diff options
| author | peter <peter@FreeBSD.org> | 1996-12-31 19:51:17 +0000 |
|---|---|---|
| committer | peter <peter@FreeBSD.org> | 1996-12-31 19:51:17 +0000 |
| commit | b13db018fbb01d60dabb34ce9bd3f06994fd81b7 (patch) | |
| tree | a2327c4e40b3c074798fd7f0ddd86f66879ceab5 /contrib | |
| parent | 2d3cf9fcaf1ca2528c5fe3ba683d1f6c1268dc41 (diff) | |
| download | FreeBSD-src-b13db018fbb01d60dabb34ce9bd3f06994fd81b7.zip FreeBSD-src-b13db018fbb01d60dabb34ce9bd3f06994fd81b7.tar.gz | |
Import Paul Vixie/ISC's bind-4.9.5-patch1 onto the vendor branch.
This has some (all?) of the DNSSEC key management/distribution mechanism
in place. (The SIG and KEY RR's)
Obtained from: Paul Vixie / ISC / ftp.isc.org
Diffstat (limited to 'contrib')
65 files changed, 7509 insertions, 4039 deletions
diff --git a/contrib/bind/CHANGES b/contrib/bind/CHANGES index 0379d50..024edae 100644 --- a/contrib/bind/CHANGES +++ b/contrib/bind/CHANGES @@ -1,4 +1,268 @@ -$Id: CHANGES,v 8.40 1996/08/05 08:31:20 vixie Exp $ +$Id: CHANGES,v 8.52 1996/12/18 04:09:41 vixie Exp $ + + --- 4.9.5-p1 released --- + +776. [doc] doc/misc/FAQ.* updated by its author. + +775. [bug] KEY RRs were not allowed to default fields per [DNSSEC]. + +774. [bug] nslookup was overflowing yet another internal data structure. + +773. [bug] syslog was being given an unprotected string to format from. + +772. [debug] a debugging syslog() was made clearer. + +771. [contrib] contrib/host updated by its author. + +770. [bug] nslookup was overflowing an internal data structure. + +769. [port] ultrix linkage hackery removed from res/res_comp.c. + +768. [lint] named-xfer u_char* vs. char*. + +767. [port] shres/sunos updates from the author. + +766. [bug] nslookup was not limiting the number of addresses it handled. + +765. [port] LOG_NOWAIT turned on if available. + +764. [lint] nslookup NULL vs ERROR. + +763. [bug] p_rr() was erroneously reporting short packets. + +762. [bug] minor memory leak fixed (during bad-name syslogging). + +761. [port] NeXTstep portability improved for modern systems. + +760. [bug] NAPTR RR support was incomplete/broken in named-xfer. + +759. [port] The resolver's POSIX.3 conformance is now optional since + it was causing trouble for vendor shared library editing. + + --- 4.9.5-rel released --- + +758. [doc] more Linux libc discussions included. + +757. [doc] RFCs 1876, 1995, 1996, 2010, and 2052 now included. + +756. [contrib] new version of contrib/host received from author. + +755. [bug] nslookup had a latent buffer overrun in initialization. + +754. [port] NCR's flavour of SVr4 is now supported. + +753. [bug] fp_nquery() could read past end of buffer. (fix from BIND 8.1) + +752. [conf] SENSIBLE_DOTS is now the default. SGI can use WANT_PIDFILE. + +751. [doc] the the BOG had an extra "the" in two places. + +750. [bug] erroneous zones weren't resetting z_ftime. + +749. [bug] named-xfer's handling of unknown type codes was not robust. + (it's still wrong but now it's wrong more gracefully.) + +748. [lint] u_char vs. char changes in db_load.c. + +747. [bug] a previous patch had leftovers. + +746. [bug] dangling CNAMEs were not handled properly. + +745. [doc] shres/sunos/INSTALL, ./INSTALL and man/gethostbyname.3 + modernized. + +744. [bug] NAPTR replacement domains were being verified as hostnames. + +743. [port] hpux10.10 makefile cleanup. + +742. [bug] inet_net_pton() was doing bad things to subnets and b'casts. + +741. [func] source and owner are now logged with name errors. + + --- 4.9.5-t6b