs[1]->mod_values == (char **)NULL)
|
||||
@@ -526,7 +584,7 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
fatal("strdup");
|
||||
|
||||
tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
|
||||
- tmp->attrs[3]->mod_type = (char*)"dNSTTL";
|
||||
+ tmp->attrs[3]->mod_type = dNSTTL;
|
||||
tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
|
||||
|
||||
if (tmp->attrs[3]->mod_values == (char **)NULL)
|
||||
@@ -539,14 +597,25 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
if (tmp->attrs[3]->mod_values[0] == NULL)
|
||||
fatal("strdup");
|
||||
|
||||
+ znlen=strlen(gbl_zone);
|
||||
+ if ( gbl_zone[znlen-1] == '.' )
|
||||
+ { /* ldapdb MUST search by relative zone name */
|
||||
+ zn = (char*)malloc(znlen);
|
||||
+ memcpy(zn, gbl_zone, znlen-1);
|
||||
+ zn[znlen-1]='\0';
|
||||
+ }else
|
||||
+ {
|
||||
+ zn = gbl_zone;
|
||||
+ }
|
||||
+
|
||||
tmp->attrs[4]->mod_op = LDAP_MOD_ADD;
|
||||
- tmp->attrs[4]->mod_type = (char*)"zoneName";
|
||||
+ tmp->attrs[4]->mod_type = zoneName;
|
||||
tmp->attrs[4]->mod_values = (char **)calloc(sizeof(char *), 2);
|
||||
|
||||
if (tmp->attrs[4]->mod_values == (char **)NULL)
|
||||
fatal("calloc");
|
||||
|
||||
- tmp->attrs[4]->mod_values[0] = gbl_zone;
|
||||
+ tmp->attrs[4]->mod_values[0] = zn;
|
||||
tmp->attrs[4]->mod_values[1] = NULL;
|
||||
|
||||
tmp->attrs[5] = NULL;
|
||||
@@ -557,7 +626,7 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
else
|
||||
{
|
||||
|
||||
- for (i = 0; tmp->attrs[i] != NULL; i++)
|
||||
+ for (i = 0; tmp->attrs[i] != NULL; i++)
|
||||
{
|
||||
sprintf (ldap_type_buffer, "%sRecord", type);
|
||||
if (!strncmp
|
||||
@@ -631,44 +700,70 @@ char **
|
||||
hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
|
||||
{
|
||||
char *tmp;
|
||||
- static char *dn_buffer[64];
|
||||
int i = 0;
|
||||
- char *zname;
|
||||
- char *hnamebuff;
|
||||
-
|
||||
- zname = strdup (hostname);
|
||||
- if (zname == NULL)
|
||||
- fatal("strdup");
|
||||
-
|
||||
- if (flags == DNS_OBJECT)
|
||||
- {
|
||||
-
|
||||
- if (strlen (zname) != strlen (zone))
|
||||
- {
|
||||
- tmp = &zname[strlen (zname) - strlen (zone)];
|
||||
- *--tmp = '\0';
|
||||
- hnamebuff = strdup (zname);
|
||||
- if (hnamebuff == NULL)
|
||||
- fatal("strdup");
|
||||
- zname = ++tmp;
|
||||
- }
|
||||
- else
|
||||
- hnamebuff = (char*)"@";
|
||||
- }
|
||||
- else
|
||||
- {
|
||||
- zname = zone;
|
||||
- hnamebuff = NULL;
|
||||
- }
|
||||
-
|
||||
- for (tmp = strrchr (zname, '.'); tmp != (char *) 0;
|
||||
- tmp = strrchr (zname, '.'))
|
||||
- {
|
||||
- *tmp++ = '\0';
|
||||
- dn_buffer[i++] = tmp;
|
||||
- }
|
||||
- dn_buffer[i++] = zname;
|
||||
- dn_buffer[i++] = hnamebuff;
|
||||
+ char *hname=0L, *last=0L;
|
||||
+ int hlen=strlen(hostname), zlen=(strlen(zone));
|
||||
+
|
||||
+/* printf("hostname: %s zone: %s\n",hostname, zone); */
|
||||
+ hname=0L;
|
||||
+ if(flags == DNS_OBJECT)
|
||||
+ {
|
||||
+ if( (zone[ zlen - 1 ] == '.') && (hostname[hlen - 1] != '.') )
|
||||
+ {
|
||||
+ hname=(char*)malloc(hlen + 1);
|
||||
+ hlen += 1;
|
||||
+ sprintf(hname, "%s.", hostname);
|
||||
+ hostname = hname;
|
||||
+ }
|
||||
+ if(strcmp(hostname, zone) == 0)
|
||||
+ {
|
||||
+ if( hname == 0 )
|
||||
+ hname=strdup(hostname);
|
||||
+ last = strdup(sameZone);
|
||||
+ }else
|
||||
+ {
|
||||
+ if( (hlen < zlen)
|
||||
+ ||( strcmp( hostname + (hlen - zlen), zone ) != 0)
|
||||
+ )
|
||||
+ {
|
||||
+ if( hname != 0 )
|
||||
+ free(hname);
|
||||
+ hname=(char*)malloc( hlen + zlen + 1);
|
||||
+ if( *zone == '.' )
|
||||
+ sprintf(hname, "%s%s", hostname, zone);
|
||||
+ else
|
||||
+ sprintf(hname,"%s",zone);
|
||||
+ }else
|
||||
+ {
|
||||
+ if( hname == 0 )
|
||||
+ hname = strdup(hostname);
|
||||
+ }
|
||||
+ last = hname;
|
||||
+ }
|
||||
+ }else
|
||||
+ { /* flags == DNS_TOP */
|
||||
+ hname = strdup(zone);
|
||||
+ last = hname;
|
||||
+ }
|
||||
+
|
||||
+ for (tmp = strrchr (hname, '.'); tmp != (char *) 0;
|
||||
+ tmp = strrchr (hname, '.'))
|
||||
+ {
|
||||
+ if( *( tmp + 1 ) != '\0' )
|
||||
+ {
|
||||
+ *tmp = '\0';
|
||||
+ dn_buffer[i++] = ++tmp;
|
||||
+ }else
|
||||
+ { /* trailing '.' ! */
|
||||
+ dn_buffer[i++] = strdup(".");
|
||||
+ *tmp = '\0';
|
||||
+ if( tmp == hname )
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+ if( ( last != hname ) && (tmp != hname) )
|
||||
+ dn_buffer[i++] = hname;
|
||||
+ dn_buffer[i++] = last;
|
||||
dn_buffer[i] = NULL;
|
||||
|
||||
return dn_buffer;
|
||||
@@ -680,30 +775,38 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
|
||||
* exception of "@"/SOA. */
|
||||
|
||||
char *
|
||||
-build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag)
|
||||
+build_dn_from_dc_list (char **dc_list, unsigned int ttl, int flag, char *zone)
|
||||
{
|
||||
int size;
|
||||
- int x;
|
||||
- static char dn[1024];
|
||||
- char tmp[128];
|
||||
+ int x, znlen;
|
||||
+ static char dn[DNS_NAME_MAXTEXT*3/2];
|
||||
+ char tmp[DNS_NAME_MAXTEXT*3/2];
|
||||
+ char zn[DNS_NAME_MAXTEXT+1];
|
||||
|
||||
bzero (tmp, sizeof (tmp));
|
||||
bzero (dn, sizeof (dn));
|
||||
size = get_attr_list_size (dc_list);
|
||||
+ znlen = strlen(zone);
|
||||
+ if ( zone[znlen-1] == '.' )
|
||||
+ { /* ldapdb MUST search by relative zone name */
|
||||
+ memcpy(&(zn[0]),zone,znlen-1);
|
||||
+ zn[znlen-1]='\0';
|
||||
+ zone = zn;
|
||||
+ }
|
||||
for (x = size - 2; x > 0; x--)
|
||||
{
|
||||
if (flag == WI_SPEC)
|
||||
{
|
||||
if (x == (size - 2) && (strncmp (dc_list[x], "@", 1) == 0) && (ttl))
|
||||
- sprintf (tmp, "relativeDomainName=%s + dNSTTL=%u,", dc_list[x], ttl);
|
||||
+ snprintf (tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
|
||||
else if (x == (size - 2))
|
||||
- sprintf(tmp, "relativeDomainName=%s,",dc_list[x]);
|
||||
+ snprintf(tmp, sizeof(tmp), "zoneName=%s + relativeDomainName=%s,", zone, dc_list[x]);
|
||||
else
|
||||
- sprintf(tmp,"dc=%s,", dc_list[x]);
|
||||
+ snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
|
||||
}
|
||||
else
|
||||
{
|
||||
- sprintf(tmp, "dc=%s,", dc_list[x]);
|
||||
+ snprintf(tmp, sizeof(tmp), "dc=%s,", dc_list[x]);
|
||||
}
|
||||
|
||||
|
||||
@@ -732,19 +835,18 @@ init_ldap_conn ()
|
||||
}
|
||||
|
||||
result = ldap_simple_bind_s (conn, binddn, bindpw);
|
||||
- ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
|
||||
+ ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
|
||||
}
|
||||
|
||||
/* Like isc_result_check, only for LDAP */
|
||||
void
|
||||
-ldap_result_check (const char *msg, char *dn, int err)
|
||||
+ldap_result_check (const char *msg, const char *dn, int err)
|
||||
{
|
||||
if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
|
||||
{
|
||||
- fprintf(stderr, "Error while adding %s (%s):\n",
|
||||
- dn, msg);
|
||||
- ldap_perror (conn, dn);
|
||||
- ldap_unbind_s (conn);
|
||||
+ fprintf(stderr, "Error while adding %s (%s):\n%s",
|
||||
+ dn, msg, ldap_err2string(err));
|
||||
+ ldap_unbind_ext_s (conn, NULL, NULL);
|
||||
exit (-1);
|
||||
}
|
||||
}
|
||||
@@ -758,16 +860,15 @@ add_ldap_values (ldap_info * ldinfo)
|
||||
int result;
|
||||
char dnbuffer[1024];
|
||||
|
||||
-
|
||||
if (ldapbase != NULL)
|
||||
sprintf (dnbuffer, "%s,%s", ldinfo->dn, ldapbase);
|
||||
else
|
||||
sprintf (dnbuffer, "%s", ldinfo->dn);
|
||||
|
||||
result = ldap_add_s (conn, dnbuffer, ldinfo->attrs);
|
||||
- ldap_result_check ("ldap_add_s", dnbuffer, result);
|
||||
-}
|
||||
+ ldap_result_check ("ldap_add_s", dnbuffer, result);
|
||||
|
||||
+}
|
||||
|
||||
|
||||
|
||||
@@ -776,5 +877,5 @@ void
|
||||
usage ()
|
||||
{
|
||||
fprintf (stderr,
|
||||
- "zone2ldap -D [BIND DN] -w [BIND PASSWORD] -b [BASE DN] -z [ZONE] -f [ZONE FILE] -h [LDAP HOST] "
|
||||
+ "zone2ldap -D [BIND DN] [-w BIND PASSWORD | -W:prompt] -b [BASE DN] -z [ZONE] -f [ZONE FILE] -h [LDAP HOST] "
|
||||
"[-c Create LDAP Base structure][-d Debug Output (lots !)] \n ");}
|
230
bind-9.3.2b2-sdbsrc.patch
Normal file
230
bind-9.3.2b2-sdbsrc.patch
Normal file
@ -0,0 +1,230 @@
|
||||
diff --git a/contrib/sdb/bdb/bdb.c b/contrib/sdb/bdb/bdb.c
|
||||
index 23594bb..b3c6619 100644
|
||||
--- a/contrib/sdb/bdb/bdb.c
|
||||
+++ b/contrib/sdb/bdb/bdb.c
|
||||
@@ -43,7 +43,7 @@
|
||||
#include <dns/lib.h>
|
||||
#include <dns/ttl.h>
|
||||
|
||||
-#include <named/bdb.h>
|
||||
+#include "bdb.h"
|
||||
#include <named/globals.h>
|
||||
#include <named/config.h>
|
||||
|
||||
diff --git a/contrib/sdb/ldap/zone2ldap.c b/contrib/sdb/ldap/zone2ldap.c
|
||||
index 07c89bc..23dd873 100644
|
||||
--- a/contrib/sdb/ldap/zone2ldap.c
|
||||
+++ b/contrib/sdb/ldap/zone2ldap.c
|
||||
@@ -63,16 +63,16 @@ typedef struct LDAP_INFO
|
||||
ldap_info;
|
||||
|
||||
/* usage Info */
|
||||
-void usage ();
|
||||
+void usage (void);
|
||||
|
||||
/* Add to the ldap dit */
|
||||
void add_ldap_values (ldap_info * ldinfo);
|
||||
|
||||
/* Init an ldap connection */
|
||||
-void init_ldap_conn ();
|
||||
+void init_ldap_conn (void);
|
||||
|
||||
/* Ldap error checking */
|
||||
-void ldap_result_check (char *msg, char *dn, int err);
|
||||
+void ldap_result_check (const char *msg, char *dn, int err);
|
||||
|
||||
/* Put a hostname into a char ** array */
|
||||
char **hostname_to_dn_list (char *hostname, char *zone, unsigned int flags);
|
||||
@@ -88,7 +88,7 @@ void add_to_rr_list (char *dn, char *name, char *type, char *data,
|
||||
unsigned int ttl, unsigned int flags);
|
||||
|
||||
/* Error checking */
|
||||
-void isc_result_check (isc_result_t res, char *errorstr);
|
||||
+void isc_result_check (isc_result_t res, const char *errorstr);
|
||||
|
||||
/* Generate LDIF Format files */
|
||||
void generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata,
|
||||
@@ -97,11 +97,17 @@ void generate_ldap (dns_name_t * dnsname, dns_rdata_t * rdata,
|
||||
/* head pointer to the list */
|
||||
ldap_info *ldap_info_base = NULL;
|
||||
|
||||
+ldap_info *
|
||||
+locate_by_dn (char *dn);
|
||||
+void
|
||||
+init_ldap_conn ();
|
||||
+void usage();
|
||||
+
|
||||
char *argzone, *ldapbase, *binddn, *bindpw = NULL;
|
||||
-char *ldapsystem = "localhost";
|
||||
-static char *objectClasses[] =
|
||||
+const char *ldapsystem = "localhost";
|
||||
+static const char *objectClasses[] =
|
||||
{ "top", "dNSZone", NULL };
|
||||
-static char *topObjectClasses[] = { "top", NULL };
|
||||
+static const char *topObjectClasses[] = { "top", NULL };
|
||||
LDAP *conn;
|
||||
unsigned int debug = 0;
|
||||
|
||||
@@ -128,7 +134,7 @@ main (int argc, char **argv)
|
||||
LDAPMod *base_attrs[2];
|
||||
LDAPMod base;
|
||||
isc_buffer_t buff;
|
||||
- char *zonefile;
|
||||
+ char *zonefile=0L;
|
||||
char fullbasedn[1024];
|
||||
char *ctmp;
|
||||
dns_fixedname_t fixedzone, fixedname;
|
||||
@@ -304,9 +310,9 @@ main (int argc, char **argv)
|
||||
if ((*ctmp == ',') || (ctmp == &basedn[0]))
|
||||
{
|
||||
base.mod_op = LDAP_MOD_ADD;
|
||||
- base.mod_type = "objectClass";
|
||||
- base.mod_values = topObjectClasses;
|
||||
- base_attrs[0] = &base;
|
||||
+ base.mod_type = (char*)"objectClass";
|
||||
+ base.mod_values = (char**)topObjectClasses;
|
||||
+ base_attrs[0] = (void*)&base;
|
||||
base_attrs[1] = NULL;
|
||||
|
||||
if (ldapbase)
|
||||
@@ -363,7 +369,7 @@ main (int argc, char **argv)
|
||||
* I should probably rename this function, as not to cause any
|
||||
* confusion with the isc* routines. Will exit on error. */
|
||||
void
|
||||
-isc_result_check (isc_result_t res, char *errorstr)
|
||||
+isc_result_check (isc_result_t res, const char *errorstr)
|
||||
{
|
||||
if (res != ISC_R_SUCCESS)
|
||||
{
|
||||
@@ -470,20 +476,20 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
if (tmp->attrs == (LDAPMod **) NULL)
|
||||
fatal("calloc");
|
||||
|
||||
- for (i = 0; i < flags; i++)
|
||||
+ for (i = 0; i < (int)flags; i++)
|
||||
{
|
||||
tmp->attrs[i] = (LDAPMod *) malloc (sizeof (LDAPMod));
|
||||
if (tmp->attrs[i] == (LDAPMod *) NULL)
|
||||
fatal("malloc");
|
||||
}
|
||||
tmp->attrs[0]->mod_op = LDAP_MOD_ADD;
|
||||
- tmp->attrs[0]->mod_type = "objectClass";
|
||||
+ tmp->attrs[0]->mod_type = (char*)"objectClass";
|
||||
|
||||
if (flags == DNS_OBJECT)
|
||||
- tmp->attrs[0]->mod_values = objectClasses;
|
||||
+ tmp->attrs[0]->mod_values = (char**)objectClasses;
|
||||
else
|
||||
{
|
||||
- tmp->attrs[0]->mod_values = topObjectClasses;
|
||||
+ tmp->attrs[0]->mod_values = (char**)topObjectClasses;
|
||||
tmp->attrs[1] = NULL;
|
||||
tmp->attrcnt = 2;
|
||||
tmp->next = ldap_info_base;
|
||||
@@ -492,7 +498,7 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
}
|
||||
|
||||
tmp->attrs[1]->mod_op = LDAP_MOD_ADD;
|
||||
- tmp->attrs[1]->mod_type = "relativeDomainName";
|
||||
+ tmp->attrs[1]->mod_type = (char*)"relativeDomainName";
|
||||
tmp->attrs[1]->mod_values = (char **) calloc (sizeof (char *), 2);
|
||||
|
||||
if (tmp->attrs[1]->mod_values == (char **)NULL)
|
||||
@@ -521,7 +527,7 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
fatal("strdup");
|
||||
|
||||
tmp->attrs[3]->mod_op = LDAP_MOD_ADD;
|
||||
- tmp->attrs[3]->mod_type = "dNSTTL";
|
||||
+ tmp->attrs[3]->mod_type = (char*)"dNSTTL";
|
||||
tmp->attrs[3]->mod_values = (char **) calloc (sizeof (char *), 2);
|
||||
|
||||
if (tmp->attrs[3]->mod_values == (char **)NULL)
|
||||
@@ -535,7 +541,7 @@ add_to_rr_list (char *dn, char *name, char *type,
|
||||
fatal("strdup");
|
||||
|
||||
tmp->attrs[4]->mod_op = LDAP_MOD_ADD;
|
||||
- tmp->attrs[4]->mod_type = "zoneName";
|
||||
+ tmp->attrs[4]->mod_type = (char*)"zoneName";
|
||||
tmp->attrs[4]->mod_values = (char **)calloc(sizeof(char *), 2);
|
||||
|
||||
if (tmp->attrs[4]->mod_values == (char **)NULL)
|
||||
@@ -648,7 +654,7 @@ hostname_to_dn_list (char *hostname, char *zone, unsigned int flags)
|
||||
zname = ++tmp;
|
||||
}
|
||||
else
|
||||
- hnamebuff = "@";
|
||||
+ hnamebuff = (char*)"@";
|
||||
}
|
||||
else
|
||||
{
|
||||
@@ -727,12 +733,12 @@ init_ldap_conn ()
|
||||
}
|
||||
|
||||
result = ldap_simple_bind_s (conn, binddn, bindpw);
|
||||
- ldap_result_check ("ldap_simple_bind_s", "LDAP Bind", result);
|
||||
+ ldap_result_check ("ldap_simple_bind_s", (char*)"LDAP Bind", result);
|
||||
}
|
||||
|
||||
/* Like isc_result_check, only for LDAP */
|
||||
void
|
||||
-ldap_result_check (char *msg, char *dn, int err)
|
||||
+ldap_result_check (const char *msg, char *dn, int err)
|
||||
{
|
||||
if ((err != LDAP_SUCCESS) && (err != LDAP_ALREADY_EXISTS))
|
||||
{
|
||||
diff --git a/contrib/sdb/pgsql/pgsqldb.c b/contrib/sdb/pgsql/pgsqldb.c
|
||||
index 50d3cba..516eb9f 100644
|
||||
--- a/contrib/sdb/pgsql/pgsqldb.c
|
||||
+++ b/contrib/sdb/pgsql/pgsqldb.c
|
||||
@@ -23,7 +23,7 @@
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#include <pgsql/libpq-fe.h>
|
||||
+#include <libpq-fe.h>
|
||||
|
||||
#include <isc/mem.h>
|
||||
#include <isc/print.h>
|
||||
diff --git a/contrib/sdb/pgsql/zonetodb.c b/contrib/sdb/pgsql/zonetodb.c
|
||||
index b8f5912..ff2d135 100644
|
||||
--- a/contrib/sdb/pgsql/zonetodb.c
|
||||
+++ b/contrib/sdb/pgsql/zonetodb.c
|
||||
@@ -37,7 +37,7 @@
|
||||
#include <dns/rdatatype.h>
|
||||
#include <dns/result.h>
|
||||
|
||||
-#include <pgsql/libpq-fe.h>
|
||||
+#include <libpq-fe.h>
|
||||
|
||||
/*
|
||||
* Generate a PostgreSQL table from a zone.