released --- + +740. [bug] dangling cname checking had a few memory leaks. + +739. [func] SRV support made more complete; NAPTR support added. + +738. [protocol] dangling CNAMEs are no longer considered format errors. + +737. [bug] owner domain names like "*." were not considered valid. + +736. [contrib] new version of contrib/host included. + +735. [doc] added some text to shres/solaris/INSTALL. + +734. [bug] loading a zone with a single line SOA RR killed following line. + +733. [bug] priming could deadlock in odd cases. + +732. [bug] SIGHUP now caught before initial zone load. + +731. [bug] IP/TCP session logging now controlled by #ifdef DEBUG. + +730. [port] untested HPUX 10 support added to top level Makefile. + +729. [port] ultrix vs. _res_close(); ultrix wins. + +728. [bug] several d_rcode references weren't #ifdef'd NCACHE. + +727. [bug] SOA timer warnings now consistently logged at LOG_WARNING. + +726. [protocol] added T_NAPTR as RR type 35, hoping the IANA concurs. + + --- 4.9.5-t5b released --- + +725. [port] shared libraries should work on Linux now. + +724. [bug] "dig @0 VERSION.BIND TXT CHAOS" had never been tested. + +723. [port] Solaris 2.6 has AF_LINK but not sa_len. + +722. [protocol] verify RdLength of A and AAAA RRs. + +721. [port] missing include directories will be made during "install". + +720. [port] solaris and sunos should use native assemblers with gcc. + +719. [port] cleaned up some A/UX linkages. + +718. [func] some SOA sanity checks were changed from errors to warnings. + +717. [port] BSD/named/Makefile needed to have dmalloc.c reference removed. + +716. [protocol] cnames and referrals were generating spurious log messages. + +715. [port] ultrix PCC didn't like a =&, said it was ambigious somehow. + + --- 4.9.5-t4b released --- + +714. [port] contrib/os2-emx now contains files nec'y for OS/2 (EMX). + +713. [func] gethostbyname2(x, AF_INET6) now accepts address literals. + +712. [bug] gethostbyname() wasn't seeing RES_USE_INET6 early enough. + +711. [bug] nslookup was printing IPv6 addresses improperly. + +710. [port] an alignment bug was found and fixed by Cray. + +709. [bug] named-xfer was dumping core on incoming LOC RRs. + +708. [protocol] primary zones are edited to make rrset ttl's coherent during + loading. + +707. [protocol] rrsets with coherent ttl's won't be overridden by new rrsets + with incoherent ttl's. + +706. [port] Ultrix portability restored. + +705. [func] added "limit files XXX" to boot file. + +704. [bug] trace generation code was getting unaligned accesses. + +703. [contrib] added contrib/getkeyby, from gnu@toad.com. + +702. [func] MAXDNAME is now 4*256+1 to allow for \000 and the NUL. + +701. [bug] samedomain() wasn't paying attention to escapes. + +700. [func] allow long text strings in T_X25 RRs. + +699. [port] added base64.c to shres/*/Makefile. + +698. [port] picked some lint out of tools/nslookup/getinfo.c. + +697. [bug] we were calling isupper() without calling isascii() first. + +696. [protocol] a new kind of bad referral is now caught and ignored. + + --- 4.9.5-t3b released --- + +695. [func] Use delete_stale() in preference to delete_all() more often. + +694. [func] DATUMREFCNT is no longer an option. + +693. [port] fixed up the CPPFLAGS usage in the top level Makefile. + +692. [port] fixed up the __ defines (for POSIX.3) in include/resolv.h. + +691. [port] removed all uses of "ssize_t", the world is not ready for it. + (fixed two latent signed/unsigned code bugs in the process.) + + --- 4.9.5-t3a released --- + +690. [bug] the stale() and delete_all() calls in finddata() weren't + respectful toward T_ANY and C_ANY queries. + +689. [lint] miscellaneous compiler warnings were disappeared. + +688. [func] handles insane/unreachable root servers a little better now. + +687. [bug] T1A's core dumps from bad databufs should be all fixed now. + +686. [func] overlong TXT strings should work again. + +685. [port] updated compat/include/sys/cdefs.h to BSD 4.4-Lite (8.7) vers. + +684. [doc] doc/i-d/* added. + +683. [contrib] "nslint" added to contrib/. + +682. [protocol] irrelevant authority information is now correctly ignored. + +681. [func] DO_RELOAD Is no longer optional. + +680. [cleanup] ALLOW_UPDATES is gone. + +679. [port] some systems need _res to be in text rather than bss. + +678. [port] -Dssize_t=int is gone; see portability.h. + +677. [contrib] outdates #671; update to contrib/host version 960808. + +676. [doc] formatting fix to man/named.man8. + + --- 4.9.5-t2a released --- + +675. [lint] various. + +674. [feature] support added for SRV RR (untested). + +673. [protocol] added definitions for EID, NIMLOC, SRV, ATMA, and IXFR. + +672. [bug] fixed decoding problem wrt AAAA in tools/nslookup/debug.c. + +671. [bug] fixed formatting problem wrt TXT in contrib/host/host.c. + + --- 4.9.5-t1a released --- + +670. [feature] added SIG and KEY RR support (without signature or + verification). + +669. [internal] name/number translations are now mostly table driven. + +668. [feature] nslookup now has better[/different] error messages. + +667. [feature] inet_neta(), inet_net_ntop(), inet_net_pton() added. + +666. [bug] parent zone will be reloaded when a child zone changes. + +665. [protocol] RETURNSOA logic has been refined, and now ships "enabled." + +664. [protocol] cached RRsets are now completely flushed when new data arrives. + +663. [port] IRIX shared libraries are now supported. + +662. [port] SCO OSE5 support has been upgraded slightly. + +661. [bug] insane root servers will now be handled correctly. + +660. [bug] TXT RRs are now parsed and displayed in full RFC1035 form. + +659. [port] UXP/DS is now supported in the top level Makefile. + +658. [feature] BIND now checks that UDP checksums are enabled in the kernel. --- 4.9.4-p1 released --- diff --git a/contrib/bind/INSTALL b/contrib/bind/INSTALL index 69d572a..0b6b9ed 100644 --- a/contrib/bind/INSTALL +++ b/contrib/bind/INSTALL @@ -1,4 +1,4 @@ -$Id: INSTALL,v 8.6 1995/12/24 06:43:57 vixie Exp $ +$Id: INSTALL,v 8.7 1996/11/11 06:36:40 vixie Exp $ THE FILES: ---------- @@ -7,20 +7,26 @@ README -- Release announcements, tips and traps (some out of date) OPTIONS -- The options that can be turned on and off RUNSON -- What machines/compilers is BIND known to build on TODO -- Have spare time? Consider contributing to the project! +BSD/* -- How to integrate BIND into a 4.4BSD or 4.4BSD-Lite +contrib/* -- Useful BIND-related contributions doc/info/* -- Platform-dependent build hints +doc/* -- other RFCs, drafts, papers and -HOW TO BUILD: +INTRODUCTION: ------------- -4.9.3 is considerably easier to build than previous releases. These -are the instructions on how to compile the software. For information -on how to create your configuration files (resolv.conf, named.boot, and -zone files) see the doc/bog directory and/or get "DNS and BIND" by C. -Liu and P. Albitz from O'Reilly & Associates, Sebastopol, CA, ISBN -0-937175-82-X 1992 +BIND used to be extremely difficult to build. That changed