|
||||
@@ -54,6 +54,9 @@ char *dbname, *dbtable;
|
||||
char str[10240];
|
||||
|
||||
void
|
||||
+closeandexit(int status);
|
||||
+
|
||||
+void
|
||||
closeandexit(int status) {
|
||||
if (conn != NULL)
|
||||
PQfinish(conn);
|
||||
@@ -61,6 +64,9 @@ closeandexit(int status) {
|
||||
}
|
||||
|
||||
void
|
||||
+check_result(isc_result_t result, const char *message);
|
||||
+
|
||||
+void
|
||||
check_result(isc_result_t result, const char *message) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "%s: %s\n", message,
|
||||
@@ -84,7 +90,8 @@ quotestring(const unsigned char *source, unsigned char *dest) {
|
||||
}
|
||||
*dest++ = 0;
|
||||
}
|
||||
-
|
||||
+void
|
||||
+addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata);
|
||||
void
|
||||
addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) {
|
||||
unsigned char namearray[DNS_NAME_MAXTEXT + 1];
|
27
bind-9.5-PIE.patch
Normal file
27
bind-9.5-PIE.patch
Normal file
@ -0,0 +1,27 @@
|
||||
--- bind-9.5.0b2/bin/named/Makefile.in.pie 2008-02-11 17:21:47.000000000 +0100
|
||||
+++ bind-9.5.0b2/bin/named/Makefile.in 2008-02-11 17:22:10.000000000 +0100
|
||||
@@ -100,8 +100,12 @@ HTMLPAGES = named.html lwresd.html named
|
||||
|
||||
MANOBJS = ${MANPAGES} ${HTMLPAGES}
|
||||
|
||||
+EXT_CFLAGS = -fpie
|
||||
+
|
||||
@BIND9_MAKE_RULES@
|
||||
|
||||
+LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
|
||||
+
|
||||
main.@O@: main.c
|
||||
${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
|
||||
-DVERSION=\"${VERSION}\" \
|
||||
diff -up bind-9.5.0b2/bin/named/unix/Makefile.in.pie bind-9.5.0b2/bin/named/unix/Makefile.in
|
||||
--- bind-9.5.0b2/bin/named/unix/Makefile.in.pie 2008-02-11 17:22:21.000000000 +0100
|
||||
+++ bind-9.5.0b2/bin/named/unix/Makefile.in 2008-02-11 17:23:00.000000000 +0100
|
||||
@@ -19,6 +19,8 @@ srcdir = @srcdir@
|
||||
VPATH = @srcdir@
|
||||
top_srcdir = @top_srcdir@
|
||||
|
||||
+EXT_CFLAGS = -fpie
|
||||
+
|
||||
@BIND9_MAKE_INCLUDES@
|
||||
|
||||
CINCLUDES = -I${srcdir}/include -I${srcdir}/../include \
|
53
bind-9.5-dlz-64bit.patch
Normal file
53
bind-9.5-dlz-64bit.patch
Normal file
@ -0,0 +1,53 @@
|
||||
diff --git a/contrib/dlz/config.dlz.in b/contrib/dlz/config.dlz.in
|
||||
index 47525af..eefe3c3 100644
|
||||
--- a/contrib/dlz/config.dlz.in
|
||||
+++ b/contrib/dlz/config.dlz.in
|
||||
@@ -17,6 +17,13 @@
|
||||
#
|
||||
dlzdir='${DLZ_DRIVER_DIR}'
|
||||
|
||||
+AC_MSG_CHECKING([for target libdir])
|
||||
+AC_RUN_IFELSE([int main(void) {exit((sizeof(void *) == 8) ? 0 : 1);}],
|
||||
+ [target_lib=lib64],
|
||||
+ [target_lib=lib],
|
||||
+)
|
||||
+AC_MSG_RESULT(["$target_lib"])
|
||||
+
|
||||
#
|
||||
# Private autoconf macro to simplify configuring drivers:
|
||||
#
|
||||
@@ -292,9 +299,9 @@ case "$use_dlz_bdb" in
|
||||
then
|
||||
break
|
||||
fi
|
||||
- elif test -f "$dd/lib/lib${d}.so"
|
||||
+ elif test -f "$dd/${target_lib}/lib${d}.so"
|
||||
then
|
||||
- dlz_bdb_libs="-L${dd}/lib -l${d}"
|
||||
+ dlz_bdb_libs="-L${dd}/${target_lib} -l${d}"
|
||||
break
|
||||
fi
|
||||
done
|
||||
@@ -396,7 +403,7 @@ case "$use_dlz_ldap" in
|
||||
*)
|
||||
DLZ_ADD_DRIVER(LDAP, dlz_ldap_driver,
|
||||
[-I$use_dlz_ldap/include],
|
||||
- [-L$use_dlz_ldap/lib -lldap -llber])
|
||||
+ [-L$use_dlz_ldap/${target_lib} -lldap -llber])
|
||||
|
||||
AC_MSG_RESULT(
|
||||
[using LDAP from $use_dlz_ldap/lib and $use_dlz_ldap/include])
|
||||
@@ -432,11 +439,11 @@ then
|
||||
odbcdirs="/usr /usr/local /usr/pkg"
|
||||
for d in $odbcdirs
|
||||
do
|
||||
- if test -f $d/include/sql.h -a -f $d/lib/libodbc.a
|
||||
+ if test -f $d/include/sql.h -a -f $d/${target_lib}/libodbc.a
|
||||
then
|
||||
use_dlz_odbc=$d
|
||||
dlz_odbc_include="-I$use_dlz_odbc/include"
|
||||
- dlz_odbc_libs="-L$use_dlz_odbc/lib -lodbc"
|
||||
+ dlz_odbc_libs="-L$use_dlz_odbc/${target_lib} -lodbc"
|
||||
break
|
||||
fi
|
||||
done
|
31
bind-9.9.1-P2-dlz-libdb.patch
Normal file
31
bind-9.9.1-P2-dlz-libdb.patch
Normal file
@ -0,0 +1,31 @@
|
||||
diff -up bind-9.10.1b1/contrib/dlz/config.dlz.in.libdb bind-9.10.1b1/contrib/dlz/config.dlz.in
|
||||
--- bind-9.10.1b1/contrib/dlz/config.dlz.in.libdb 2014-08-04 12:33:09.320735111 +0200
|
||||
+++ bind-9.10.1b1/contrib/dlz/config.dlz.in 2014-08-04 12:41:46.888241910 +0200
|
||||
@@ -263,7 +263,7 @@ case "$use_dlz_bdb" in
|
||||
# Check other locations for includes.
|
||||
# Order is important (sigh).
|
||||
|
||||
- bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /db"
|
||||
+ bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /libdb /db"
|
||||
# include a blank element first
|
||||
for d in "" $bdb_incdirs
|
||||
do
|
||||
@@ -288,16 +288,9 @@ case "$use_dlz_bdb" in
|
||||
bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
|
||||
for d in $bdb_libnames
|
||||
do
|
||||
- if test "$dd" = "/usr"
|
||||
+ if test -f "$dd/${target_lib}/lib${d}.so"
|
||||
then
|
||||
- AC_CHECK_LIB($d, db_create, dlz_bdb_libs="-l${d}")
|
||||
- if test $dlz_bdb_libs != "yes"
|
||||
- then
|
||||
- break
|
||||
- fi
|
||||
- elif test -f "$dd/${target_lib}/lib${d}.so"
|
||||
- then
|
||||
- dlz_bdb_libs="-L${dd}/${target_lib} -l${d}"
|
||||
+ dlz_bdb_libs="-L${dd}/${target_lib}/libdb -l${d}"
|
||||
break
|
||||
fi
|
||||
done
|
54
bind-9.9.1-P2-multlib-conflict.patch
Normal file
54
bind-9.9.1-P2-multlib-conflict.patch
Normal file
@ -0,0 +1,54 @@
|
||||
diff --git a/config.h.in b/config.h.in
|
||||
index 4ecaa8f..2f65ccc 100644
|
||||
--- a/config.h.in
|
||||
+++ b/config.h.in
|
||||
@@ -600,7 +600,7 @@ int sigwait(const unsigned int *set, int *sig);
|
||||
#undef PREFER_GOSTASN1
|
||||
|
||||
/* The size of `void *', as computed by sizeof. */
|
||||
-#undef SIZEOF_VOID_P
|
||||
+/* #undef SIZEOF_VOID_P */
|
||||
|
||||
/* Define to 1 if you have the ANSI C header files. */
|
||||
#undef STDC_HEADERS
|
||||
diff --git a/isc-config.sh.in b/isc-config.sh.in
|
||||
index a8a0a89..b5e94ed 100644
|
||||
--- a/isc-config.sh.in
|
||||
+++ b/isc-config.sh.in
|
||||
@@ -13,7 +13,18 @@ prefix=@prefix@
|
||||
exec_prefix=@exec_prefix@
|
||||
exec_prefix_set=
|
||||
includedir=@includedir@
|
||||
-libdir=@libdir@
|
||||
+arch=$(uname -m)
|
||||
+
|
||||
+case $arch in
|
||||
+ x86_64 | amd64 | sparc64 | s390x | ppc64)
|
||||
+ libdir=/usr/lib64
|
||||
+ sec_libdir=/usr/lib
|
||||
+ ;;
|
||||
+ * )
|
||||
+ libdir=/usr/lib
|
||||
+ sec_libdir=/usr/lib64
|
||||
+ ;;
|
||||
+esac
|
||||
|
||||
usage()
|
||||
{
|
||||
@@ -132,6 +143,16 @@ if test x"$echo_libs" = x"true"; then
|
||||
if test x"${exec_prefix_set}" = x"true"; then
|
||||
libs="-L${exec_prefix}/lib"
|
||||
else
|
||||
+ if [ ! -x $libdir/libisc.so ] ; then
|
||||
+ if [ ! -x $sec_libdir/libisc.so ] ; then
|
||||
+ echo "Error: ISC libs not found in $libdir"
|
||||
+ if [ -d $sec_libdir ] ; then
|
||||
+ echo "Error: ISC libs not found in $sec_libdir"
|
||||
+ fi
|
||||
+ exit 1
|
||||
+ fi
|
||||
+ libdir=$sec_libdir
|
||||
+ fi
|
||||
libs="-L${libdir}"
|
||||
fi
|
||||
if test x"$libirs" = x"true" ; then
|
42
bind-95-rh452060.patch
Normal file
42
bind-95-rh452060.patch
Normal file
@ -0,0 +1,42 @@
|
||||
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
|
||||
index aa5315d..1fa711a 100644
|
||||
--- a/bin/dig/dighost.c
|
||||
+++ b/bin/dig/dighost.c
|
||||
@@ -1814,6 +1814,13 @@ clear_query(dig_query_t *query) {
|
||||
|
||||
if (query->timer != NULL)
|
||||
isc_timer_detach(&query->timer);
|
||||
+
|
||||
+ if (query->waiting_senddone) {
|
||||
+ debug("send_done not yet called");
|
||||
+ query->pending_free = true;
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
lookup = query->lookup;
|
||||
|
||||
if (lookup->current_query == query)
|
||||
@@ -1839,10 +1846,7 @@ clear_query(dig_query_t *query) {
|
||||
isc_mempool_put(commctx, query->recvspace);
|
||||
isc_buffer_invalidate(&query->recvbuf);
|
||||
isc_buffer_invalidate(&query->lengthbuf);
|
||||
- if (query->waiting_senddone)
|
||||
- query->pending_free = true;
|
||||
- else
|
||||
- isc_mem_free(mctx, query);
|
||||
+ isc_mem_free(mctx, query);
|
||||
}
|
||||
|
||||
/*%
|
||||
@@ -2892,9 +2896,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
|
||||
isc_event_free(&event);
|
||||
|
||||
if (query->pending_free)
|
||||
- isc_mem_free(mctx, query);
|
||||
+ clear_query(query);
|
||||
|
||||
- check_if_done();
|
||||
+ check_next_lookup(l);
|
||||
UNLOCK_LOOKUP;
|
||||
}
|
||||
|
23
bind-96-old-api.patch
Normal file
23
bind-96-old-api.patch
Normal file
@ -0,0 +1,23 @@
|
||||
diff -up bind-9.6.0b1/contrib/sdb/ldap/ldapdb.c.old-api bind-9.6.0b1/contrib/sdb/ldap/ldapdb.c
|
||||
--- bind-9.6.0b1/contrib/sdb/ldap/ldapdb.c.old-api 2008-11-24 13:28:13.000000000 +0100
|
||||
+++ bind-9.6.0b1/contrib/sdb/ldap/ldapdb.c 2008-11-24 13:28:23.000000000 +0100
|
||||
@@ -25,6 +25,7 @@
|
||||
/* Using LDAPv3 by default, change this if you want v2 */
|
||||
#ifndef LDAPDB_LDAP_VERSION
|
||||
#define LDAPDB_LDAP_VERSION 3
|
||||
+#define LDAP_DEPRECATED 1
|
||||
#endif
|
||||
|
||||
#include <config.h>
|
||||
diff -up bind-9.6.0b1/contrib/sdb/ldap/zone2ldap.c.old-api bind-9.6.0b1/contrib/sdb/ldap/zone2ldap.c
|
||||
--- bind-9.6.0b1/contrib/sdb/ldap/zone2ldap.c.old-api 2008-11-24 13:29:05.000000000 +0100
|
||||
+++ bind-9.6.0b1/contrib/sdb/ldap/zone2ldap.c 2008-11-24 13:29:14.000000000 +0100
|
||||
@@ -13,6 +13,8 @@
|
||||
* ditched dNSDomain2 schema support. Version 0.3-ALPHA
|
||||
*/
|
||||
|
||||
+#define LDAP_DEPRECATED 1
|
||||
+
|
||||
#include <errno.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
1
bind.tmpfiles.d
Normal file
1
bind.tmpfiles.d
Normal file
@ -0,0 +1 @@
|
||||
d /run/named 0755 named named -
|
81
bind93-rh490837.patch
Normal file
81
bind93-rh490837.patch
Normal file
@ -0,0 +1,81 @@
|
||||
diff --git a/lib/isc/include/isc/stdio.h b/lib/isc/include/isc/stdio.h
|
||||
index 1f44b5a..a3625f9 100644
|
||||
--- a/lib/isc/include/isc/stdio.h
|
||||
+++ b/lib/isc/include/isc/stdio.h
|
||||
@@ -69,6 +69,9 @@ isc_stdio_sync(FILE *f);
|
||||
* direct counterpart in the stdio library.