around +version 4.9.3. These are the instructions on how to compile the +software. For information on how to create your configuration files +(resolv.conf, named.boot, and zone files) see the doc/bog directory for +the complete "BIND Operations Guide". You might also consider getting +"DNS and BIND" by C. Liu and P. Albitz from O'Reilly & Associates, +Sebastopol, CA, ISBN 0-937175-82-X 1992 Note: If you maintain a BSD or are otherwise running a 4.4BSD-based system and want to integrate BIND into it, check out BSD/README. +BUILDING & INSTALLING: +---------------------- 1. (optional) If you are going to compile for multiple platforms, you can make a symbolic link tree for each platform to save disk space. To create a directory called "sun4.dir", do: @@ -30,15 +36,28 @@ copy of the source. Just be careful if you are modifying a file, make sure you turn any links into files: mv file file.tmp ; cp file.tmp file ; rm file.tmp -2. Edit "conf/options.h" and turn on any options that you want. The +2. (optional) If you have a typical site, you should find yourself only +editing Makefile and conf/options.h. Make backups of them now: + + mv Makefile Makefile.tmp + cp Makefile.tmp Makefile ; rm Makefile.tmp + chmod u+w Makefile + + mv conf/options.h conf/options.h.tmp + cp conf/options.h.tmp conf/options.h ; rm conf/options.h.tmp + chmod u+w conf/options.h + +3. Edit "conf/options.h" and turn on any options that you want. The defaults are pretty reasonable for most installations. -3. Edit "Makefile". Go to the section that describes your operating -system and uncoment it out. Add any other variables (for example, -I added a line "DISTHELP=/usr/local/lib".) If in doubt, use the -default! +4. Edit "Makefile". The default build parameters are given for 4.4 BSD. +They should be overridden (not edited!). Do this by going to the +section that describes your operating system and uncoment the +appropriate lines. Add any other variables (for example, some people +add "DISTHELP=/usr/local/lib".) If in doubt, use the default! Read +the comments carefully! -4. "make" should build everything. Consider putting "./bin" in your +5. "make" should build everything. Consider putting "./bin" in your path if "make depend" fails and you think bin/mkdep will help you out. *** NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE *** @@ -49,26 +68,30 @@ path if "make depend" fails and you think bin/mkdep will help you out. *** NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE *** -5. "make install" will install everything. You might first do +6. "make install" will install everything. You might first do "make -n install" to see what commands would be executed by "make install" to make sure you understand where everything is about to be installed. -6. (optional, SunOS 4.1.x/NetBSD-1.x/Solaris 2.x only): You can integrate -the new resolver (client-side) code into the shared libraries of your -operating system so that all dynamicly linked programs take advantage of -the new resolver. Read shres/<osname>/INSTALL to find out how to do it. +7. (optional, SunOS 4, SunOS 5, NetBSD-1.x, IRIX, Linix only): You can +integrate the new resolver (client-side) code into the shared libraries +of your operating system so that all dynamicly linked programs take +advantage of the new resolver. Read shres/<osname>/INSTALL to find out +how to do it. HOW TO GET HELP: ----------------- -If you have any problems or fixes send them to - bind@uunet.uu.net - -To be added to that mailing list, send