|
||||
*/
|
||||
|
||||
+isc_result_t
|
||||
+isc_stdio_fgetc(FILE *f, int *ret);
|
||||
+
|
||||
ISC_LANG_ENDDECLS
|
||||
|
||||
#endif /* ISC_STDIO_H */
|
||||
diff --git a/lib/isc/lex.c b/lib/isc/lex.c
|
||||
index a8955bc..fc6103b 100644
|
||||
--- a/lib/isc/lex.c
|
||||
+++ b/lib/isc/lex.c
|
||||
@@ -434,17 +434,14 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
|
||||
if (source->is_file) {
|
||||
stream = source->input;
|
||||
|
||||
-#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETCUNLOCKED)
|
||||
- c = getc_unlocked(stream);
|
||||
-#else
|
||||
- c = getc(stream);
|
||||
-#endif
|
||||
- if (c == EOF) {
|
||||
- if (ferror(stream)) {
|
||||
- source->result = ISC_R_IOERROR;
|
||||
- result = source->result;
|
||||
+ result = isc_stdio_fgetc(stream, &c);
|
||||
+
|
||||
+ if (result != ISC_R_SUCCESS) {
|
||||
+ if (result != ISC_R_EOF) {
|
||||
+ source->result = result;
|
||||
goto done;
|
||||
}
|
||||
+
|
||||
source->at_eof = true;
|
||||
}
|
||||
} else {
|
||||
diff --git a/lib/isc/unix/errno2result.c b/lib/isc/unix/errno2result.c
|
||||
index 2f12bcc..5bfd648 100644
|
||||
--- a/lib/isc/unix/errno2result.c
|
||||
+++ b/lib/isc/unix/errno2result.c
|
||||
@@ -40,6 +40,7 @@ isc___errno2result(int posixerrno, bool dolog,
|
||||
case EINVAL: /* XXX sometimes this is not for files */
|
||||
case ENAMETOOLONG:
|
||||
case EBADF:
|
||||
+ case EISDIR:
|
||||
return (ISC_R_INVALIDFILE);
|
||||
case ENOENT:
|
||||
return (ISC_R_FILENOTFOUND);
|
||||
diff --git a/lib/isc/unix/stdio.c b/lib/isc/unix/stdio.c
|
||||
index e60fa65..77f0b13 100644
|
||||
--- a/lib/isc/unix/stdio.c
|
||||
+++ b/lib/isc/unix/stdio.c
|
||||
@@ -149,3 +149,22 @@ isc_stdio_sync(FILE *f) {
|
||||
return (isc__errno2result(errno));
|
||||
}
|
||||
|
||||
+isc_result_t
|
||||
+isc_stdio_fgetc(FILE *f, int *ret) {
|
||||
+ int r;
|
||||
+ isc_result_t result = ISC_R_SUCCESS;
|
||||
+
|
||||
+#if defined(HAVE_FLOCKFILE) && defined(HAVE_GETCUNLOCKED)
|
||||
+ r = fgetc_unlocked(f);
|
||||
+#else
|
||||
+ r = fgets(f);
|
||||
+#endif
|
||||
+
|
||||
+ if (r == EOF)
|
||||
+ result = ferror(f) ? isc__errno2result(errno) : ISC_R_EOF;
|
||||
+
|
||||
+ *ret = r;
|
||||
+
|
||||
+ return result;
|
||||
+}
|
||||
+
|
226
bind97-exportlib.patch
Normal file
226
bind97-exportlib.patch
Normal file
@ -0,0 +1,226 @@
|
||||
diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in
|
||||
diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in
|
||||
--- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200
|
||||
+++ bind-9.9.3rc2/lib/export/dns/Makefile.in 2013-05-13 10:45:22.574089729 +0200
|
||||
@@ -35,9 +35,9 @@ CDEFINES = -DUSE_MD5 @USE_OPENSSL@ @USE_
|
||||
|
||||
CWARNINGS =
|
||||
|
||||
-ISCLIBS = ../isc/libisc.@A@
|
||||
+ISCLIBS = ../isc/libisc-export.@A@
|
||||
|
||||
-ISCDEPLIBS = ../isc/libisc.@A@
|
||||
+ISCDEPLIBS = ../isc/libisc-export.@A@
|
||||
|
||||
LIBS = @LIBS@
|
||||
|
||||
@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c
|
||||
-DLIBAGE=${LIBAGE} \
|
||||
-c ${srcdir}/version.c
|
||||
|
||||
-libdns.@SA@: ${OBJS}
|
||||
+libdns-export.@SA@: ${OBJS}
|
||||
${AR} ${ARFLAGS} $@ ${OBJS}
|
||||
${RANLIB} $@
|
||||
|
||||
-libdns.la: ${OBJS}
|
||||
+libdns-export.la: ${OBJS}
|
||||
${LIBTOOL_MODE_LINK} \
|
||||
- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
|
||||
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
|
||||
-rpath ${export_libdir} \
|
||||
-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
|
||||
${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
|
||||
|
||||
-timestamp: libdns.@A@
|
||||
+timestamp: libdns-export.@A@
|
||||
touch timestamp
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
|
||||
|
||||
install:: timestamp installdirs
|
||||
- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
|
||||
${DESTDIR}${export_libdir}/
|
||||
|
||||
clean distclean::
|
||||
- rm -f libdns.@A@ timestamp
|
||||
+ rm -f libdns-export.@A@ timestamp
|
||||
rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
|
||||
rm -f include/dns/rdatastruct.h
|
||||
|
||||
diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in
|
||||
--- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200
|
||||
+++ bind-9.9.3rc2/lib/export/irs/Makefile.in 2013-05-13 10:45:22.575089729 +0200
|
||||
@@ -43,9 +43,9 @@ SRCS = context.c \
|
||||
gai_sterror.c getaddrinfo.c getnameinfo.c \
|
||||
resconf.c
|
||||
|
||||
-ISCLIBS = ../isc/libisc.@A@
|
||||
-DNSLIBS = ../dns/libdns.@A@
|
||||
-ISCCFGLIBS = ../isccfg/libisccfg.@A@
|
||||
+ISCLIBS = ../isc/libisc-export.@A@
|
||||
+DNSLIBS = ../dns/libdns-export.@A@
|
||||
+ISCCFGLIBS = ../isccfg/libisccfg-export.@A@
|
||||
|
||||
LIBS = @LIBS@
|
||||
|
||||
@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c
|
||||
-DLIBAGE=${LIBAGE} \
|
||||
-c ${srcdir}/version.c
|
||||
|
||||
-libirs.@SA@: ${OBJS} version.@O@
|
||||
+libirs-export.@SA@: ${OBJS} version.@O@
|
||||
${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
|
||||
${RANLIB} $@
|
||||
|
||||
-libirs.la: ${OBJS} version.@O@
|
||||
+libirs-export.la: ${OBJS} version.@O@
|
||||
${LIBTOOL_MODE_LINK} \
|
||||
- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
|
||||
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
|
||||
-rpath ${export_libdir} \
|
||||
-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
|
||||
${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
|
||||
|
||||
-timestamp: libirs.@A@
|
||||
+timestamp: libirs-export.@A@
|
||||
touch timestamp
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
|
||||
|
||||
install:: timestamp installdirs
|
||||
- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
|
||||
${DESTDIR}${export_libdir}/
|
||||
|
||||
clean distclean::
|
||||
- rm -f libirs.@A@ libirs.la timestamp
|
||||
+ rm -f libirs-export.@A@ libirs-export.la timestamp
|
||||
diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in
|
||||
--- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200
|
||||
+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in 2013-05-13 10:45:22.576089729 +0200
|
||||
@@ -30,11 +30,11 @@ CINCLUDES = -I. ${DNS_INCLUDES} -I${expo
|
||||
CDEFINES =
|
||||
CWARNINGS =
|
||||
|
||||
-ISCLIBS = ../isc/libisc.@A@
|
||||
-DNSLIBS = ../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
+ISCLIBS = ../isc/libisc-export.@A@
|
||||
+DNSLIBS = ../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
|
||||
|
||||
ISCDEPLIBS = ../../lib/isc/libisc.@A@
|
||||
-ISCCFGDEPLIBS = libisccfg.@A@
|
||||
+ISCCFGDEPLIBS = libisccfg-export.@A@
|
||||
|
||||
LIBS = @LIBS@
|
||||
|
||||
@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c
|
||||
-DLIBAGE=${LIBAGE} \
|
||||
-c ${srcdir}/version.c
|
||||
|
||||
-libisccfg.@SA@: ${OBJS}
|
||||
+libisccfg-export.@SA@: ${OBJS}
|
||||
${AR} ${ARFLAGS} $@ ${OBJS}
|
||||
${RANLIB} $@
|
||||
|
||||
-libisccfg.la: ${OBJS}
|
||||
+libisccfg-export.la: ${OBJS}
|
||||
${LIBTOOL_MODE_LINK} \
|
||||
- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
|
||||
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
|
||||
-rpath ${export_libdir} \
|
||||
-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
|
||||
${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
|
||||
|
||||
-timestamp: libisccfg.@A@
|
||||
+timestamp: libisccfg-export.@A@
|
||||
touch timestamp
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
|
||||
|
||||
install:: timestamp installdirs
|
||||
- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
|
||||
${DESTDIR}${export_libdir}/
|
||||
|
||||
clean distclean::
|
||||
- rm -f libisccfg.@A@ timestamp
|
||||
+ rm -f libisccfg-export.@A@ timestamp
|
||||
diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in
|
||||
--- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200
|
||||
+++ bind-9.9.3rc2/lib/export/isc/Makefile.in 2013-05-13 10:45:22.576089729 +0200
|
||||
@@ -100,6 +100,10 @@ SRCS = @ISC_EXTRA_SRCS@ \
|
||||
|
||||
LIBS = @LIBS@
|
||||
|
||||
+# Note: the order of SUBDIRS is important.
|
||||
+# Attempt to disable parallel processing.
|
||||
+.NOTPARALLEL:
|
||||
+.NO_PARALLEL:
|
||||
SUBDIRS = include unix nls @ISC_THREAD_DIR@
|
||||
TARGETS = timestamp
|
||||
|
||||
@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c
|
||||
-DLIBAGE=${LIBAGE} \
|
||||
-c ${srcdir}/version.c
|
||||
|
||||
-libisc.@SA@: ${OBJS}
|
||||
+libisc-export.@SA@: ${OBJS}
|
||||
${AR} ${ARFLAGS} $@ ${OBJS}
|
||||
${RANLIB} $@
|
||||
|
||||
-libisc.la: ${OBJS}
|
||||
+libisc-export.la: ${OBJS}
|
||||
${LIBTOOL_MODE_LINK} \
|
||||
- ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
|
||||
+ ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
|
||||
-rpath ${export_libdir} \
|
||||
-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
|
||||
${OBJS} ${LIBS}
|
||||
|
||||
-timestamp: libisc.@A@
|
||||
+timestamp: libisc-export.@A@
|
||||
touch timestamp
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
|
||||
|
||||
install:: timestamp installdirs
|
||||
- ${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
|
||||
+ ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
|
||||
${DESTDIR}${export_libdir}
|
||||
|
||||
clean distclean::
|
||||
- rm -f libisc.@A@ libisc.la timestamp
|
||||
+ rm -f libisc-export.@A@ libisc-export.la timestamp
|
||||
diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in
|
||||
--- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib 2013-04-30 08:38:46.000000000 +0200
|
||||
+++ bind-9.9.3rc2/lib/export/samples/Makefile.in 2013-05-13 10:45:22.577089729 +0200
|
||||
@@ -31,15 +31,15 @@ CINCLUDES = -I${srcdir}/include -I../dns
|
||||
CDEFINES =
|
||||
CWARNINGS =
|
||||
|
||||
-DNSLIBS = ../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
-ISCLIBS = ../isc/libisc.@A@
|
||||
-ISCCFGLIBS = ../isccfg/libisccfg.@A@
|
||||
-IRSLIBS = ../irs/libirs.@A@
|
||||
+DNSLIBS = ../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
|
||||
+ISCLIBS = ../isc/libisc-export.@A@
|
||||
+ISCCFGLIBS = ../isccfg/libisccfg-export.@A@
|
||||
+IRSLIBS = ../irs/libirs-export.@A@
|
||||
|
||||
-DNSDEPLIBS = ../dns/libdns.@A@
|
||||
-ISCDEPLIBS = ../isc/libisc.@A@
|
||||
-ISCCFGDEPLIBS = ../isccfg/libisccfg.@A@
|
||||
-IRSDEPLIBS = ../irs/libirs.@A@
|
||||
+DNSDEPLIBS = ../dns/libdns-export.@A@
|
||||
+ISCDEPLIBS = ../isc/libisc-export.@A@
|
||||
+ISCCFGDEPLIBS = ../isccfg/libisccfg-export.@A@
|
||||
+IRSDEPLIBS = ../irs/libirs-export.@A@
|
||||
|
||||
DEPLIBS = ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
|
||||
|
51
bind97-rh478718.patch
Normal file
51
bind97-rh478718.patch
Normal file
@ -0,0 +1,51 @@
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 26c509e..c1bfd62 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -4152,6 +4152,10 @@ if test "yes" = "$use_atomic"; then
|
||||
AC_MSG_RESULT($arch)
|
||||
fi
|
||||
|
||||
+if test ! "$arch" = "x86_64" -a "$have_xaddq" = "yes"; then
|
||||
+ AC_MSG_ERROR([XADDQ present but disabled by Fedora patch!])
|
||||
+fi
|
||||
+
|
||||
if test "yes" = "$have_atomic"; then
|
||||
AC_MSG_CHECKING([compiler support for inline assembly code])
|
||||
|
||||
diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
|
||||
index c902d46..9c7c342 100644
|
||||
--- a/lib/isc/include/isc/platform.h.in
|
||||
+++ b/lib/isc/include/isc/platform.h.in
|
||||
@@ -284,19 +284,25 @@
|
||||
* If the "xaddq" operation (64bit xadd) is available on this architecture,
|
||||
* ISC_PLATFORM_HAVEXADDQ will be defined.
|
||||
*/
|
||||
-@ISC_PLATFORM_HAVEXADDQ@
|
||||
|
||||
/*
|
||||
- * If the 32-bit "atomic swap" operation is available on this
|
||||
- * architecture, ISC_PLATFORM_HAVEATOMICSTORE" will be defined.
|
||||
+ * If the 64-bit "atomic swap" operation is available on this
|
||||
+ * architecture, ISC_PLATFORM_HAVEATOMICSTOREQ" will be defined.
|
||||
*/
|
||||
-@ISC_PLATFORM_HAVEATOMICSTORE@
|
||||
+
|
||||
+#ifdef __x86_64__
|
||||
+#define ISC_PLATFORM_HAVEXADDQ 1
|
||||
+#define ISC_PLATFORM_HAVEATOMICSTOREQ 1
|
||||
+#else
|
||||
+#undef ISC_PLATFORM_HAVEXADDQ
|
||||
+#undef ISC_PLATFORM_HAVEATOMICSTOREQ
|
||||
+#endif
|
||||
|
||||
/*
|
||||
- * If the 64-bit "atomic swap" operation is available on this
|
||||
+ * If the 32-bit "atomic swap" operation is available on this
|
||||
* architecture, ISC_PLATFORM_HAVEATOMICSTORE" will be defined.
|
||||
*/
|
||||
-@ISC_PLATFORM_HAVEATOMICSTOREQ@
|
||||
+@ISC_PLATFORM_HAVEATOMICSTORE@
|
||||
|
||||
/*
|
||||
* If the "compare-and-exchange" operation is available on this architecture,
|
31
bind97-rh645544.patch
Normal file
31
bind97-rh645544.patch
Normal file
@ -0,0 +1,31 @@
|
||||
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
|
||||
index ecb3ddb..f7f73cd 100644
|
||||
--- a/lib/dns/resolver.c
|
||||
+++ b/lib/dns/resolver.c
|
||||
@@ -1456,7 +1456,7 @@ log_edns(fetchctx_t *fctx) {
|
||||
*/
|
||||
dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
|
||||
isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
|
||||
- DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
|
||||
+ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
|
||||
"success resolving '%s' (in '%s'?) after %s",
|
||||
fctx->info, domainbuf, fctx->reason);
|
||||
|
||||
@@ -4667,7 +4667,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
|
||||
dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
|
||||
isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
|
||||
isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
|
||||
- DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
|
||||
+ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
|
||||
"lame server resolving '%s' (in '%s'?): %s",
|
||||
namebuf, domainbuf, addrbuf);
|
||||
}
|
||||
@@ -4685,7 +4685,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
|
||||
isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf));
|
||||
|
||||
isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
|
||||
- DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
|
||||
+ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
|
||||
"DNS format error from %s resolving %s for %s: %s",
|
||||
nsbuf, fctx->info, fctx->clientstr, msgbuf);
|
||||
}
|
14
bind97-rh669163.patch
Normal file
14
bind97-rh669163.patch
Normal file
@ -0,0 +1,14 @@
|
||||
diff -up bind-9.7.2-P3/lib/lwres/lwconfig.c.rh669163 bind-9.7.2-P3/lib/lwres/lwconfig.c
|
||||
--- bind-9.7.2-P3/lib/lwres/lwconfig.c.rh669163 2011-01-28 14:48:38.934472578 +0100
|
||||
+++ bind-9.7.2-P3/lib/lwres/lwconfig.c 2011-01-28 14:49:50.421326035 +0100
|
||||
@@ -612,6 +612,10 @@ lwres_conf_parse(lwres_context_t *ctx, c
|
||||
break;
|
||||
}
|
||||
|
||||
+ /* Ignore options with no parameters */
|
||||
+ if (stopchar == '\n')
|
||||
+ continue;
|
||||
+
|
||||
if (strlen(word) == 0U)
|
||||
rval = LWRES_R_SUCCESS;
|
||||
else if (strcmp(word, "nameserver") == 0)
|
44
bind99-rh640538.patch
Normal file
44
bind99-rh640538.patch
Normal file
@ -0,0 +1,44 @@
|
||||
diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
|
||||
index 1079421..f11abd1 100644
|
||||
--- a/bin/dig/dig.docbook
|
||||
+++ b/bin/dig/dig.docbook
|
||||
@@ -1177,6 +1177,39 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
||||
</para>
|
||||
</refsection>
|
||||
|
||||
+ <refsection><info><title>RETURN CODES</title></info>
|
||||
+ <para>
|
||||
+ <command>Dig</command> return codes are:
|
||||
+ <variablelist>
|
||||
+ <varlistentry>
|
||||
+ <listitem>
|
||||
+ <para>0: Everything went well, including things like NXDOMAIN</para>
|
||||
+ </listitem>
|
||||
+ </varlistentry>
|
||||
+ <varlistentry>
|
||||
+ <listitem>
|
||||
+ <para>1: Usage error</para>
|
||||
+ </listitem>
|
||||
+ </varlistentry>
|
||||
+ <varlistentry>
|
||||
+ <listitem>
|
||||
+ <para>8: Couldn't open batch file</para>
|
||||
+ </listitem>
|
||||
+ </varlistentry>
|
||||
+ <varlistentry>
|
||||
+ <listitem>
|
||||
+ <para>9: No reply from server</para>
|
||||
+ </listitem>
|
||||
+ </varlistentry>
|
||||
+ <varlistentry>
|
||||
+ <listitem>
|
||||
+ <para>10: Internal error</para>
|
||||
+ </listitem>
|
||||
+ </varlistentry>
|
||||
+ </variablelist>
|
||||
+ </para>
|
||||
+ </refsection>
|
||||
+
|
||||
<refsection><info><title>FILES</title></info>
|
||||
|
||||
<para><filename>/etc/resolv.conf</filename>
|
252
codesign2019.txt
Normal file
252
codesign2019.txt
Normal file
@ -0,0 +1,252 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
Comment: GPGTools - http://gpgtools.org
|
||||
|
||||
mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
|
||||
r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
|
||||
pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
|
||||
yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
|
||||
ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
|
||||
/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
|
||||
qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
|
||||
UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
|
||||
SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
|
||||
o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
|
||||
LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
|
||||
tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
|
||||
LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
|
||||
EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
|
||||
Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
|
||||
1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
|
||||
tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
|
||||
5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
|
||||
Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
|
||||
JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
|
||||
hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
|
||||
xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
|
||||
gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
|
||||
pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
|
||||
vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
|
||||
6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
|
||||
lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
|
||||
yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
|
||||
Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
|
||||
1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
|
||||
+JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
|
||||
Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
|
||||
0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
|
||||
bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
|
||||
/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
|
||||
gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
|
||||
+C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
|
||||
9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
|
||||
SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
|
||||
XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
|
||||
NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
|
||||
ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
|
||||
+BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
|
||||
0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
|
||||
X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
|
||||
+8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
|
||||
8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
|
||||
fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
|
||||
P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
|
||||
9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
|
||||
ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
|
||||
FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
|
||||
zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
|
||||
9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
|
||||
c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
|
||||
Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
|
||||
LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
|
||||
dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
|
||||
Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
|
||||
EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
|
||||
TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
|
||||
JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
|
||||
uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
|
||||
Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
|
||||
rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
|
||||
iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
|
||||
Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
|
||||
w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
|
||||
9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
|
||||
EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
|
||||
8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
|
||||
VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
|
||||
puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
|
||||
EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
|
||||
+7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
|
||||
7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
|
||||
md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
|
||||
KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
|
||||
kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
|
||||
uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
|
||||
1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
|
||||
j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
|
||||
riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
|
||||
PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
|
||||
FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
|
||||
PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
|
||||
XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
|
||||
1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
|
||||
wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
|
||||
dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
|
||||
oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
|
||||
5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
|
||||
Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
|
||||
zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
|
||||
uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
|
||||
R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
|
||||
V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
|
||||
I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
|
||||
NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
|
||||
QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
|
||||
LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
|
||||
aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
|
||||
Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
|
||||
A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
|
||||
AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
|
||||
r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
|
||||
c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
|
||||
mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
|
||||
ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
|
||||
iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
|
||||
Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
|
||||
QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
|
||||
wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
|
||||
1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
|
||||
IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
|
||||
wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
|
||||
/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
|
||||
S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
|
||||
/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
|
||||
/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
|
||||
FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
|
||||
rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
|
||||
BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
|
||||
fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
|
||||
8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
|
||||
Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
|
||||
Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
|
||||
irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
|
||||
GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
|
||||
Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
|
||||
ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
|
||||
lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
|
||||
cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
|
||||
87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
|
||||
JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
|
||||
AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
|
||||
4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
|
||||
QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
|
||||
h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
|
||||
+TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
|
||||
37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
|
||||
5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
|
||||
H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
|
||||
zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
|
||||
96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
|
||||
B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
|
||||
/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
|
||||
0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
|
||||
EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
|
||||
NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
|
||||
cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
|
||||
VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
|
||||
Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
|
||||
kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
|
||||
OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
|
||||
tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
|
||||
pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
|
||||
xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
|
||||
hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
|
||||
P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
|
||||
5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
|
||||
wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
|
||||
uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
|
||||
wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
|
||||
h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
|
||||
J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
|
||||
1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
|
||||
hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
|
||||
8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
|
||||
CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
|
||||
rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
|
||||
sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
|
||||
GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
|
||||
5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
|
||||
0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
|
||||
z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
|
||||
sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
|
||||
8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
|
||||
te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
|
||||
EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
|
||||
p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
|
||||
HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
|
||||
hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
|
||||
4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
|
||||
MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
|
||||
vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
|
||||
fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
|
||||
qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
|
||||
QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
|
||||
CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
|
||||
eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
|
||||
2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
|
||||
rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
|
||||
ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
|
||||
L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
|
||||
wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
|
||||
SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
|
||||
sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
|
||||
SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
|
||||
Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
|
||||
PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
|
||||
LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
|
||||
aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
|
||||
AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
|
||||
3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
|
||||
x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
|
||||
gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
|
||||
NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
|
||||
BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
|
||||
AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
|
||||
BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
|
||||
cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
|
||||
W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
|
||||
vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
|
||||
s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
|
||||
yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
|
||||
nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
|
||||
NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
|
||||
LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
|
||||
yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
|
||||
0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
|
||||
76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
|
||||
tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
|
||||
AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
|
||||
a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
|
||||
F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
|
||||
TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
|
||||
y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
|
||||
94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
|
||||
0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
|
||||
eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
|
||||
k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
|
||||
PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
|
||||
pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
|
||||
0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
|
||||
6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
|
||||
I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
|
||||
++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
|
||||
CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
|
||||
ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
|
||||
rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
|
||||
WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
|
||||
hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
|
||||
uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
|
||||
RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
|
||||
XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
|
||||
nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
|
||||
=MkGo
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
148
dnszone.schema
Normal file
148
dnszone.schema
Normal file
@ -0,0 +1,148 @@
|
||||
# A schema for storing DNS zones in LDAP
|
||||
#
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.0.0 NAME 'dNSTTL'
|
||||
DESC 'An integer denoting time to live'
|
||||
EQUALITY integerMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.0.1 NAME 'dNSClass'
|
||||
DESC 'The class of a resource record'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.0.2 NAME 'zoneName'
|
||||
DESC 'The name of a zone, i.e. the name of the highest node in the zone'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.0.3 NAME 'relativeDomainName'
|
||||
DESC 'The starting labels of a domain name'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.12 NAME 'pTRRecord'
|
||||
DESC 'domain name pointer, RFC 1035'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.13 NAME 'hInfoRecord'
|
||||
DESC 'host information, RFC 1035'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.14 NAME 'mInfoRecord'
|
||||
DESC 'mailbox or mail list information, RFC 1035'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.16 NAME 'tXTRecord'
|
||||
DESC 'text string, RFC 1035'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.18 NAME 'aFSDBRecord'
|
||||
DESC 'for AFS Data Base location, RFC 1183'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.24 NAME 'SigRecord'
|
||||
DESC 'Signature, RFC 2535'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.25 NAME 'KeyRecord'
|
||||
DESC 'Key, RFC 2535'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.28 NAME 'aAAARecord'
|
||||
DESC 'IPv6 address, RFC 1886'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.29 NAME 'LocRecord'
|
||||
DESC 'Location, RFC 1876'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.30 NAME 'nXTRecord'
|
||||
DESC 'non-existant, RFC 2535'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.33 NAME 'sRVRecord'
|
||||
DESC 'service location, RFC 2782'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.35 NAME 'nAPTRRecord'
|
||||
DESC 'Naming Authority Pointer, RFC 2915'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.36 NAME 'kXRecord'
|
||||
DESC 'Key Exchange Delegation, RFC 2230'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.37 NAME 'certRecord'
|
||||
DESC 'certificate, RFC 2538'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.38 NAME 'a6Record'
|
||||
DESC 'A6 Record Type, RFC 2874'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord'
|
||||
DESC 'Non-Terminal DNS Name Redirection, RFC 2672'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.43 NAME 'dSRecord'
|
||||
DESC 'Delegation Signer, RFC 3658'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.46 NAME 'rRSIGRecord'
|
||||
DESC 'RRSIG, RFC 3755'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.2428.20.1.47 NAME 'nSECRecord'
|
||||
DESC 'NSEC, RFC 3755'
|
||||
EQUALITY caseIgnoreIA5Match
|
||||
SUBSTR caseIgnoreIA5SubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
|
||||
objectclass ( 1.3.6.1.4.1.2428.20.3 NAME 'dNSZone'
|
||||
SUP top STRUCTURAL
|
||||
MUST ( zoneName $ relativeDomainName )
|
||||
MAY ( DNSTTL $ DNSClass $
|
||||
ARecord $ MDRecord $ MXRecord $ NSRecord $
|
||||
SOARecord $ CNAMERecord $ PTRRecord $ HINFORecord $
|
||||
MINFORecord $ TXTRecord $ SIGRecord $ KEYRecord $
|
||||
AAAARecord $ LOCRecord $ NXTRecord $ SRVRecord $
|
||||
NAPTRRecord $ KXRecord $ CERTRecord $ A6Record $
|
||||
DNAMERecord ) )
|
33
generate-rndc-key.sh
Executable file
33
generate-rndc-key.sh
Executable file
@ -0,0 +1,33 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -r /etc/rc.d/init.d/functions ]; then
|
||||
. /etc/rc.d/init.d/functions
|
||||
else
|
||||
success() {
|
||||
echo $" OK "
|
||||
}
|
||||
|
||||
failure() {
|
||||
echo -n " "
|
||||
echo $"FAILED"
|
||||
}
|
||||
fi
|
||||
|
||||
# This script generates /etc/rndc.key if doesn't exist AND if there is no rndc.conf
|
||||
|
||||
if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
|
||||
echo -n $"Generating /etc/rndc.key:"
|
||||
if /usr/sbin/rndc-confgen -a -A hmac-sha256 -r /dev/urandom > /dev/null 2>&1
|
||||
then
|
||||
chmod 640 /etc/rndc.key
|
||||
chown root:named /etc/rndc.key
|
||||
[ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.key
|
||||
success $"/etc/rndc.key generation"
|
||||
echo
|
||||
else
|
||||
rc=$?
|
||||
failure $"/etc/rndc.key generation"
|
||||
echo
|
||||
exit $rc
|
||||
fi
|
||||
fi
|
41
ldap2zone.1
Normal file
41
ldap2zone.1
Normal file
@ -0,0 +1,41 @@
|
||||
.\" Copyright (C) 2004, 2005 Stig Venaas <venaas@uninett.no>
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
.\" copyright notice and this permission notice appear in all copies.
|
||||
.\" Manpage written by Jan Gorig
|
||||
.TH ldap2zone 1 "15 March 2010" "BIND9"
|
||||
.SH NAME
|
||||
ldap2zone - Creates zone file from LDAP dnszone information
|
||||
.SH SYNOPSIS
|
||||
.B ldap2zone zone-name LDAP-URL default-ttl [serial]
|
||||
.SH DESCRIPTION
|
||||
ldap2zone is a tool that reads info for a zone from LDAP and constructs a standard plain ascii zone file that is written to the standard output. The LDAP information has to be stored using the dnszone schema. The schema is used by BIND with LDAP back-end.
|
||||
|
||||
\fBzone-name\fR
|
||||
.RS 4
|
||||
Name of the zone, eg "mydomain.net."
|
||||
.RE
|
||||
.PP
|
||||
\fBLDAP-URL\fR
|
||||
.RS 4
|
||||
LDAP URL to dnszone information
|
||||
.RE
|
||||
.PP
|
||||
\fBdefault-ttl\fR
|
||||
.RS 4
|
||||
Default TTL value to be used in zone
|
||||
.RE
|
||||
.PP
|
||||
\fBserial\fR
|
||||
.RS 4
|
||||
(optional) Program checks this number to be different than SOA serial number.
|
||||
.RE
|
||||
|
||||
.SH "EXIT STATUS"
|
||||
Exits with 0 on success or 1 on failure.
|
||||
.SH "SEE ALSO"
|
||||
named(8) ldap(3)
|
||||
http://www.venaas.no/dns/ldap2zone/
|
||||
.SH "COPYRIGHT"
|
||||
Copyright (C) 2004, 2005 Stig Venaas
|
411
ldap2zone.c
Normal file
411
ldap2zone.c
Normal file
@ -0,0 +1,411 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2005 Stig Venaas <venaas@uninett.no>
|
||||
* $Id: ldap2zone.c,v 1.1 2007/07/24 15:18:00 atkac Exp $
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*/
|
||||
|
||||
#define LDAP_DEPRECATED 1
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <ctype.h>
|
||||
|
||||
#include <ldap.h>
|
||||
|
||||
struct string {
|
||||
void *data;
|
||||
size_t len;
|
||||
};
|
||||
|
||||
struct assstack_entry {
|
||||
struct string key;
|
||||
struct string val;
|
||||
struct assstack_entry *next;
|
||||
};
|
||||
|
||||
struct assstack_entry *assstack_find(struct assstack_entry *stack, struct string *key);
|
||||
void assstack_push(struct assstack_entry **stack, struct assstack_entry *item);
|
||||
void assstack_insertbottom(struct assstack_entry **stack, struct assstack_entry *item);
|
||||
void printsoa(struct string *soa);
|
||||
void printrrs(char *defaultttl, struct assstack_entry *item);
|
||||
void print_zone(char *defaultttl, struct assstack_entry *stack);
|
||||
void usage(char *name);
|
||||
void err(char *name, const char *msg);
|
||||
int putrr(struct assstack_entry **stack, struct berval *name, char *type, char *ttl, struct berval *val);
|
||||
|
||||
struct assstack_entry *assstack_find(struct assstack_entry *stack, struct string *key) {
|
||||
for (; stack; stack = stack->next)
|
||||
if (stack->key.len == key->len && !memcmp(stack->key.data, key->data, key->len))
|
||||
return stack;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
void assstack_push(struct assstack_entry **stack, struct assstack_entry *item) {
|
||||
item->next = *stack;
|
||||
*stack = item;
|
||||
}
|
||||
|
||||
void assstack_insertbottom(struct assstack_entry **stack, struct assstack_entry *item) {
|
||||
struct assstack_entry *p;
|
||||
|
||||
item->next = NULL;
|
||||
if (!*stack) {
|
||||
*stack = item;
|
||||
return;
|
||||
}
|
||||
/* find end, should keep track of end somewhere */
|
||||
/* really a queue, not a stack */
|
||||
p = *stack;
|
||||
while (p->next)
|
||||
p = p->next;
|
||||
p->next = item;
|
||||
}
|
||||
|
||||
void printsoa(struct string *soa) {
|
||||
char *s;
|
||||
size_t i;
|
||||
|
||||
s = (char *)soa->data;
|
||||
i = 0;
|
||||
while (i < soa->len) {
|
||||
putchar(s[i]);
|
||||
if (s[i++] == ' ')
|
||||
break;
|
||||
}
|
||||
while (i < soa->len) {
|
||||
putchar(s[i]);
|
||||
if (s[i++] == ' ')
|
||||
break;
|
||||
}
|
||||
printf("(\n\t\t\t\t");
|
||||
while (i < soa->len) {
|
||||
putchar(s[i]);
|
||||
if (s[i++] == ' ')
|
||||
break;
|
||||
}
|
||||
printf("; Serialnumber\n\t\t\t\t");
|
||||
while (i < soa->len) {
|
||||
if (s[i] == ' ')
|
||||
break;
|
||||
putchar(s[i++]);
|
||||
}
|
||||
i++;
|
||||
printf("\t; Refresh\n\t\t\t\t");
|
||||
while (i < soa->len) {
|
||||
if (s[i] == ' ')
|
||||
break;
|
||||
putchar(s[i++]);
|
||||
}
|
||||
i++;
|
||||
printf("\t; Retry\n\t\t\t\t");
|
||||
while (i < soa->len) {
|
||||
if (s[i] == ' ')
|
||||
break;
|
||||
putchar(s[i++]);
|
||||
}
|
||||
i++;
|
||||
printf("\t; Expire\n\t\t\t\t");
|
||||
while (i < soa->len) {
|
||||
putchar(s[i++]);
|
||||
}
|
||||
printf(" )\t; Minimum TTL\n");
|
||||
}
|
||||
|
||||
void printrrs(char *defaultttl, struct assstack_entry *item) {
|
||||
struct assstack_entry *stack;
|
||||
char *s;
|
||||
int first;
|
||||
size_t i;
|
||||
char *ttl, *type;
|
||||
int top;
|
||||
|
||||
s = (char *)item->key.data;
|
||||
|
||||
if (item->key.len == 1 && *s == '@') {
|
||||
top = 1;
|
||||
printf("@\t");
|
||||
} else {
|
||||
top = 0;
|
||||
for (i = 0; i < item->key.len; i++)
|
||||
putchar(s[i]);
|
||||
if (item->key.len < 8)
|
||||
putchar('\t');
|
||||
putchar('\t');
|
||||
}
|
||||
|
||||
first = 1;
|
||||
for (stack = (struct assstack_entry *) item->val.data; stack; stack = stack->next) {
|
||||
ttl = (char *)stack->key.data;
|
||||
s = strchr(ttl, ' ');
|
||||
*s++ = '\0';
|
||||
type = s;
|
||||
|
||||
if (first)
|
||||
first = 0;
|
||||
else
|
||||
printf("\t\t");
|
||||
|
||||
if (strcmp(defaultttl, ttl))
|
||||
printf("%s", ttl);
|
||||
putchar('\t');
|
||||
|
||||
if (top) {
|
||||
top = 0;
|
||||
printf("IN\t%s\t", type);
|
||||
/* Should always be SOA here */
|
||||
if (!strcmp(type, "SOA")) {
|
||||
printsoa(&stack->val);
|
||||
continue;
|
||||
}
|
||||
} else
|
||||
printf("%s\t", type);
|
||||
|
||||
s = (char *)stack->val.data;
|
||||
for (i = 0; i < stack->val.len; i++)
|
||||
putchar(s[i]);
|
||||
putchar('\n');
|
||||
}
|
||||
}
|
||||
|
||||
void print_zone(char *defaultttl, struct assstack_entry *stack) {
|
||||
printf("$TTL %s\n", defaultttl);
|
||||
for (; stack; stack = stack->next)
|
||||
printrrs(defaultttl, stack);
|
||||
};
|
||||
|
||||
void usage(char *name) {
|
||||
fprintf(stderr, "Usage:%s zone-name LDAP-URL default-ttl [serial]\n", name);
|
||||
exit(1);
|
||||
};
|
||||
|
||||
void err(char *name, const char *msg) {
|
||||
fprintf(stderr, "%s: %s\n", name, msg);
|
||||
exit(1);
|
||||
};
|
||||
|
||||
int putrr(struct assstack_entry **stack, struct berval *name, char *type, char *ttl, struct berval *val) {
|
||||
struct string key;
|
||||
struct assstack_entry *rr, *rrdata;
|
||||
|
||||
/* Do nothing if name or value have 0 length */
|
||||
if (!name->bv_len || !val->bv_len)
|
||||
return 0;
|
||||
|
||||
/* see if already have an entry for this name */
|
||||
key.len = name->bv_len;
|
||||
key.data = name->bv_val;
|
||||
|
||||
rr = assstack_find(*stack, &key);
|
||||
if (!rr) {
|
||||
/* Not found, create and push new entry */
|
||||
rr = (struct assstack_entry *) malloc(sizeof(struct assstack_entry));
|
||||
if (!rr)
|
||||
return -1;
|
||||
rr->key.len = name->bv_len;
|
||||
rr->key.data = (void *) malloc(rr->key.len);
|
||||
if (!rr->key.data) {
|
||||
free(rr);
|
||||
return -1;
|
||||
}
|
||||
memcpy(rr->key.data, name->bv_val, name->bv_len);
|
||||
rr->val.len = sizeof(void *);
|
||||
rr->val.data = NULL;
|
||||
if (name->bv_len == 1 && *(char *)name->bv_val == '@')
|
||||
assstack_push(stack, rr);
|
||||
else
|
||||
assstack_insertbottom(stack, rr);
|
||||
}
|
||||
|
||||
rrdata = (struct assstack_entry *) malloc(sizeof(struct assstack_entry));
|
||||
if (!rrdata) {
|
||||
free(rr->key.data);
|
||||
free(rr);
|
||||
return -1;
|
||||
}
|
||||
rrdata->key.len = strlen(type) + strlen(ttl) + 1;
|
||||
rrdata->key.data = (void *) malloc(rrdata->key.len);
|
||||
if (!rrdata->key.data) {
|
||||
free(rrdata);
|
||||
free(rr->key.data);
|
||||
free(rr);
|
||||
return -1;
|
||||
}
|
||||
sprintf((char *)rrdata->key.data, "%s %s", ttl, type);
|
||||
|
||||
rrdata->val.len = val->bv_len;
|
||||
rrdata->val.data = (void *) malloc(val->bv_len);
|
||||
if (!rrdata->val.data) {
|
||||
free(rrdata->key.data);
|
||||
free(rrdata);
|
||||
free(rr->key.data);
|
||||
free(rr);
|
||||
return -1;
|
||||
}
|
||||
memcpy(rrdata->val.data, val->bv_val, val->bv_len);
|
||||
|
||||
if (!strcmp(type, "SOA"))
|
||||
assstack_push((struct assstack_entry **) &(rr->val.data), rrdata);
|
||||
else
|
||||
assstack_insertbottom((struct assstack_entry **) &(rr->val.data), rrdata);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
char *s, *hostporturl, *base = NULL;
|
||||
char *ttl, *defaultttl;
|
||||
LDAP *ld;
|
||||
char *fltr = NULL;
|
||||
LDAPMessage *res, *e;
|
||||
char *a, **ttlvals, **soavals, *serial;
|
||||
struct berval **vals, **names;
|
||||
char type[64];
|
||||
BerElement *ptr;
|
||||
int i, j, rc, msgid;
|
||||
struct assstack_entry *zone = NULL;
|
||||
|
||||
if (argc < 4 || argc > 5)
|
||||
usage(argv[0]);
|
||||
|
||||
hostporturl = argv[2];
|
||||
|
||||
if (hostporturl != strstr( hostporturl, "ldap"))
|
||||
err(argv[0], "Not an LDAP URL");
|
||||
|
||||
s = strchr(hostporturl, ':');
|
||||
|
||||
if (!s || strlen(s) < 3 || s[1] != '/' || s[2] != '/')
|
||||
err(argv[0], "Not an LDAP URL");
|
||||
|
||||
s = strchr(s+3, '/');
|
||||
if (s) {
|
||||
*s++ = '\0';
|
||||
base = s;
|
||||
s = strchr(base, '?');
|
||||
if (s)
|
||||
err(argv[0], "LDAP URL can only contain host, port and base");
|
||||
}
|
||||
|
||||
defaultttl = argv[3];
|
||||
|
||||
rc = ldap_initialize(&ld, hostporturl);
|
||||
if (rc != LDAP_SUCCESS)
|
||||
err(argv[0], "ldap_initialize() failed");
|
||||
|
||||
if (argc == 5) {
|
||||
/* serial number specified, check if different from one in SOA */
|
||||
fltr = (char *)malloc(strlen(argv[1]) + strlen("(&(relativeDomainName=@)(zoneName=))") + 1);
|
||||
sprintf(fltr, "(&(relativeDomainName=@)(zoneName=%s))", argv[1]);
|
||||
msgid = ldap_search(ld, base, LDAP_SCOPE_SUBTREE, fltr, NULL, 0);
|
||||
if (msgid == -1)
|
||||
err(argv[0], "ldap_search() failed");
|
||||
|
||||
while ((rc = ldap_result(ld, msgid, 0, NULL, &res)) != LDAP_RES_SEARCH_RESULT ) {
|
||||
/* not supporting continuation references at present */
|
||||
if (rc != LDAP_RES_SEARCH_ENTRY)
|
||||
err(argv[0], "ldap_result() returned cont.ref? Exiting");
|
||||
|
||||
/* only one entry per result message */
|
||||
e = ldap_first_entry(ld, res);
|
||||
if (e == NULL) {
|
||||
ldap_msgfree(res);
|
||||
err(argv[0], "ldap_first_entry() failed");
|
||||
}
|
||||
|
||||
soavals = ldap_get_values(ld, e, "SOARecord");
|
||||
if (soavals)
|
||||
break;
|
||||
}
|
||||
|
||||
ldap_msgfree(res);
|
||||
if (!soavals) {
|
||||
err(argv[0], "No SOA Record found");
|
||||
}
|
||||
|
||||
/* We have a SOA, compare serial numbers */
|
||||
/* Only checkinf first value, should be only one */
|
||||
s = strchr(soavals[0], ' ');
|
||||
s++;
|
||||
s = strchr(s, ' ');
|
||||
s++;
|
||||
serial = s;
|
||||
s = strchr(s, ' ');
|
||||
*s = '\0';
|
||||
if (!strcmp(serial, argv[4])) {
|
||||
ldap_value_free(soavals);
|
||||
err(argv[0], "serial numbers match");
|
||||
}
|
||||
ldap_value_free(soavals);
|
||||
}
|
||||
|
||||
if (!fltr)
|
||||
fltr = (char *)malloc(strlen(argv[1]) + strlen("(zoneName=)") + 1);
|
||||
if (!fltr)
|
||||
err(argv[0], "Malloc failed");
|
||||
sprintf(fltr, "(zoneName=%s)", argv[1]);
|
||||
|
||||
msgid = ldap_search(ld, base, LDAP_SCOPE_SUBTREE, fltr, NULL, 0);
|
||||
if (msgid == -1)
|
||||
err(argv[0], "ldap_search() failed");
|
||||
|
||||
while ((rc = ldap_result(ld, msgid, 0, NULL, &res)) != LDAP_RES_SEARCH_RESULT ) {
|
||||
/* not supporting continuation references at present */
|
||||
if (rc != LDAP_RES_SEARCH_ENTRY)
|
||||
err(argv[0], "ldap_result() returned cont.ref? Exiting");
|
||||
|
||||
/* only one entry per result message */
|
||||
e = ldap_first_entry(ld, res);
|
||||
if (e == NULL) {
|
||||
ldap_msgfree(res);
|
||||
err(argv[0], "ldap_first_entry() failed");
|
||||
}
|
||||
|
||||
names = ldap_get_values_len(ld, e, "relativeDomainName");
|
||||
if (!names)
|
||||
continue;
|
||||
|
||||
ttlvals = ldap_get_values(ld, e, "dNSTTL");
|
||||
ttl = ttlvals ? ttlvals[0] : defaultttl;
|
||||
|
||||
for (a = ldap_first_attribute(ld, e, &ptr); a != NULL; a = ldap_next_attribute(ld, e, ptr)) {
|
||||
char *s;
|
||||
|
||||
for (s = a; *s; s++)
|
||||
*s = toupper(*s);
|
||||
s = strstr(a, "RECORD");
|
||||
if ((s == NULL) || (s == a) || (s - a >= (signed int)sizeof(type))) {
|
||||
ldap_memfree(a);
|
||||
continue;
|
||||
}
|
||||
|
||||
strncpy(type, a, s - a);
|
||||
type[s - a] = '\0';
|
||||
vals = ldap_get_values_len(ld, e, a);
|
||||
if (vals) {
|
||||
for (i = 0; vals[i]; i++)
|
||||
for (j = 0; names[j]; j++)
|
||||
if (putrr(&zone, names[j], type, ttl, vals[i]))
|
||||
err(argv[0], "malloc failed");
|
||||
ldap_value_free_len(vals);
|
||||
}
|
||||
ldap_memfree(a);
|
||||
}
|
||||
|
||||
if (ptr)
|
||||
ber_free(ptr, 0);
|
||||
if (ttlvals)
|
||||
ldap_value_free(ttlvals);
|
||||
ldap_value_free_len(names);
|
||||
/* free this result */
|
||||
ldap_msgfree(res);
|
||||
}
|
||||
|
||||
/* free final result */
|
||||
ldap_msgfree(res);
|
||||
|
||||
print_zone(defaultttl, zone);
|
||||
return 0;
|
||||
}
|
143
makefile-replace-libs.py
Executable file
143
makefile-replace-libs.py
Executable file
@ -0,0 +1,143 @@
|
||||
#!/usr/bin/python3
|
||||
#
|
||||
# Makefile modificator
|
||||
#
|
||||
# Should help in building bin/tests/system tests standalone,
|
||||
# linked to libraries installed into the system.
|
||||
# TODO:
|
||||
# - Fix top_srcdir, because dyndb/driver/Makefile uses $TOPSRC/mkinstalldirs
|
||||
# - Fix conf.sh to contain paths to system tools
|
||||
# - Export $TOP/version somewhere, where it would be used
|
||||
# - system tests needs bin/tests code. Do not include just bin/tests/system
|
||||
#
|
||||
# Possible solution:
|
||||
#
|
||||
# sed -e 's/$TOP\/s\?bin\/\(delv\|confgen\|named\|nsupdate\|pkcs11\|python\|rndc\|check\|dig\|dnssec\|tools\)\/\([[:alnum:]-]\+\)/`type -p \2`/' conf.sh
|
||||
# sed -e 's,../../../../\(isc-config.sh\),\1,' builtin/tests.sh
|
||||
# or use: $NAMED -V | head -1 | cut -d ' ' -f 2
|
||||
|
||||
import re
|
||||
import argparse
|
||||
|
||||
"""
|
||||
Script for replacing Makefile ISC_INCLUDES with runtime flags.
|
||||
|
||||
Should translate part of Makefile to use isc-config.sh instead static linked sources.
|
||||
ISC_INCLUDES = -I/home/pemensik/rhel/bind/bind-9.11.12/build/lib/isc/include \
|
||||
-I${top_srcdir}/lib/isc \
|
||||
-I${top_srcdir}/lib/isc/include \
|
||||
-I${top_srcdir}/lib/isc/unix/include \
|
||||
-I${top_srcdir}/lib/isc/pthreads/include \
|
||||
-I${top_srcdir}/lib/isc/x86_32/include
|
||||
|
||||
Should be translated to:
|
||||
ISC_INCLUDES = $(shell isc-config.sh --cflags isc)
|
||||
"""
|
||||
|
||||
def isc_config(mode, lib):
|
||||
if mode:
|
||||
return '$(shell isc-config.sh {mode} {lib})'.format(mode=mode, lib=lib)
|
||||
else:
|
||||
return ''
|
||||
|
||||
def check_match(match, debug=False):
|
||||
"""
|
||||
Check this definition is handled by internal library
|
||||
"""
|
||||
if not match:
|
||||
return False
|
||||
lib = match.group(2).lower()
|
||||
ok = not lib_filter or lib in lib_filter
|
||||
if debug:
|
||||
print('{status} {lib}: {text}'.format(status=ok, lib=lib, text=match.group(1)))
|
||||
return ok
|
||||
|
||||
def fix_line(match, mode):
|
||||
lib = match.group(2).lower()
|
||||
return match.group(1)+isc_config(mode, lib)+"\n"
|
||||
|
||||
def fix_file_lines(path, debug=False):
|
||||
"""
|
||||
Opens file and scans fixes selected parameters
|
||||
|
||||
Returns list of lines if something should be changed,
|
||||
None if no action is required
|
||||
"""
|
||||
fixed = []
|
||||
changed = False
|
||||
with open(path, 'r') as fin:
|
||||
fout = None
|
||||
|
||||
line = next(fin, None)
|
||||
while line:
|
||||
appended = False
|
||||
while line.endswith("\\\n"):
|
||||
line += next(fin, None)
|
||||
|
||||
inc = re_includes.match(line)
|
||||
deplibs = re_deplibs.match(line)
|
||||
libs = re_libs.match(line)
|
||||
newline = None
|
||||
if check_match(inc, debug=debug):
|
||||
newline = fix_line(inc, '--cflags')
|
||||
elif check_match(deplibs, debug=debug):
|
||||
newline = fix_line(libs, None)
|
||||
elif check_match(libs, debug=debug):
|
||||
newline = fix_line(libs, '--libs')
|
||||
|
||||
if newline and line != newline:
|
||||
changed = True
|
||||
line = newline
|
||||
|
||||
fixed.append(line)
|
||||
line = next(fin, None)
|
||||
|
||||
if not changed:
|
||||
return None
|
||||
else:
|
||||
return fixed
|
||||
|
||||
def write_lines(path, lines):
|
||||
fout = open(path, 'w')
|
||||
for line in lines:
|
||||
fout.write(line)
|
||||
fout.close()
|
||||
|
||||
def print_lines(lines):
|
||||
for line in lines:
|
||||
print(line, end='')
|
||||
|
||||
if __name__ == '__main__':
|
||||
parser = argparse.ArgumentParser(description='Makefile multiline include replacer')
|
||||
parser.add_argument('files', nargs='+')
|
||||
parser.add_argument('--filter', type=str,
|
||||
default='isc isccc isccfg dns lwres bind9 irs',
|
||||
help='List of libraries supported by isc-config.sh')
|
||||
parser.add_argument('--check', action='store_true',
|
||||
help='Test file only')
|
||||
parser.add_argument('--print', action='store_true',
|
||||
help='Print changed file only')
|
||||
parser.add_argument('--debug', action='store_true',
|
||||
help='Enable debug outputs')
|
||||
|
||||
args = parser.parse_args()
|
||||
lib_filter = None
|
||||
|
||||
re_includes = re.compile(r'^\s*((\w+)_INCLUDES\s+=\s*).*')
|
||||
re_deplibs = re.compile(r'^\s*((\w+)DEPLIBS\s*=).*')
|
||||
re_libs = re.compile(r'^\s*((\w+)LIBS\s*=).*')
|
||||
|
||||
if args.filter:
|
||||
lib_filter = set(args.filter.split(' '))
|
||||
pass
|
||||
|
||||
for path in args.files:
|
||||
lines = fix_file_lines(path, debug=args.debug)
|
||||
if lines:
|
||||
if args.print:
|
||||
print_lines(lines)
|
||||
elif not args.check:
|
||||
write_lines(path, lines)
|
||||
print('File {path} was fixed'.format(path=path))
|
||||
else:
|
||||
print('File {path} does not need fixing'.format(path=path))
|
12
named-chroot-setup.service
Normal file
12
named-chroot-setup.service
Normal file
@ -0,0 +1,12 @@
|
||||
[Unit]
|
||||
Description=Set-up/destroy chroot environment for named (DNS)
|
||||
BindsTo=named-chroot.service
|
||||
Wants=named-setup-rndc.service
|
||||
After=named-setup-rndc.service
|
||||
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
|
||||
ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files
|
24
named-chroot.files
Normal file
24
named-chroot.files
Normal file
@ -0,0 +1,24 @@
|
||||
# Configuration of files used in chroot
|
||||
# Following files are made available after named-chroot.service start
|
||||
# if they are missing or empty in target directory.
|
||||
/etc/localtime
|
||||
/etc/named.root.key
|
||||
/etc/named.conf
|
||||
/etc/named.rfc1912.zones
|
||||
/etc/rndc.conf
|
||||
/etc/rndc.key
|
||||
/etc/named.iscdlv.key
|
||||
/etc/crypto-policies/back-ends/bind.config
|
||||
/etc/protocols
|
||||
/etc/services
|
||||
/etc/named.dnssec.keys
|
||||
/etc/pki/dnssec-keys
|
||||
/etc/named
|
||||
/usr/lib64/bind
|
||||
/usr/lib/bind
|
||||
/usr/share/GeoIP
|
||||
/run/named
|
||||
# Warning: the order is important
|
||||
# If a directory containing $ROOTDIR is listed here,
|
||||
# it MUST be listed last. (/var/named contains /var/named/chroot)
|
||||
/var/named
|
30
named-chroot.service
Normal file
30
named-chroot.service
Normal file
@ -0,0 +1,30 @@
|
||||
# Don't forget to add "$AddUnixListenSocket /var/named/chroot/dev/log"
|
||||
# line to your /etc/rsyslog.conf file. Otherwise your logging becomes
|
||||
# broken when rsyslogd daemon is restarted (due update, for example).
|
||||
|
||||
[Unit]
|
||||
Description=Berkeley Internet Name Domain (DNS)
|
||||
Wants=nss-lookup.target
|
||||
Requires=named-chroot-setup.service
|
||||
Before=nss-lookup.target
|
||||
After=named-chroot-setup.service
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
Environment=NAMEDCONF=/etc/named.conf
|
||||
EnvironmentFile=-/etc/sysconfig/named
|
||||
Environment=KRB5_KTNAME=/etc/named.keytab
|
||||
PIDFile=/var/named/chroot/run/named/named.pid
|
||||
|
||||
ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
|
||||
ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
|
||||
|
||||
ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
|
||||
|
||||
ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
|
||||
|
||||
PrivateTmp=false
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
26
named-pkcs11.service
Normal file
26
named-pkcs11.service
Normal file
@ -0,0 +1,26 @@
|
||||
[Unit]
|
||||
Description=Berkeley Internet Name Domain (DNS) with native PKCS#11
|
||||
Wants=nss-lookup.target
|
||||
Wants=named-setup-rndc.service
|
||||
Before=nss-lookup.target
|
||||
After=network.target
|
||||
After=named-setup-rndc.service
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
Environment=NAMEDCONF=/etc/named.conf
|
||||
EnvironmentFile=-/etc/sysconfig/named
|
||||
Environment=KRB5_KTNAME=/etc/named.keytab
|
||||
PIDFile=/run/named/named.pid
|
||||
|
||||
ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
|
||||
ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
|
||||
|
||||
ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
|
||||
|
||||
ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
|
||||
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
12
named-sdb-chroot-setup.service
Normal file
12
named-sdb-chroot-setup.service
Normal file
@ -0,0 +1,12 @@
|
||||
[Unit]
|
||||
Description=Set-up/destroy chroot environment for named-sdb
|
||||
BindsTo=named-sdb-chroot.service
|
||||
Wants=named-setup-rndc.service
|
||||
After=named-setup-rndc.service
|
||||
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot_sdb on /etc/named-chroot.files
|
||||
ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot_sdb off /etc/named-chroot.files
|
30
named-sdb-chroot.service
Normal file
30
named-sdb-chroot.service
Normal file
@ -0,0 +1,30 @@
|
||||
# Don't forget to add "$AddUnixListenSocket /var/named/chroot_sdb/dev/log"
|
||||
# line to your /etc/rsyslog.conf file. Otherwise your logging becomes
|
||||
# broken when rsyslogd daemon is restarted (due update, for example).
|
||||
|
||||
[Unit]
|
||||
Description=Berkeley Internet Name Domain (DNS)
|
||||
Wants=nss-lookup.target
|
||||
Requires=named-sdb-chroot-setup.service
|
||||
Before=nss-lookup.target
|
||||
After=named-sdb-chroot-setup.service
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
Environment=NAMEDCONF=/etc/named.conf
|
||||
EnvironmentFile=-/etc/sysconfig/named
|
||||
Environment=KRB5_KTNAME=/etc/named.keytab
|
||||
PIDFile=/var/named/chroot_sdb/run/named/named.pid
|
||||
|
||||
ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot_sdb -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
|
||||
ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} -t /var/named/chroot_sdb $OPTIONS
|
||||
|
||||
ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
|
||||
|
||||
ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
|
||||
|
||||
PrivateTmp=false
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
1
named-sdb.8
Normal file
1
named-sdb.8
Normal file
@ -0,0 +1 @@
|
||||
.so man8/named.8.gz
|
26
named-sdb.service
Normal file
26
named-sdb.service
Normal file
@ -0,0 +1,26 @@
|
||||
[Unit]
|
||||
Description=Berkeley Internet Name Domain (DNS)
|
||||
Wants=nss-lookup.target
|
||||
Wants=named-setup-rndc.service
|
||||
Before=nss-lookup.target
|
||||
After=named-setup-rndc.service
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
Environment=NAMEDCONF=/etc/named.conf
|
||||
EnvironmentFile=-/etc/sysconfig/named
|
||||
Environment=KRB5_KTNAME=/etc/named.keytab
|
||||
PIDFile=/run/named/named.pid
|
||||
|
||||
ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
|
||||
ExecStart=/usr/sbin/named-sdb -u named -c ${NAMEDCONF} $OPTIONS
|
||||
|
||||
ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
|
||||
|
||||
ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
|
||||
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
7
named-setup-rndc.service
Normal file
7
named-setup-rndc.service
Normal file
@ -0,0 +1,7 @@
|
||||
[Unit]
|
||||
Description=Generate rndc key for BIND (DNS)
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
|
||||
ExecStart=/usr/libexec/generate-rndc-key.sh
|
60
named.conf
Normal file
60
named.conf
Normal file
@ -0,0 +1,60 @@
|
||||
//
|
||||
// named.conf
|
||||
//
|
||||
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
|
||||
// server as a caching only nameserver (as a localhost DNS resolver only).
|
||||
//
|
||||
// See /usr/share/doc/bind*/sample/ for example named configuration files.
|
||||
//
|
||||
|
||||
options {
|
||||
listen-on port 53 { 127.0.0.1; };
|
||||
listen-on-v6 port 53 { ::1; };
|
||||
directory "/var/named";
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||||
secroots-file "/var/named/data/named.secroots";
|
||||
recursing-file "/var/named/data/named.recursing";
|
||||
allow-query { localhost; };
|
||||
|
||||
/*
|
||||
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
|
||||
- If you are building a RECURSIVE (caching) DNS server, you need to enable
|
||||
recursion.
|
||||
- If your recursive DNS server has a public IP address, you MUST enable access
|
||||
control to limit queries to your legitimate users. Failing to do so will
|
||||
cause your server to become part of large scale DNS amplification
|
||||
attacks. Implementing BCP38 within your network would greatly
|
||||
reduce such attack surface
|
||||
*/
|
||||
recursion yes;
|
||||
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
|
||||
managed-keys-directory "/var/named/dynamic";
|
||||
geoip-directory "/usr/share/GeoIP";
|
||||
|
||||
pid-file "/run/named/named.pid";
|
||||
session-keyfile "/run/named/session.key";
|
||||
|
||||
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
|
||||
include "/etc/crypto-policies/back-ends/bind.config";
|
||||
};
|
||||
|
||||
logging {
|
||||
channel default_debug {
|
||||
file "data/named.run";
|
||||
severity dynamic;
|
||||
};
|
||||
};
|
||||
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "named.ca";
|
||||
};
|
||||
|
||||
include "/etc/named.rfc1912.zones";
|
||||
include "/etc/named.root.key";
|
||||
|
252
named.conf.sample
Normal file
252
named.conf.sample
Normal file
@ -0,0 +1,252 @@
|
||||
/*
|
||||
Sample named.conf BIND DNS server 'named' configuration file
|
||||
for the Red Hat BIND distribution.
|
||||
|
||||
See the BIND Administrator's Reference Manual (ARM) for details, in:
|
||||
file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
|
||||
Also see the BIND Configuration GUI : /usr/bin/system-config-bind and
|
||||
its manual.
|
||||
*/
|
||||
|
||||
options
|
||||
{
|
||||
// Put files that named is allowed to write in the data/ directory:
|
||||
directory "/var/named"; // "Working" directory
|
||||
dump-file "data/cache_dump.db";
|
||||
statistics-file "data/named_stats.txt";
|
||||
memstatistics-file "data/named_mem_stats.txt";
|
||||
secroots-file "data/named.secroots";
|
||||
recursing-file "data/named.recursing";
|
||||
|
||||
|
||||
/*
|
||||
Specify listenning interfaces. You can use list of addresses (';' is
|
||||
delimiter) or keywords "any"/"none"
|
||||
*/
|
||||
//listen-on port 53 { any; };
|
||||
listen-on port 53 { 127.0.0.1; };
|
||||
|
||||
//listen-on-v6 port 53 { any; };
|
||||
listen-on-v6 port 53 { ::1; };
|
||||
|
||||
/*
|
||||
Access restrictions
|
||||
|
||||
There are two important options:
|
||||
allow-query { argument; };
|
||||
- allow queries for authoritative data
|
||||
|
||||
allow-query-cache { argument; };
|
||||
- allow queries for non-authoritative data (mostly cached data)
|
||||
|
||||
You can use address, network address or keywords "any"/"localhost"/"none" as argument
|
||||
Examples:
|
||||
allow-query { localhost; 10.0.0.1; 192.168.1.0/8; };
|
||||
allow-query-cache { ::1; fe80::5c63:a8ff:fe2f:4526; 10.0.0.1; };
|
||||
*/
|
||||
|
||||
allow-query { localhost; };
|
||||
allow-query-cache { localhost; };
|
||||
|
||||
/* Enable/disable recursion - recursion yes/no;
|
||||
|
||||
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
|
||||
- If you are building a RECURSIVE (caching) DNS server, you need to enable
|
||||
recursion.
|
||||
- If your recursive DNS server has a public IP address, you MUST enable access
|
||||
control to limit queries to your legitimate users. Failing to do so will
|
||||
cause your server to become part of large scale DNS amplification
|
||||
attacks. Implementing BCP38 within your network would greatly
|
||||
reduce such attack surface
|
||||
*/
|
||||
recursion yes;
|
||||
|
||||
/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */
|
||||
|
||||
/* Enable serving of DNSSEC related data - enable on both authoritative
|
||||
and recursive servers DNSSEC aware servers */
|
||||
dnssec-enable yes;
|
||||
|
||||
/* Enable DNSSEC validation on recursive servers */
|
||||
dnssec-validation yes;
|
||||
|
||||
/* In Fedora we use /run/named instead of default /var/run/named
|
||||
so we have to configure paths properly. */
|
||||
pid-file "/run/named/named.pid";
|
||||
session-keyfile "/run/named/session.key";
|
||||
|
||||
managed-keys-directory "/var/named/dynamic";
|
||||
|
||||
/* In Fedora we use system-wide Crypto Policy */
|
||||
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
|
||||
include "/etc/crypto-policies/back-ends/bind.config";
|
||||
};
|
||||
|
||||
logging
|
||||
{
|
||||
/* If you want to enable debugging, eg. using the 'rndc trace' command,
|
||||
* named will try to write the 'named.run' file in the $directory (/var/named).
|
||||
* By default, SELinux policy does not allow named to modify the /var/named directory,
|
||||
* so put the default debug log file in data/ :
|
||||
*/
|
||||
channel default_debug {
|
||||
file "data/named.run";
|
||||
severity dynamic;
|
||||
};
|
||||
};
|
||||
|
||||
/*
|
||||
Views let a name server answer a DNS query differently depending on who is asking.
|
||||
|
||||
By default, if named.conf contains no "view" clauses, all zones are in the
|
||||
"default" view, which matches all clients.
|
||||
|
||||
Views are processed sequentially. The first match is used so the last view should
|
||||
match "any" - it's fallback and the most restricted view.
|
||||
|
||||
If named.conf contains any "view" clause, then all zones MUST be in a view.
|
||||
*/
|
||||
|
||||
view "localhost_resolver"
|
||||
{
|
||||
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
|
||||
* If all you want is a caching-only nameserver, then you need only define this view:
|
||||
*/
|
||||
match-clients { localhost; };
|
||||
recursion yes;
|
||||
|
||||
# all views must contain the root hints zone:
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "/var/named/named.ca";
|
||||
};
|
||||
|
||||
/* these are zones that contain definitions for all the localhost
|
||||
* names and addresses, as recommended in RFC1912 - these names should
|
||||
* not leak to the other nameservers:
|
||||
*/
|
||||
include "/etc/named.rfc1912.zones";
|
||||
};
|
||||
view "internal"
|
||||
{
|
||||
/* This view will contain zones you want to serve only to "internal" clients
|
||||
that connect via your directly attached LAN interfaces - "localnets" .
|
||||
*/
|
||||
match-clients { localnets; };
|
||||
recursion yes;
|
||||
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "/var/named/named.ca";
|
||||
};
|
||||
|
||||
/* these are zones that contain definitions for all the localhost
|
||||
* names and addresses, as recommended in RFC1912 - these names should
|
||||
* not leak to the other nameservers:
|
||||
*/
|
||||
include "/etc/named.rfc1912.zones";
|
||||
|
||||
// These are your "authoritative" internal zones, and would probably
|
||||
// also be included in the "localhost_resolver" view above :
|
||||
|
||||
/*
|
||||
NOTE for dynamic DNS zones and secondary zones:
|
||||
|
||||
DO NOT USE SAME FILES IN MULTIPLE VIEWS!
|
||||
|
||||
If you are using views and DDNS/secondary zones it is strongly
|
||||
recommended to read FAQ on ISC site (www.isc.org), section
|
||||
"Configuration and Setup Questions", questions
|
||||
"How do I share a dynamic zone between multiple views?" and
|
||||
"How can I make a server a slave for both an internal and an external
|
||||
view at the same time?"
|
||||
*/
|
||||
|
||||
zone "my.internal.zone" {
|
||||
type master;
|
||||
file "my.internal.zone.db";
|
||||
};
|
||||
zone "my.slave.internal.zone" {
|
||||
type slave;
|
||||
file "slaves/my.slave.internal.zone.db";
|
||||
masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
|
||||
// put slave zones in the slaves/ directory so named can update them
|
||||
};
|
||||
zone "my.ddns.internal.zone" {
|
||||
type master;
|
||||
allow-update { key ddns_key; };
|
||||
file "dynamic/my.ddns.internal.zone.db";
|
||||
// put dynamically updateable zones in the slaves/ directory so named can update them
|
||||
};
|
||||
};
|
||||
|
||||
key ddns_key
|
||||
{
|
||||
algorithm hmac-md5;
|
||||
secret "use /usr/sbin/dnssec-keygen to generate TSIG keys";
|
||||
};
|
||||
|
||||
view "external"
|
||||
{
|
||||
/* This view will contain zones you want to serve only to "external" clients
|
||||
* that have addresses that are not match any above view:
|
||||
*/
|
||||
match-clients { any; };
|
||||
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "/var/named/named.ca";
|
||||
};
|
||||
|
||||
recursion no;
|
||||
// you'd probably want to deny recursion to external clients, so you don't
|
||||
// end up providing free DNS service to all takers
|
||||
|
||||
// These are your "authoritative" external zones, and would probably
|
||||
// contain entries for just your web and mail servers:
|
||||
|
||||
zone "my.external.zone" {
|
||||
type master;
|
||||
file "my.external.zone.db";
|
||||
};
|
||||
};
|
||||
|
||||
/* Trusted keys
|
||||
|
||||
This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
|
||||
have to configure at least one trusted key.
|
||||
|
||||
Note that no key written below is valid. Especially root key because root zone
|
||||
is not signed yet.
|
||||
*/
|
||||
/*
|
||||
trusted-keys {
|
||||
// Root Key
|
||||
"." 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwSJxrGkxJWoZu6I7PzJu/
|
||||
E9gx4UC1zGAHlXKdE4zYIpRhaBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3
|
||||
zy2Xy4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYghf+6fElrmLkdaz
|
||||
MQ2OCnACR817DF4BBa7UR/beDHyp5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M
|
||||
/lUUVRbkeg1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq66gKodQj+M
|
||||
iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
|
||||
Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";
|
||||
|
||||
// Key for forward zone
|
||||
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
|
||||
3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
|
||||
OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
|
||||
lrinKJp1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt
|
||||
8lgnyTUHs1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/b
|
||||
iuvF4qJCyduieHukuY3H4XMAcR+xia2 nIUPvm/oyWR8BW/hWdzOvn
|
||||
SCThlHf3xiYleDbt/o1OTQ09A0=";
|
||||
|
||||
// Key for reverse zone.
|
||||
2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwcxOdNax071L18QqZnQQQA
|
||||
VVr+iLhGTnNGp3HoWQLUIzKrJVZ3zggy3WwNT6kZo6c0
|
||||
tszYqbtvchmgQC8CzKojM/W16i6MG/ea fGU3siaOdS0
|
||||
yOI6BgPsw+YZdzlYMaIJGf4M4dyoKIhzdZyQ2bYQrjyQ
|
||||
4LB0lC7aOnsMyYKHHYeRv PxjIQXmdqgOJGq+vsevG06
|
||||
zW+1xgYJh9rCIfnm1GX/KMgxLPG2vXTD/RnLX+D3T3UL
|
||||
7HJYHJhAZD5L59VvjSPsZJHeDCUyWYrvPZesZDIRvhDD
|
||||
52SKvbheeTJUm6EhkzytNN2SN96QRk8j/iI8ib";
|
||||
};
|
||||
*/
|
10
named.empty
Normal file
10
named.empty
Normal file
@ -0,0 +1,10 @@
|
||||
$TTL 3H
|
||||
@ IN SOA @ rname.invalid. (
|
||||
0 ; serial
|
||||
1D ; refresh
|
||||
1H ; retry
|
||||
1W ; expire
|
||||
3H ) ; minimum
|
||||
NS @
|
||||
A 127.0.0.1
|
||||
AAAA ::1
|
10
named.localhost
Normal file
10
named.localhost
Normal file
@ -0,0 +1,10 @@
|
||||
$TTL 1D
|
||||
@ IN SOA @ rname.invalid. (
|
||||
0 ; serial
|
||||
1D ; refresh
|
||||
1H ; retry
|
||||
1W ; expire
|
||||
3H ) ; minimum
|
||||
NS @
|
||||
A 127.0.0.1
|
||||
AAAA ::1
|
12
named.logrotate
Normal file
12
named.logrotate
Normal file
@ -0,0 +1,12 @@
|
||||
/var/named/data/named.run {
|
||||
missingok
|
||||
su named named
|
||||
create 0644 named named
|
||||
postrotate
|
||||
/usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
|
||||
/usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
|
||||
/usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
|
||||
/usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
|
||||
/usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
|
||||
endscript
|
||||
}
|
11
named.loopback
Normal file
11
named.loopback
Normal file
@ -0,0 +1,11 @@
|
||||
$TTL 1D
|
||||
@ IN SOA @ rname.invalid. (
|
||||
0 ; serial
|
||||
1D ; refresh
|
||||
1H ; retry
|
||||
1W ; expire
|
||||
3H ) ; minimum
|
||||
NS @
|
||||
A 127.0.0.1
|
||||
AAAA ::1
|
||||
PTR localhost.
|
45
named.rfc1912.zones
Normal file
45
named.rfc1912.zones
Normal file
@ -0,0 +1,45 @@
|
||||
// named.rfc1912.zones:
|
||||
//
|
||||
// Provided by Red Hat caching-nameserver package
|
||||
//
|
||||
// ISC BIND named zone configuration for zones recommended by
|
||||
// RFC 1912 section 4.1 : localhost TLDs and address zones
|
||||
// and https://tools.ietf.org/html/rfc6303
|
||||
// (c)2007 R W Franks
|
||||
//
|
||||
// See /usr/share/doc/bind*/sample/ for example named configuration files.
|
||||
//
|
||||
// Note: empty-zones-enable yes; option is default.
|
||||
// If private ranges should be forwarded, add
|
||||
// disable-empty-zone "."; into options
|
||||
//
|
||||
|
||||
zone "localhost.localdomain" IN {
|
||||
type master;
|
||||
file "named.localhost";
|
||||
allow-update { none; };
|
||||
};
|
||||
|
||||
zone "localhost" IN {
|
||||
type master;
|
||||
file "named.localhost";
|
||||
allow-update { none; };
|
||||
};
|
||||
|
||||
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
|
||||
type master;
|
||||
file "named.loopback";
|
||||
allow-update { none; };
|
||||
};
|
||||
|
||||
zone "1.0.0.127.in-addr.arpa" IN {
|
||||
type master;
|
||||
file "named.loopback";
|
||||
allow-update { none; };
|
||||
};
|
||||
|
||||
zone "0.in-addr.arpa" IN {
|
||||
type master;
|
||||
file "named.empty";
|
||||
allow-update { none; };
|
||||
};
|
61
named.root
Normal file
61
named.root
Normal file
@ -0,0 +1,61 @@
|
||||
|
||||
; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
|
||||
; (2 servers found)
|
||||
;; global options: +cmd
|
||||
;; Got answer:
|
||||
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
|
||||
;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
|
||||
|
||||
;; OPT PSEUDOSECTION:
|
||||
; EDNS: version: 0, flags:; udp: 1472
|
||||
;; QUESTION SECTION:
|
||||
;. IN NS
|
||||
|
||||
;; ANSWER SECTION:
|
||||
. 518400 IN NS a.root-servers.net.
|
||||
. 518400 IN NS b.root-servers.net.
|
||||
. 518400 IN NS c.root-servers.net.
|
||||
. 518400 IN NS d.root-servers.net.
|
||||
. 518400 IN NS e.root-servers.net.
|
||||
. 518400 IN NS f.root-servers.net.
|
||||
. 518400 IN NS g.root-servers.net.
|
||||
. 518400 IN NS h.root-servers.net.
|
||||
. 518400 IN NS i.root-servers.net.
|
||||
. 518400 IN NS j.root-servers.net.
|
||||
. 518400 IN NS k.root-servers.net.
|
||||
. 518400 IN NS l.root-servers.net.
|
||||
. 518400 IN NS m.root-servers.net.
|
||||
|
||||
;; ADDITIONAL SECTION:
|
||||
a.root-servers.net. 518400 IN A 198.41.0.4
|
||||
b.root-servers.net. 518400 IN A 199.9.14.201
|
||||
c.root-servers.net. 518400 IN A 192.33.4.12
|
||||
d.root-servers.net. 518400 IN A 199.7.91.13
|
||||
e.root-servers.net. 518400 IN A 192.203.230.10
|
||||
f.root-servers.net. 518400 IN A 192.5.5.241
|
||||
g.root-servers.net. 518400 IN A 192.112.36.4
|
||||
h.root-servers.net. 518400 IN A 198.97.190.53
|
||||
i.root-servers.net. 518400 IN A 192.36.148.17
|
||||
j.root-servers.net. 518400 IN A 192.58.128.30
|
||||
k.root-servers.net. 518400 IN A 193.0.14.129
|
||||
l.root-servers.net. 518400 IN A 199.7.83.42
|
||||
m.root-servers.net. 518400 IN A 202.12.27.33
|
||||
a.root-servers.net. 518400 IN AAAA 2001:503:ba3e::2:30
|
||||
b.root-servers.net. 518400 IN AAAA 2001:500:200::b
|
||||
c.root-servers.net. 518400 IN AAAA 2001:500:2::c
|
||||
d.root-servers.net. 518400 IN AAAA 2001:500:2d::d
|
||||
e.root-servers.net. 518400 IN AAAA 2001:500:a8::e
|
||||
f.root-servers.net. 518400 IN AAAA 2001:500:2f::f
|
||||
g.root-servers.net. 518400 IN AAAA 2001:500:12::d0d
|
||||
h.root-servers.net. 518400 IN AAAA 2001:500:1::53
|
||||
i.root-servers.net. 518400 IN AAAA 2001:7fe::53
|
||||
j.root-servers.net. 518400 IN AAAA 2001:503:c27::2:30
|
||||
k.root-servers.net. 518400 IN AAAA 2001:7fd::1
|
||||
l.root-servers.net. 518400 IN AAAA 2001:500:9f::42
|
||||
m.root-servers.net. 518400 IN AAAA 2001:dc3::35
|
||||
|
||||
;; Query time: 24 msec
|
||||
;; SERVER: 198.41.0.4#53(198.41.0.4)
|
||||
;; WHEN: Thu Apr 05 15:57:34 CEST 2018
|
||||
;; MSG SIZE rcvd: 811
|
||||
|
19
named.root.key
Normal file
19
named.root.key
Normal file
@ -0,0 +1,19 @@
|
||||
managed-keys {
|
||||
# ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
|
||||
# for current trust anchor information.
|
||||
#
|
||||
# This key (20326) was published in the root zone in 2017.
|
||||
# Servers which were already using the old key (19036) should
|
||||
# roll seamlessly to this new one via RFC 5011 rollover. Servers
|
||||
# being set up for the first time can use the contents of this
|
||||
# file as initializing keys; thereafter, the keys in the
|
||||
# managed key database will be trusted and maintained
|
||||
# automatically.
|
||||
. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
|
||||
+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
|
||||
ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
|
||||
0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
|
||||
oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
|
||||
RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
|
||||
R1AkUTV74bU=";
|
||||
};
|
6
named.rwtab
Normal file
6
named.rwtab
Normal file
@ -0,0 +1,6 @@
|
||||
dirs /var/named
|
||||
|
||||
files /var/named/named.ca
|
||||
files /var/named/named.empty
|
||||
files /var/named/named.localhost
|
||||
files /var/named/named.loopback
|
25
named.service
Normal file
25
named.service
Normal file
@ -0,0 +1,25 @@
|
||||
[Unit]
|
||||
Description=Berkeley Internet Name Domain (DNS)
|
||||
Wants=nss-lookup.target
|
||||
Wants=named-setup-rndc.service
|
||||
Before=nss-lookup.target
|
||||
After=named-setup-rndc.service
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
Environment=NAMEDCONF=/etc/named.conf
|
||||
EnvironmentFile=-/etc/sysconfig/named
|
||||
Environment=KRB5_KTNAME=/etc/named.keytab
|
||||
PIDFile=/run/named/named.pid
|
||||
|
||||
ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
|
||||
ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
|
||||
ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
|
||||
|
||||
ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
|
||||
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
17
named.sysconfig
Normal file
17
named.sysconfig
Normal file
@ -0,0 +1,17 @@
|
||||
# BIND named process options
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# OPTIONS="whatever" -- These additional options will be passed to named
|
||||
# at startup. Don't add -t here, enable proper
|
||||
# -chroot.service unit file.
|
||||
#
|
||||
# NAMEDCONF=/etc/named/alternate.conf
|
||||
# -- Don't use -c to change configuration file.
|
||||
# Extend systemd named.service instead or use this
|
||||
# variable.
|
||||
#
|
||||
# DISABLE_ZONE_CHECKING -- By default, service file calls named-checkzone
|
||||
# utility for every zone to ensure all zones are
|
||||
# valid before named starts. If you set this option
|
||||
# to 'yes' then service file doesn't perform those
|
||||
# checks.
|
BIN
random.data
Normal file
BIN
random.data
Normal file
Binary file not shown.
117
setup-named-chroot.sh
Executable file
117
setup-named-chroot.sh
Executable file
@ -0,0 +1,117 @@
|
||||
#!/bin/bash
|
||||
|
||||
ROOTDIR="$1"
|
||||
CONFIG_FILES="${3:-/etc/named-chroot.files}"
|
||||
|
||||
usage()
|
||||
{
|
||||
echo
|
||||
echo 'This script setups chroot environment for BIND'
|
||||
echo 'Usage: setup-named-chroot.sh ROOTDIR <on|off> [chroot.files]'
|
||||
}
|
||||
|
||||
if ! [ "$#" -ge 2 -a "$#" -le 3 ]; then
|
||||
echo 'Wrong number of arguments'
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Exit if ROOTDIR doesn't exist
|
||||
if ! [ -d "$ROOTDIR" ]; then
|
||||
echo "Root directory $ROOTDIR doesn't exist"
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! [ -r "$CONFIG_FILES" ]; then
|
||||
echo "Files list $CONFIG_FILES doesn't exist" 2>&1
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
dev_create()
|
||||
{
|
||||
DEVNAME="$ROOTDIR/dev/$1"
|
||||
shift
|
||||
if ! [ -e "$DEVNAME" ]; then
|
||||
/bin/mknod -m 0664 "$DEVNAME" $@
|
||||
/bin/chgrp named "$DEVNAME"
|
||||
if [ -x /usr/sbin/selinuxenabled -a -x /sbin/restorecon ]; then
|
||||
/usr/sbin/selinuxenabled && /sbin/restorecon "$DEVNAME" > /dev/null || :
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
dev_chroot_prep()
|
||||
{
|
||||
dev_create random c 1 8
|
||||
dev_create urandom c 1 9
|
||||
dev_create zero c 1 5
|
||||
dev_create null c 1 3
|
||||
}
|
||||
|
||||
files_comment_filter()
|
||||
{
|
||||
if [ -d "$1" ]; then
|
||||
grep -v '^[[:space:]]*#' "$1"/*.files
|
||||
else
|
||||
grep -v '^[[:space:]]*#' "$1"
|
||||
fi
|
||||
}
|
||||
|
||||
mount_chroot_conf()
|
||||
{
|
||||
if [ -n "$ROOTDIR" ]; then
|
||||
# Check devices are prepared
|
||||
dev_chroot_prep
|
||||
files_comment_filter "$CONFIG_FILES" | while read -r all; do
|
||||
# Skip nonexistant files
|
||||
[ -e "$all" ] || continue
|
||||
|
||||
# If mount source is a file
|
||||
if ! [ -d "$all" ]; then
|
||||
# mount it only if it is not present in chroot or it is empty
|
||||
if ! [ -e "$ROOTDIR$all" ] || [ `stat -c'%s' "$ROOTDIR$all"` -eq 0 ]; then
|
||||
touch "$ROOTDIR$all"
|
||||
mount --bind "$all" "$ROOTDIR$all"
|
||||
fi
|
||||
else
|
||||
# Mount source is a directory. Mount it only if directory in chroot is
|
||||
# empty.
|
||||
if [ -e "$all" ] && [ `ls -1A $ROOTDIR$all | wc -l` -eq 0 ]; then
|
||||
mount --bind --make-private "$all" "$ROOTDIR$all"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
umount_chroot_conf()
|
||||
{
|
||||
if [ -n "$ROOTDIR" ]; then
|
||||
files_comment_filter "$CONFIG_FILES" | while read -r all; do
|
||||
# Check if file is mount target. Do not use /proc/mounts because detecting
|
||||
# of modified mounted files can fail.
|
||||
if mount | grep -q '.* on '"$ROOTDIR$all"' .*'; then
|
||||
umount "$ROOTDIR$all"
|
||||
# Remove temporary created files
|
||||
[ -f "$all" ] && rm -f "$ROOTDIR$all"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
case "$2" in
|
||||
on)
|
||||
mount_chroot_conf
|
||||
;;
|
||||
off)
|
||||
umount_chroot_conf
|
||||
;;
|
||||
*)
|
||||
echo 'Second argument has to be "on" or "off"'
|
||||
usage
|
||||
exit 1
|
||||
esac
|
||||
|
||||
exit 0
|
124
setup-named-softhsm.sh
Executable file
124
setup-named-softhsm.sh
Executable file
@ -0,0 +1,124 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This script will initialise token storage of softhsm PKCS11 provider
|
||||
# in custom location. Is useful to store tokens in non-standard location.
|
||||
#
|
||||
# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
|
||||
# Quotes around eval are mandatory!
|
||||
# Recommended use:
|
||||
# eval "$(bash setup-named-softhsm.sh -A)"
|
||||
#
|
||||
|
||||
SOFTHSM2_CONF="$1"
|
||||
TOKENPATH="$2"
|
||||
GROUPNAME="$3"
|
||||
# Do not use this script for real keys worth protection
|
||||
# This is intended for crypto accelerators using PKCS11 interface.
|
||||
# Uninitialized token would fail any crypto operation.
|
||||
PIN=1234
|
||||
SO_PIN=1234
|
||||
LABEL=rpm
|
||||
|
||||
set -e
|
||||
|
||||
echo_i()
|
||||
{
|
||||
echo "#" $@
|
||||
}
|
||||
|
||||
random()
|
||||
{
|
||||
if [ -x "$(which openssl 2>/dev/null)" ]; then
|
||||
openssl rand -base64 $1
|
||||
else
|
||||
dd if=/dev/urandom bs=1c count=$1 | base64
|
||||
fi
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
echo "Usage: $0 -A [token directory] [group]"
|
||||
echo " or: $0 <config file> <token directory> [group]"
|
||||
}
|
||||
|
||||
if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
|
||||
TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
|
||||
fi
|
||||
|
||||
if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
|
||||
usage >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$SOFTHSM2_CONF" = "-A" ]; then
|
||||
# Automagic mode instead
|
||||
MODE=secure
|
||||
SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
|
||||
PIN_SOURCE="$TOKENPATH/pin"
|
||||
SOPIN_SOURCE="$TOKENPATH/so-pin"
|
||||
TOKENPATH="$TOKENPATH/tokens"
|
||||
else
|
||||
MODE=legacy
|
||||
fi
|
||||
|
||||
[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
|
||||
|
||||
umask 0022
|
||||
|
||||
if ! [ -f "$SOFTHSM2_CONF" ]; then
|
||||
cat << SED > "$SOFTHSM2_CONF"
|
||||
# SoftHSM v2 configuration file
|
||||
|
||||
directories.tokendir = ${TOKENPATH}
|
||||
objectstore.backend = file
|
||||
|
||||
# ERROR, WARNING, INFO, DEBUG
|
||||
log.level = ERROR
|
||||
|
||||
# If CKF_REMOVABLE_DEVICE flag should be set
|
||||
slots.removable = false
|
||||
SED
|
||||
else
|
||||
echo_i "Config file $SOFTHSM2_CONF already exists" >&2
|
||||
fi
|
||||
|
||||
if [ -n "$PIN_SOURCE" ]; then
|
||||
touch "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
if [ -n "$GROUPNAME" ]; then
|
||||
chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
fi
|
||||
fi
|
||||
|
||||
export SOFTHSM2_CONF
|
||||
|
||||
if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
|
||||
then
|
||||
echo_i "Token in ${TOKENPATH} is already initialized" >&2
|
||||
|
||||
[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
|
||||
[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
|
||||
else
|
||||
PIN=$(random 6)
|
||||
SO_PIN=$(random 18)
|
||||
if [ -n "$PIN_SOURCE" ]; then
|
||||
echo -n "$PIN" > "$PIN_SOURCE"
|
||||
echo -n "$SO_PIN" > "$SOPIN_SOURCE"
|
||||
fi
|
||||
|
||||
echo_i "Initializing tokens to ${TOKENPATH}..."
|
||||
softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
|
||||
|
||||
if [ -n "$GROUPNAME" ]; then
|
||||
chgrp -R -- "$GROUPNAME" "$TOKENPATH"
|
||||
chmod -R -- g=rX,o= "$TOKENPATH"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
|
||||
echo "export PIN_SOURCE=\"$PIN_SOURCE\""
|
||||
echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
|
||||
# These are intentionaly not exported
|
||||
echo "PIN=\"$PIN\""
|
||||
echo "SO_PIN=\"$SO_PIN\""
|
10
softhsm2.conf.in
Normal file
10
softhsm2.conf.in
Normal file
@ -0,0 +1,10 @@
|
||||
# SoftHSM v2 configuration file
|
||||
|
||||
directories.tokendir = @TOKENPATH@
|
||||
objectstore.backend = file
|
||||
|
||||
# ERROR, WARNING, INFO, DEBUG
|
||||
log.level = ERROR
|
||||
|
||||
# If CKF_REMOVABLE_DEVICE flag should be set
|
||||
slots.removable = false
|
2
sources
Normal file
2
sources
Normal file
@ -0,0 +1,2 @@
|
||||
SHA512 (bind-9.11.23.tar.gz) = df374dcfdad5c905d5607fd3a5dcfd236f1c9ee448902db520748a738d1ff2f1761603bf62949d38932fcd3ebbf36e693737c40f0a6233af20ee91c3f9a3f462
|
||||
SHA512 (bind-9.11.23.tar.gz.asc) = afba039f50ad94fffa7891730d2d506a035f7abedeaec2f05abf19d030ffebc271b49e24adb3720f7bdb73318d52ededf0765ee082a6dc7cd9b581facafd411a
|
63
tests/Master-server-chrooted/Makefile
Normal file
63
tests/Master-server-chrooted/Makefile
Normal file
@ -0,0 +1,63 @@
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/tests/Sanity/Master-server-chrooted
|
||||
# Description: Run basic empty named service and try to resolve localhost on it
|
||||
# Author: Petr Mensik <pemensik@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2018 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/tests/Sanity/Master-server-chrooted
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Petr Mensik <pemensik@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Run basic empty named-chroot service and try to resolve localhost on it" >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: bind" >> $(METADATA)
|
||||
@echo "Requires: bind bind-utils bind-chroot bind-sdb-chroot" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
6
tests/Master-server-chrooted/PURPOSE
Normal file
6
tests/Master-server-chrooted/PURPOSE
Normal file
@ -0,0 +1,6 @@
|
||||
PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
|
||||
Description: Run basic empty named-chroot service and try to resolve localhost on it
|
||||
Author: Petr Mensik <pemensik@redhat.com>
|
||||
|
||||
Check also clean package both when running and finished.
|
||||
https://bugzilla.redhat.com/show_bug.cgi?id=1592873
|
73
tests/Master-server-chrooted/runtest.sh
Executable file
73
tests/Master-server-chrooted/runtest.sh
Executable file
@ -0,0 +1,73 @@
|
||||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/tests/Sanity/Master-server-chrooted
|
||||
# Description: Run basic empty named-chroot service and try to resolve localhost on it
|
||||
# Author: Petr Mensik <pemensik@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2018 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="bind"
|
||||
|
||||
test_service()
|
||||
{
|
||||
local SERVICE="$1"
|
||||
local PACKAGE="$2"
|
||||
rlRun "rlServiceStart $SERVICE"
|
||||
rlRun "dig @localhost localhost | grep '^localhost'"
|
||||
rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
|
||||
rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
|
||||
rlRun "rlServiceRestore $SERVICE"
|
||||
rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
|
||||
}
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm bind
|
||||
rlAssertRpm bind-utils
|
||||
rlAssertRpm bind-chroot
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Testing named"
|
||||
test_service named bind
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Testing named-chroot"
|
||||
test_service named-chroot bind-chroot
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Testing named-sdb-chroot"
|
||||
if rpm -q bind-sdb-chroot; then
|
||||
test_service named-sdb-chroot bind-sdb-chroot
|
||||
else
|
||||
rlLog "bind-sdb-chroot not installed, skipping it"
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
# noop
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
65
tests/Master-server-not-chrooted/Makefile
Normal file
65
tests/Master-server-not-chrooted/Makefile
Normal file
@ -0,0 +1,65 @@
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/bind/Sanity/Master-server-not-chrooted
|
||||
# Description: Set up master nameserver, test it.
|
||||
# Author: Martin Cermak <mcermak@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/bind/Sanity/Master-server-not-chrooted
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE named.conf zonefile
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Martin Cermak <mcermak@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Set up master nameserver in chrooted env, test it." >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: bind" >> $(METADATA)
|
||||
@echo "Requires: bind bind-chroot redhat-lsb" >> $(METADATA)
|
||||
@echo "Requires: bind-utils" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "RhtsRequires: library(bind/bind-setup)" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
6
tests/Master-server-not-chrooted/PURPOSE
Normal file
6
tests/Master-server-not-chrooted/PURPOSE
Normal file
@ -0,0 +1,6 @@
|
||||
PURPOSE of /CoreOS/bind/Sanity/Master-server-not-chrooted
|
||||
Description: Set up master nameserver in chrooted env, test it.
|
||||
This is a very basic sanity test for bind9.
|
||||
The main purpose for me was to learn how
|
||||
bind works :-)
|
||||
Author: Martin Cermak <mcermak@redhat.com>
|
11
tests/Master-server-not-chrooted/named.conf
Normal file
11
tests/Master-server-not-chrooted/named.conf
Normal file
@ -0,0 +1,11 @@
|
||||
options {
|
||||
directory "/var/named";
|
||||
allow-query { any; };
|
||||
};
|
||||
|
||||
zone "<DOMAIN>" IN {
|
||||
type master;
|
||||
file "<DOMAIN>.zone";
|
||||
allow-update { none; };
|
||||
};
|
||||
|
109
tests/Master-server-not-chrooted/runtest.sh
Normal file
109
tests/Master-server-not-chrooted/runtest.sh
Normal file
@ -0,0 +1,109 @@
|
||||
#!/bin/bash
|
||||
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/bind/Sanity/Master-server-not-chrooted
|
||||
# Description: Set up master nameserver, test it.
|
||||
# Author: Martin Cermak <mcermak@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include rhts environment
|
||||
#set -x
|
||||
. /usr/bin/rhts-environment.sh
|
||||
. /usr/lib/beakerlib/beakerlib.sh
|
||||
|
||||
# Some heplful functions
|
||||
randomString () {
|
||||
TEMPSTR=`date +%c%N | md5sum | awk '{print $1}'`
|
||||
echo ${TEMPSTR:0:8}
|
||||
unset TEMPSTR
|
||||
}
|
||||
|
||||
randomIp () {
|
||||
echo "192.168.1.`echo $[ $RANDOM / 256 + 1 ]`"
|
||||
}
|
||||
|
||||
randomSerial () {
|
||||
date +%N
|
||||
}
|
||||
|
||||
# Variable declarations
|
||||
CONF="/etc/named.conf"
|
||||
IP1=`randomIp`
|
||||
IP2=`randomIp`
|
||||
IP3=`randomIp`
|
||||
IP4=`randomIp`
|
||||
IP5=`randomIp`
|
||||
SERIAL=`randomSerial`
|
||||
ORIGPWD=`pwd`
|
||||
|
||||
# The test
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlRun "TmpDir=\`mktemp -d\`" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
|
||||
rlRun "rlImport bind/bind-setup"
|
||||
|
||||
bsBindSetupStart "$ORIGPWD/named.conf" "off"
|
||||
|
||||
rlRun "TDOMAIN=`randomString`.cz"
|
||||
rlRun "TZONEFILE=$ROOTDIR/var/named/$TDOMAIN.zone"
|
||||
|
||||
# set up /etc/named.conf
|
||||
rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $CONF"
|
||||
|
||||
# set up zonefile
|
||||
rlRun "cp $ORIGPWD/zonefile $TZONEFILE"
|
||||
rlRun "chmod a+r $TZONEFILE"
|
||||
rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $TZONEFILE"
|
||||
rlRun "sed -i \"s/<IP1>/$IP1/g\" $TZONEFILE"
|
||||
rlRun "sed -i \"s/<IP2>/$IP2/g\" $TZONEFILE"
|
||||
rlRun "sed -i \"s/<IP3>/$IP3/g\" $TZONEFILE"
|
||||
rlRun "sed -i \"s/<IP4>/$IP4/g\" $TZONEFILE"
|
||||
rlRun "sed -i \"s/<IP5>/$IP5/g\" $TZONEFILE"
|
||||
rlRun "sed -i \"s/<SERIAL>/$SERIAL/g\" $TZONEFILE"
|
||||
|
||||
bsBindSetupDone
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
# perform tests
|
||||
rlRun "dig @localhost $TDOMAIN | grep \"^$TDOMAIN\" | head -n 1 | grep \"$IP1\""
|
||||
rlRun "dig @localhost server1.$TDOMAIN | grep \"^server1.$TDOMAIN\" | grep \"$IP2\""
|
||||
rlRun "dig @localhost server2.$TDOMAIN | grep \"^server2.$TDOMAIN\" | grep \"$IP3\""
|
||||
rlRun "dig @localhost dns1.$TDOMAIN | grep \"^dns1.$TDOMAIN\" | grep \"$IP4\""
|
||||
rlRun "dig @localhost dns2.$TDOMAIN | grep \"^dns2.$TDOMAIN\" | grep \"$IP5\""
|
||||
rlRun "dig @localhost ftp.$TDOMAIN | grep \"^ftp.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
|
||||
rlRun "dig @localhost mail.$TDOMAIN | grep \"^mail.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
|
||||
rlRun "dig @localhost mail2.$TDOMAIN | grep \"^mail2.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
|
||||
rlRun "dig @localhost www.$TDOMAIN | grep \"^www.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
|
||||
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
bsBindSetupCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlRun "rm -rf $TZONEFILE"
|
||||
rlPhaseEnd
|
||||
rlJournalEnd
|
27
tests/Master-server-not-chrooted/zonefile
Normal file
27
tests/Master-server-not-chrooted/zonefile
Normal file
@ -0,0 +1,27 @@
|
||||
$ORIGIN <DOMAIN>.
|
||||
$TTL 86400
|
||||
@ IN SOA dns1.<DOMAIN>. hostmaster.<DOMAIN>. (
|
||||
<SERIAL> ; serial
|
||||
21600 ; refresh after 6 hours
|
||||
3600 ; retry after 1 hour
|
||||
604800 ; expire after 1 week
|
||||
86400 ) ; minimum TTL of 1 day
|
||||
|
||||
IN NS dns1.<DOMAIN>.
|
||||
IN NS dns2.<DOMAIN>.
|
||||
|
||||
IN MX 10 mail.<DOMAIN>.
|
||||
IN MX 20 mail2.<DOMAIN>.
|
||||
|
||||
IN A <IP1>
|
||||
|
||||
server1 IN A <IP2>
|
||||
server2 IN A <IP3>
|
||||
dns1 IN A <IP4>
|
||||
dns2 IN A <IP5>
|
||||
|
||||
ftp IN CNAME server1
|
||||
mail IN CNAME server1
|
||||
mail2 IN CNAME server2
|
||||
www IN CNAME server2
|
||||
|
77
tests/Run-internal-BIND-test-suite/Makefile
Normal file
77
tests/Run-internal-BIND-test-suite/Makefile
Normal file
@ -0,0 +1,77 @@
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of tests/Run-internal-BIND-test-suite
|
||||
# Description: Run internal BIND test suite
|
||||
# Author: Martin Cermak <mcermak@redhat.com>
|
||||
# Author: Petr Mensik <pemensik@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2010 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=tests/Run-internal-BIND-test-suite
|
||||
export TESTVERSION=1.3
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE knownerror* setup-named-softhsm.sh bind-systest-filter.sh
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Martin Cermak <mcermak@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Run internal BIND test suite" >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 8h" >> $(METADATA)
|
||||
@echo "RunFor: bind" >> $(METADATA)
|
||||
@echo "Requires: bind rpm-build bind-utils" >> $(METADATA)
|
||||
@echo "Requires: perl-Net-DNS perl-Net-DNS-Nameserver" >> $(METADATA)
|
||||
@echo "Requires: perl-Time-HiRes" >> $(METADATA)
|
||||
@echo "Requires: bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
|
||||
@echo "Requires: openssl-devel libtool autoconf" >> $(METADATA)
|
||||
# Try to satisfy all build dependencies from here
|
||||
@echo "Requires: bind-devel" >> $(METADATA)
|
||||
@echo "Requires: net-tools" >> $(METADATA)
|
||||
@echo "Requires: dnf-utils" >> $(METADATA)
|
||||
@echo "Requires: kyua" >> $(METADATA)
|
||||
@echo "Requires: libcmocka-devel" >> $(METADATA)
|
||||
# Obsolete, uses cmocka
|
||||
# @echo "Requires: libatf-c gcc-c++" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Bug: 642970" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
6
tests/Run-internal-BIND-test-suite/PURPOSE
Normal file
6
tests/Run-internal-BIND-test-suite/PURPOSE
Normal file
@ -0,0 +1,6 @@
|
||||
PURPOSE of tests/Run-internal-BIND-test-suite
|
||||
Description: Run internal BIND test suite
|
||||
Author: Martin Cermak <mcermak@redhat.com>
|
||||
Bug summary: Run internal BIND test suite
|
||||
Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=642970
|
||||
|
47
tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
Executable file
47
tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
Executable file
@ -0,0 +1,47 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This script will filter out output from BINDs tests
|
||||
# It supports form from BIND 9.9 and BIND 9.11
|
||||
# Its purpose is to display only failed tests from list of all tests
|
||||
|
||||
CURRENT_TEST=
|
||||
CURRENT_OUTPUT=
|
||||
STATUS_ONLY=
|
||||
|
||||
for P; do
|
||||
case "$P" in
|
||||
-s|--status) STATUS_ONLY=yes; shift ;;
|
||||
esac
|
||||
done
|
||||
|
||||
cat $@ | while read LINE; do
|
||||
if [ "${LINE#S:}" != "$LINE" ]; then
|
||||
CURRENT_TEST=`echo $LINE | cut -d: -f2`
|
||||
CURRENT_OUTPUT="$LINE"$'\n'
|
||||
elif [ "${LINE#R:}" != "$LINE" ]; then
|
||||
# echo "$CURRENT_TEST $LINE"
|
||||
if [ "${LINE/#R:*:*}" != "$LINE" ]; then
|
||||
# more recent results contain test name
|
||||
# R:dlz:FAIL
|
||||
CURRENT_TEST="${LINE#R:}"
|
||||
CURRENT_TEST="${CURRENT_TEST/%:*}"
|
||||
RESULT="${LINE/#*:}"
|
||||
else
|
||||
# S:dlz:time
|
||||
# R:FAIL
|
||||
RESULT="${LINE/#R*:/}"
|
||||
fi
|
||||
if [ "$RESULT" != "PASS" ]; then
|
||||
if [ -n "$STATUS_ONLY" ]; then
|
||||
echo "$RESULT $CURRENT_TEST"
|
||||
else
|
||||
CURRENT_OUTPUT+="$LINE"
|
||||
echo "$CURRENT_OUTPUT"
|
||||
echo
|
||||
fi
|
||||
fi
|
||||
CURRENT_OUTPUT=
|
||||
else
|
||||
CURRENT_OUTPUT+="$LINE"$'\n'
|
||||
fi
|
||||
done
|
2
tests/Run-internal-BIND-test-suite/knownerror
Normal file
2
tests/Run-internal-BIND-test-suite/knownerror
Normal file
@ -0,0 +1,2 @@
|
||||
A:System test dlz
|
||||
A:System test idna
|
185
tests/Run-internal-BIND-test-suite/runtest.sh
Executable file
185
tests/Run-internal-BIND-test-suite/runtest.sh
Executable file
@ -0,0 +1,185 @@
|
||||
#!/bin/bash
|
||||
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of tests/Run-internal-BIND-test-suite
|
||||
# Description: Run internal BIND test suite
|
||||
# Author: Martin Cermak <mcermak@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2010 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include rhts environment
|
||||
. /usr/bin/rhts-environment.sh
|
||||
. /usr/lib/beakerlib/beakerlib.sh
|
||||
|
||||
PACKAGE="bind"
|
||||
|
||||
# Set those variables to n to skip tests on variants
|
||||
#DEFAULT_VARIANTS="normal pkcs11 sdb"
|
||||
DEFAULT_VARIANTS="normal"
|
||||
#TEST_VARIANTS="normal"
|
||||
|
||||
#
|
||||
# Runs test suite and checks known errors
|
||||
# Prepared to be repeated with another variants
|
||||
run_testsuite()
|
||||
{
|
||||
local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
|
||||
local FOUNDERROR=`mktemp found-XXXXXXXX.err`
|
||||
local KNOWNERROR=/dev/null
|
||||
|
||||
if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
|
||||
KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
|
||||
elif [ -f "$ORIG/knownerror${NAMED_VARIANT}" ]; then
|
||||
KNOWNERROR=`readlink -f $ORIG/knownerror`
|
||||
fi
|
||||
|
||||
# Sometime it can fail. Report just failures that are not known
|
||||
rlRun "make test -j${CORES:-1} &> $RESULT_TEXT" 0-255 "Perform the test."
|
||||
rlRun "grep -C 10 FAIL $RESULT_TEXT" 0-255 "Quickly show the test error (if any)."
|
||||
|
||||
rlRun "$FILTER $RESULT_TEXT" 0 "Showing unsuccessful tests"
|
||||
rlRun "$FILTER -s $RESULT_TEXT > $FOUNDERROR" 0
|
||||
rlRun "ls $KNOWNERROR $FOUNDERROR $RESULT_TEXT" 0 'check if there is needed files'
|
||||
rlLog "`cat $FOUNDERROR`"
|
||||
|
||||
rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
|
||||
cat $FOUNDERROR | while read STATUS TEST ; do
|
||||
if [ "$STATUS" = FAIL ]; then
|
||||
rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
|
||||
else
|
||||
rlLog "$STATUS $TEST"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
# package assertions
|
||||
rlAssertRpm $PACKAGE
|
||||
rlAssertRpm rpm-build
|
||||
rlAssertRpm perl-Net-DNS-Nameserver
|
||||
|
||||
#pwd
|
||||
ORIG=`pwd`
|
||||
SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
|
||||
FILTER=`readlink -f bind-systest-filter.sh`
|
||||
CORES=`grep 'processor\s*:' /proc/cpuinfo | wc -l`
|
||||
|
||||
TAG=generic
|
||||
if [ -f /etc/os-release ]; then
|
||||
# extract platform tag
|
||||
TAG=`(source /etc/os-release && echo ${PLATFORM_ID#platform:})`
|
||||
fi
|
||||
|
||||
#tempdir
|
||||
rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TMPDIR"
|
||||
|
||||
# topdir
|
||||
TOPDIR=`rpm -E '%{_topdir}'`
|
||||
|
||||
# cleanup in topdir
|
||||
mkdir -p $TOPDIR/{BUILD,SOURCES,SPECS}
|
||||
rm -rf $TOPDIR/{BUILD,SOURCES,SPECS}/*
|
||||
|
||||
# download src rpm
|
||||
if ! ls bind*.src.rpm; then
|
||||
rlRun "dnf --enablerepo='*-source' download --source bind" 0 "Fetch source from repository"
|
||||
rlRun "rpm -i bind*.src.rpm"
|
||||
fi
|
||||
|
||||
rlRun "rpm --define '_topdir $TOPDIR' -Uvh *rpm &> $TMPDIR/install.txt"
|
||||
rlRun "cd $TOPDIR/SPECS"
|
||||
|
||||
rlRun "dnf -y builddep *.spec"
|
||||
|
||||
# stop bind if it is running
|
||||
rlServiceStop named
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
# rebuild from source
|
||||
rlRun "rpmbuild -ba *.spec &> $TMPDIR/build.txt"
|
||||
|
||||
# the test
|
||||
rlRun "cd $TOPDIR/BUILD/bind*"
|
||||
|
||||
rlLogInfo "Test takes place in `pwd`"
|
||||
|
||||
rlRun "chown -R root ."
|
||||
|
||||
if [ -x "$SETUP_SOFTHSM" ]; then
|
||||
rlRun "eval \"$(bash $SETUP_SOFTHSM -A)\"" 0 "Preparing PKCS#11 token slot"
|
||||
rlRun "pkcs11-tokens" 0 "Testing token slot availability"
|
||||
else
|
||||
rlLog "PKCS#11 not initialized"
|
||||
fi
|
||||
|
||||
if [ -d build ]; then
|
||||
BUILD=build
|
||||
else
|
||||
BUILD=.
|
||||
fi
|
||||
|
||||
rlRun "./bin/tests/system/ifconfig.sh up" 0 "Setup fake network interfaces."
|
||||
|
||||
# required by idna test
|
||||
export LC_ALL=en_US.UTF-8
|
||||
|
||||
rlRun "pushd $BUILD"
|
||||
|
||||
if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q normal; then
|
||||
rlLog "Running normal variant"
|
||||
export NAMED_VARIANT= DNSSEC_VARIANT=
|
||||
run_testsuite
|
||||
rlLog "Finished normal variant"
|
||||
fi
|
||||
|
||||
if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
|
||||
rlLog "Running sdb variant"
|
||||
export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
|
||||
run_testsuite
|
||||
rlLog "Finished sdb variant"
|
||||
fi
|
||||
|
||||
if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
|
||||
rlLog "Running pkcs11 variant"
|
||||
# Unfortunately, PKCS11 variant uses shared key storage
|
||||
# It cannot use more threads for that reason
|
||||
export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
|
||||
CORES=1 run_testsuite
|
||||
rlLog "Finished pkcs11 variant"
|
||||
fi
|
||||
|
||||
rlRun "popd"
|
||||
|
||||
rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."
|
||||
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlBundleLogs "BUILD_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt"
|
||||
rlBundleLogs "TEST_LOGS" "$TMPDIR"/test*.txt
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalEnd
|
123
tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
Executable file
123
tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
Executable file
@ -0,0 +1,123 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This script will initialise token storage of softhsm PKCS11 provider
|
||||
# in custom location. Is useful to store tokens in non-standard location.
|
||||
#
|
||||
# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
|
||||
# Recommended use:
|
||||
# eval $(bash setup-named-softhsm.sh -A)
|
||||
#
|
||||
|
||||
SOFTHSM2_CONF="$1"
|
||||
TOKENPATH="$2"
|
||||
GROUPNAME="$3"
|
||||
# Do not use this script for real keys worth protection
|
||||
# This is intended for crypto accelerators using PKCS11 interface.
|
||||
# Uninitialized token would fail any crypto operation.
|
||||
PIN=1234
|
||||
SO_PIN=1234
|
||||
LABEL=rpm
|
||||
|
||||
set -e
|
||||
|
||||
echo_i()
|
||||
{
|
||||
echo "#" $@
|
||||
}
|
||||
|
||||
random()
|
||||
{
|
||||
if [ -x "$(which openssl 2>/dev/null)" ]; then
|
||||
openssl rand -base64 $1
|
||||
else
|
||||
dd if=/dev/urandom bs=1c count=$1 | base64
|
||||
fi
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
echo "Usage: $0 -A [token directory] [group]"
|
||||
echo " or: $0 <config file> <token directory> [group]"
|
||||
}
|
||||
|
||||
if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
|
||||
TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
|
||||
fi
|
||||
|
||||
if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
|
||||
usage >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$SOFTHSM2_CONF" = "-A" ]; then
|
||||
# Automagic mode instead
|
||||
MODE=secure
|
||||
SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
|
||||
PIN_SOURCE="$TOKENPATH/pin"
|
||||
SOPIN_SOURCE="$TOKENPATH/so-pin"
|
||||
TOKENPATH="$TOKENPATH/tokens"
|
||||
else
|
||||
MODE=legacy
|
||||
fi
|
||||
|
||||
[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
|
||||
|
||||
umask 0022
|
||||
|
||||
if ! [ -f "$SOFTHSM2_CONF" ]; then
|
||||
cat << SED > "$SOFTHSM2_CONF"
|
||||
# SoftHSM v2 configuration file
|
||||
|
||||
directories.tokendir = ${TOKENPATH}
|
||||
objectstore.backend = file
|
||||
|
||||
# ERROR, WARNING, INFO, DEBUG
|
||||
log.level = ERROR
|
||||
|
||||
# If CKF_REMOVABLE_DEVICE flag should be set
|
||||
slots.removable = false
|
||||
SED
|
||||
else
|
||||
echo_i "Config file $SOFTHSM2_CONF already exists" >&2
|
||||
fi
|
||||
|
||||
if [ -n "$PIN_SOURCE" ]; then
|
||||
touch "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
if [ -n "$GROUPNAME" ]; then
|
||||
chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
fi
|
||||
fi
|
||||
|
||||
export SOFTHSM2_CONF
|
||||
|
||||
if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
|
||||
then
|
||||
echo_i "Token in ${TOKENPATH} is already initialized" >&2
|
||||
|
||||
[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
|
||||
[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
|
||||
else
|
||||
PIN=$(random 6)
|
||||
SO_PIN=$(random 18)
|
||||
if [ -n "$PIN_SOURCE" ]; then
|
||||
echo -n "$PIN" > "$PIN_SOURCE"
|
||||
echo -n "$SO_PIN" > "$SOPIN_SOURCE"
|
||||
fi
|
||||
|
||||
echo_i "Initializing tokens to ${TOKENPATH}..."
|
||||
softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
|
||||
|
||||
if [ -n "$GROUPNAME" ]; then
|
||||
chgrp -R -- "$GROUPNAME" "$TOKENPATH"
|
||||
chmod -R -- g=rX,o= "$TOKENPATH"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
|
||||
echo "export PIN_SOURCE=\"$PIN_SOURCE\""
|
||||
echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
|
||||
# These are intentionaly not exported
|
||||
echo "PIN=\"$PIN\""
|
||||
echo "SO_PIN=\"$SO_PIN\""
|
11
tests/tests.yml
Normal file
11
tests/tests.yml
Normal file
@ -0,0 +1,11 @@
|
||||
---
|
||||
# This first play always runs on the local staging system
|
||||
- hosts: localhost
|
||||
roles:
|
||||
- role: standard-test-beakerlib
|
||||
tags:
|
||||
- classic
|
||||
repositories:
|
||||
- repo: "https://github.com/InfrastructureServices/bind-tests.git"
|
||||
dest: "bind-tests"
|
||||
fmf_filter: "tier: 1"
|
1
trusted-key.key
Normal file
1
trusted-key.key
Normal file
@ -0,0 +1 @@
|
||||
. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
|
53
zone2sqlite.1
Normal file
53
zone2sqlite.1
Normal file
@ -0,0 +1,53 @@
|
||||
.\" Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and/or distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
.\" copyright notice and this permission notice appear in all copies.
|
||||
.\"
|
||||
.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
.\" PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" Manpage written by Jan Gorig
|
||||
.TH zone2sqlite 1 "15 March 2010" "BIND9"
|
||||
.SH NAME
|
||||
zone2sqlite - Load BIND 9 zone file into SQLite database
|
||||
.SH SYNOPSIS
|
||||
.B zone2sqlite zone zonefile dbfile dbtable
|
||||
.SH DESCRIPTION
|
||||
zone2sqlite parses DNS zone file and creates database for use with SQLite BIND SDB driver.
|
||||
|
||||
\fBzone\fR
|
||||
.RS 4
|
||||
Zone origin, eg "mydomain.net."
|
||||
.RE
|
||||
.PP
|
||||
\fBzonefile\fR
|
||||
.RS 4
|
||||
Master zone database file, eg. mydomain.net.zone
|
||||
.RE
|
||||
.PP
|
||||
\fBdbfile\fR
|
||||
.RS 4
|
||||
Name of SQLite database file
|
||||
.RE
|
||||
.PP
|
||||
\fBdbtable\fR
|
||||
.RS 4
|
||||
Name of table in database
|
||||
.RE
|
||||
|
||||
.SH "EXIT STATUS"
|
||||
Exits with 0 on success or 1 on failure.
|
||||
.SH "SEE ALSO"
|
||||
named(8)
|
||||
.SH "COPYRIGHT"
|
||||
Copyright \(co 2004, 2005, 2007\-2009 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
Copyright \(co 2000, 2001 Internet Software Consortium.
|
||||
.br
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user