mail to +---------------- +The "bind@uunet.uu.net" mailing list was created especially for people +to talk about and ask questions about installation, maintenance, etc. +It is highly recommended that you first help yourself by reading +the BOG (doc/bog) or a book on DNS and BIND. + +To be added to this mailing list, send mail to bind-request@uunet.uu.net -This INSTALL was originally written on 15Jul94 by Tom Limoncelli <tal@plts.org> -Minor changes 23Dec95 by Christopher Davis <ckd@kei.com> +This INSTALL was originally written on 15Jul94 by Tom Limoncelli +<tal@bell-labs.org> Minor changes 23Dec95 by Christopher Davis +<ckd@kei.com> and then by Tom Limoncelli 16Oct96. diff --git a/contrib/bind/Makefile b/contrib/bind/Makefile index 1f01a42..f684ffb 100644 --- a/contrib/bind/Makefile +++ b/contrib/bind/Makefile @@ -1,7 +1,7 @@ # Makefile for BIND>=4.9 top level # vixie@decwrl December, 1992 [original] # -# $Id: Makefile,v 8.39 1996/08/05 08:31:20 vixie Exp $ +# $Id: Makefile,v 8.48 1996/11/26 10:11:13 vixie Exp $ ## ++Copyright++ 1989 ## - @@ -56,7 +56,7 @@ ## - ## --Copyright-- -VER = 4.9.4-P1 +VER = 4.9.5-P1 SHELL = /bin/sh MAKE = make DESTDIR = @@ -101,11 +101,12 @@ PS = ps IOT = ABRT SHCC = SHLD = +PIC = # (NetBSD - for details on shared library building, see shres/netbsd/INSTALL) #uncomment next three lines to build a shared library version of libresolv #SHRES = shres/netbsd -#SHCC = cc +#SHCC = cc $(CPPFLAGS) #PIC = -fpic #(Linux - on modern systems, all you need to do is rename or remove @@ -113,13 +114,27 @@ SHLD = #CC = gcc $(CPPFLAGS) #CDEBUG = -g #CPPFLAGS = -DSYSV +#LEX=flex -8 -I +#INSTALL_COMPAT = install-compat #LIBS = -lfl #DESTEXEC = /usr/sbin #DESTMAN = /usr/man +#MANDIR = man +#MANROFF = cat #DESTHELP = /usr/lib #CATEXT = $$$$N #PS = ps -p #IOT = IOT +#uncomment next line to build a shared library version of libresolv +#SHRES = shres/linux +#uncomment next line to build tools and named with shared libresolv +#RES = $(SHRES)/libresolv.so +# ... and then (for shared) uncomment these lines too: +#SHCC = gcc $(CPPFLAGS) -fomit-frame-pointer -pipe +#PIC= -fpic +#SHMAJVER=4 +#SHVER=$(SHMAJVER).9.5.0.4 +#SHLD= gcc -shared -Wl,-rpath,$(DESTDIR)$(DESTLIB),-soname,libresolv.so.$(SHMAJVER) -lfl #(CRAY) #CDEBUG = -g @@ -145,9 +160,9 @@ SHLD = #(DEC AXP OSF/1 Version 3.0 and after) #CC = cc $(CPPFLAGS) -std #CDEBUG = -g3 -O2 -Olimit 2000 -#CPPFLAGS = +#CPPFLAGS = -DCHECK_UDP_SUM #LEX = lex -#LIBS = -ll -lutil +#LIBS = -ll -lutil -lmld #DESTEXEC = /usr/sbin #COMPINCL = compat/include #INSTALL_COMPAT = install-compat @@ -157,13 +172,16 @@ SHLD = #CATEXT = $$$$N #PS = ps -p #IOT = IOT +#KSYMS = /vmunix +#KMEM = /dev/kmem +#UDPSUM = udpcksum #(irix4) #CC = cc $(CPPFLAGS) -xansi -signed #CDEBUG = -g -#CPPFLAGS = -D__STDC__ -D_BSD_SIGNALS -DSIG_FN=int +#CPPFLAGS = -D__STDC__ -D_BSD_SIGNALS -DSIG_FN=int -DCHECK_UDP_SUM -DKMAP #LEX = lex -#LIBS = -ll +#LIBS = -ll -lmld #DESTSBIN = /usr/etc #DESTEXEC = /usr/etc #DESTMAN = /usr/catman/local @@ -173,13 +191,17 @@ SHLD = #PS = ps -p #(bsdinstall.sh is in conf/) #IOT = IOT +#KSYMS = /unix +#KMEM = /dev/kmem +#UDPSUM = udpcksum -#(irix5) +#(irix5 and irix6.2) #CC = cc $(CPPFLAGS) -xansi -signed #CDEBUG = -g -#CPPFLAGS = -D__STDC__ -D_BSD_SIGNALS -DSIG_FN=void -D__BIT_TYPES_DEFINED__ +#CPPFLAGS = -D__STDC__ -D_BSD_SIGNALS -DSIG_FN=void -D__BIT_TYPES_DEFINED__ \ +# -DCHECK_UDP_SUM -DKMAP #LEX = lex -#LIBS = -ll +#LIBS = -ll -lelf #DESTSBIN = /usr/etc #DESTEXEC = /usr/etc #DESTMAN = /usr/share/catman/local @@ -189,11 +211,20 @@ SHLD = #PS = ps -p #(bsdinstall.sh is in conf/) #IOT = IOT +#KSYMS = /unix +#KMEM = /dev/kmem +#UDPSUM = udpcksum +# shared libresolv.o options below. +# they could work under irix6, if the cmplr didn't change alot +#SHRES = shres/irix +#SHCC = $(CC) $(CPPFLAGS) +#SHLD = ld -shared +#RES = $(SHRES)/libresolv.so #(sunos4.x) -#CC = /usr/bin/cc +#CC = /usr/bin/cc $(CPPFLAGS) #CDEBUG = -g -#CPPFLAGS = -DSUNOS4 -DSPRINTF_CHAR +#CPPFLAGS = -DSUNOS4 -DSPRINTF_CHAR -DCHECK_UDP_SUM -Dconst= #INDOT = in. #XFER_INDOT = in. #LEX = lex @@ -211,6 +242,9 @@ SHLD = #INSTALL_COMPAT = install-compat #INSTALL = install #IOT = IOT +#KSYMS = /vmunix +#KMEM = /dev/kmem +#UDPSUM = _udp_cksum # (for details on shared library building, see shres/sunos/INSTALL; # note that shres/solaris/INSTALL has some good testing notes for sunos) #uncomment next line to build a shared library version of libresolv @@ -219,7 +253,7 @@ SHLD = # -- if you use gcc (recommended) # (if -fpic doesn't work, see shres/sunos/PROBLEMS) #SHCC = gcc -DSUNSECURITY $(CPPFLAGS) -#PIC= -fpic -D_res=_res_shlib +#PIC= -B/usr/bin/ -fpic -D_res=_res_shlib # -- if you use Sun's cc #SHCC = /usr/bin/cc -DSUNSECURITY $(CPPFLAGS) #PIC = -pic -D_res=_res_shlib @@ -229,7 +263,7 @@ SHLD = #(ULTRIX, other 4.[23]bsd-alikes) #CDEBUG = -g -#CPPFLAGS = +#CPPFLAGS = -DCHECK_UDP_SUM #LEX = lex #LIBS = -ll #PIDDIR = /etc @@ -244,6 +278,9 @@ SHLD = #MANDIR = man #MANROFF = cat #IOT = IOT +#KSYMS = /vmunix +#KMEM = /dev/kmem +#UDPSUM = udpcksum #(solaris2.x/sunos5.x) #be careful with installation - note in particular that the system ships @@ -258,17 +295,20 @@ SHLD = #LEX = lex #uncomment next line for Sun C compiler #CC = /opt/SUNWspro/bin/cc $(CPPFLAGS) -R$(DESTLIB) -#uncomment next line for GNU C compiler -#CC = gcc $(CPPFLAGS) -Xlinker -R$(DESTLIB) +#uncomment next two lines for GNU C compiler +#CC = gcc $(CPPFLAGS) +#LDFLAGS=-Xlinker -R$(DESTLIB) #otherwise uncomment the next line and hope for the best #CC = cc $(CPPFLAGS) #CDEBUG = -g -#CPPFLAGS = -DSVR4 -D_SYS_STREAM_H $(SOLCOMPAT) +#CPPPFLAGS = -DSVR4 -D_SYS_STREAM_H +#CPPFLAGS = $(CPPPFLAGS) $(SOLCOMPAT) #INDOT = in. #XFER_INDOT = #LIBS = -ll -lnsl -lsocket #DESTEXEC = /usr/sbin #DESTHELP = /usr/lib +#INSTALL_COMPAT = install-compat #LDS = : #INSTALL = /usr/ucb/install #RANLIB = : @@ -295,18 +335,18 @@ SHLD = # uncomment only one of the triplets of lines below # -- if you use gcc (recommended) # (if -fpic doesn't work, see shres/solaris/ISSUES) -#SHCC = gcc -DSVR4 -D_SYS_STREAM_H +#SHCC = gcc -B/usr/ccs/bin/ $(CPPPFLAGS) #PIC= -fpic #SHLD = /usr/ccs/bin/ld -G # -- if you use Sun's cc -#SHCC = /opt/SUNWspro/bin/cc -DSVR4 -D_SYS_STREAM_H +#SHCC = /opt/SUNWspro/bin/cc $(CPPPFLAGS) #PIC = -Kpic #SHLD = /opt/SUNWspro/bin/cc -G #(hpux7.0,hpux8.0,hpux9.0,) #CC = cc $(CPPFLAGS) #CDEBUG = -g -#CPPFLAGS = +#CPPFLAGS = -DCHECK_UDP_SUM #LEX = lex #LIBS = -ll -lBSD #PIDDIR = /etc @@ -318,6 +358,28 @@ SHLD = #RANLIB = : #MANROFF = cat #PS = ps -p +#KSYMS = /hp-ux +#KMEM = /dev/kmem +#UDPSUM = udpcksum +#(bsdinstall.sh is in conf/) + +#(hpux10.10) +#CC = cc $(CPPFLAGS) +#CDEBUG = -g +#CPPFLAGS = -Dconst= +#LEX = lex +#LIBS = -ll +#PIDDIR = /etc +#DESTSBIN = /usr/sbin +#DESTEXEC = /usr/sbin +#DESTMAN = /usr/man +#DESTHELP = /usr/lib +#LDS = : +#INSTALL = bsdinstall.sh +#RANLIB = : +#MANROFF = cat +#PS = ps -p +#INSTALL_COMPAT = install-install #(bsdinstall.sh is in conf/) #(apollo domainos) @@ -346,6 +408,18 @@ SHLD = #PS = ps -p #IOT = IOT +#(AIX4) +#CC = cc $(CPPFLAGS) +#CDEBUG = -g +#CPPFLAGS = -D_BSD=44 +#LIBS = -ll -lbsd +#DESTEXEC = /usr/sbin +#INSTALL = /usr/ucb/install +#CATEXT = $$$$N +#LEX = lex +#PS = ps -p +#IOT = IOT + # (ConvexOS-10.x) #CC = gcc $(CPPFLAGS) -g -O2 -fpcc-struct-return -fno-builtin -funsigned-char #CDEBUG = -g @@ -398,10 +472,19 @@ SHLD = #PS = ps -p #IOT = IOT -# SCO Unix 3.4.2 / ODT 3.0 using gcc (the only choice for now) +# SCO OSE5, SCO ODT 3.0, SCO Unix 3.2v4.2 +# uncomment only one set of the CC/CDEBUG lines below +# -- OSE5 using SCO's cc +#CC = cc $(CPPFLAGS) +#CDEBUG=-O3 +# -- ODT 3.0 / 3.2v4.2 using SCO's cc ( lots of warnings during compilation ) +#CC = cc $(CPPFLAGS) +#CDEBUG=-O +# -- if you use gcc ( gcc highly recommended on 3.2v4.2 / ODT 3.0 ) #CC = gcc $(CPPFLAGS) -#CPPFLAGS = -DSYSV -DSYSV3 #CDEBUG=-O6 +# For the time being, the rest is common for all supported SCO flavors +#CPPFLAGS = -DSYSV -DSYSV3 #LDFLAGS=-s #INDOT= #LEX=lex @@ -586,8 +669,8 @@ SHLD = #IOT = IOT #(ISC4.0 using GCC) -#CC = gcc -DISC -posix -#CPPFLAGS = +#CC = gcc $(CPPFLAGS) -posix +#CPPFLAGS = -DISC #CDEBUG = -g #LEX = flex -I #LIBS = -lbsd @@ -649,6 +732,98 @@ SHLD = #PS = ps -p #IOT = IOT +#NCR System Vr4.3 3.x +#also, use 'make install' at your own risk. +#PIDDIR = /etc/inet +#LEX = lex +#CC = cc $(CPPFLAGS) +#CDEBUG = -g +#CPPFLAGS = -DSVR4 -Hnocopyr -DPOSIX_SIGNALS -DNO_SA_LEN -DNCR -w +#INDOT = in. +#XFER_INDOT = in. +#LIBS = -ll -lnsl -lsocket +#DESTEXEC = /usr/sbin +#LDS = : +#RANLIB = : +#ARPREF = `lorder +#ARSUFF = | tsort` +#CATEXT = $$$$N +#PS = ps -p +#IOT = IOT + +#NCR System Vr4.3-3.0 +#also, use 'make install' at your own risk. +#PIDDIR = /etc/inet +#LEX = lex +#CC = cc $(CPPFLAGS) +#CDEBUG = -g +#CPPFLAGS = -DSVR4 -Hnocopyr -DPOSIX_SIGNALS -DNO_SA_LEN -DNCR -w +#INDOT = in. +#XFER_INDOT = in. +#LIBS = -ll -lnsl -lsocket +#DESTEXEC = /usr/sbin +#LDS = : +#RANLIB = : +#ARPREF = `lorder +#ARSUFF = | tsort` +#CATEXT = $$$$N +#PS = ps -p +#IOT = IOT +#SHCC = cc $(CPPPFLAGS) +#PIC = -Kpic +#SHLD = cc -G +#SHRES = shres/ncr + +#NCR System Vr4.3-2.03 +#also, use 'make install' at your own risk. +#PIDDIR = /etc +#LEX = lex +#CC = cc $(CPPFLAGS) +#CDEBUG = -g +#CPPFLAGS = -DSVR4 -Hnocopyr -DPOSIX_SIGNALS -DNO_SA_LEN -DNCR -w +#INDOT = +#XFER_INDOT = +#LIBS = -ll -lnsl -lsocket +#DESTSBIN = /usr/etc +#DESTEXEC = /usr/etc +#LDS = : +#RANLIB = : +#ARPREF = `lorder +#ARSUFF = | tsort` +#CATEXT = $$$$N +#PS = ps -p +#IOT = IOT +#SHCC = cc $(CPPPFLAGS) +#PIC = -Kpic +#SHLD = cc -G +#SHRES = shres/ncr + +#(UXP/DS) +#PIDDIR = /etc +#LEX = lex +#CC = cc $(CPPFLAGS) +#CDEBUG = -O +#CPPFLAGS = -DSVR4 -D_SYS_STREAM_H -DUSE_POSIX +#INDOT = in. +#XFER_INDOT = +#LIBS = -ll -lnsl -lsocket +#LDS = : +#COMPINCL = compat/include +#AR = ar -cru +## for V10L20 +#INSTALL = /usr/ucb/install -g sys +## for V20L10 +#INSTALL = /usr/ucb/install +#RANLIB = : +#ARPREF = `lorder +#ARSUFF = | tsort` +#CATEXT = $$$$N +#PS = ps -p +#IOT = IOT +#PIC = -Kpic +#MANROFF = ( tbl | nroff -man ) +#MANDIR = man + #################################################################### ############ no user servicable parts beyond this point ############ #################################################################### @@ -666,7 +841,8 @@ MARGS = "VER=${VER}" "CC=${CC}" "CDEBUG=${CDEBUG}" "LIBS=${LIBS}" \ "DESTHELP=${DESTHELP}" "PIC=${PIC}" "SHCC=${SHCC}" "SHLD=${SHLD}" \ "AR=${AR}" "RANLIB=${RANLIB}" "LDS=${LDS}" 'ARPREF=${ARPREF}' \ 'ARSUFF=${ARSUFF}' $(MANARGS) PS="${PS}" "IOT=${IOT}" \ - "CPPFLAGS=${CPPFLAGS}" + "CPPFLAGS=${CPPFLAGS}" "KSYMS=${KSYMS}" "KMEM=${KMEM}" \ + "UDPSUM=${UDPSUM}" "SHVER=${SHVER}" "SHMAJVER=${SHMAJVER}" MACHINE = native DST = $(MACHINE).b @@ -694,8 +870,10 @@ clean:: FRC depend:: FRC mkdirs: FRC - -set +e; for x in $(DESTBIN) $(DESTSBIN) $(DESTEXEC) \ - $(DESTMAN) $(DESTHELP) $(DESTLIB) $(DESTINC); do \ + -set +e; for x in $(DESTDIR)$(DESTBIN) $(DESTDIR)$(DESTSBIN) \ + $(DESTDIR)$(DESTEXEC) $(DESTDIR)$(DESTMAN) \ + $(DESTDIR)$(DESTHELP) $(DESTDIR)$(DESTLIB) \ + $(DESTDIR)$(DESTINC); do \ test -d $$x || mkdir -p $$x; \ done @@ -770,6 +948,12 @@ $(DST): FRC ( mkdir solaris; cd solaris; ln -s ../../SRC/shres/solaris SRC; \ cp SRC/Makefile .; chmod +w Makefile; \ ); \ + ( mkdir irix; cd irix; ln -s ../../SRC/shres/irix SRC; \ + cp SRC/Makefile .; chmod +w Makefile; \ + ); \ + ( mkdir linux; cd linux; ln -s ../../SRC/shres/linux SRC; \ + cp SRC/Makefile .; chmod +w Makefile; \ + ); \ ); \ ( mkdir man; cd man; ln -s ../SRC/man SRC; \ cp SRC/Makefile .; chmod +w Makefile; \ diff --git a/contrib/bind/README b/contrib/bind/README index cc3d980..7346eef 100644 --- a/contrib/bind/README +++ b/contrib/bind/README @@ -1,7 +1,4 @@ -The official way to get BIND is: ftp ftp.vix.com - cd pub/bind/release - binary - get bind.tar.gz +The official place to get BIND is <URL:ftp://ftp.vix.com/pub/bind/release>. The official mailing lists are: bind-users@vix.com - users/admins (use *-request@* for admin mail) bind-workers@vix.com - developers diff --git a/contrib/bind/conf/options.h b/contrib/bind/conf/options.h index b5548af..bea7eb9 100644 --- a/contrib/bind/conf/options.h +++ b/contrib/bind/conf/options.h @@ -1,7 +1,7 @@ /* options.h - specify the conditionally-compiled features * vix 28mar92 [moved out of the Makefile because they were getting too big] * - * $Id: options.h,v 8.9 1996/05/17 09:10:41 vixie Exp $ + * $Id: options.h,v 8.12 1996/11/11 06:36:43 vixie Exp $ */ /* @@ -93,7 +93,7 @@ #define SLAVE_FORWARD /* use sensible timeouts on slave forwarders (pma) */ #define WANT_PIDFILE /* if you want the named.pid file (ucb/arc) */ #define DOTTED_SERIAL /* if you want to be able to specify dotted serial#s */ -/*#define SENSIBLE_DOTS /* if you want dotted serial#s to make numeric sense */ +#define SENSIBLE_DOTS /* if you want dotted serial#s to make numeric sense */ #define NCACHE /* negative caching (anant@isi.edu) */ /*#define VALIDATE /* validation procedure (anant@isi.edu) (BUGGY!) */ /*#define SHORT_FNAMES /* file names used in named-xfer need to be short */ @@ -107,11 +107,10 @@ #define ADDAUTH /* return NS and glue w/ authorative answers (mpa) */ #define RFC1535 /* use RFC 1535 default for "search" list (vix) */ #define GEN_AXFR /* distinct zones within each class */ -#define DATUMREFCNT /* use reference counts on datums (mpa) */ #define LAME_DELEGATION /* lame delegations (original-del,reworked-bb&del)*/ #define LAME_LOGGING LOG_DEBUG /* log lame delegations, set log level */ #define GETSER_LOGGING LOG_INFO /* log errors/timeouts getting serial number */ -/*#define RETURNSOA /* good code that the world isn't ready for yet */ +#define RETURNSOA /* good code that the world might be ready for now */ #define CLEANCACHE /* useful and necessary in the face of NCACHE */ #define PURGE_ZONE /* remove all traces of a zone when reloading (mpa) */ #define STATS /* keep nameserver statistics; uses more memory */ @@ -150,14 +149,6 @@ # include "dmalloc.h" #endif -/* systems with killall(1M) don't need this - */ -#ifdef __sgi -# ifdef WANT_PIDFILE -# undef WANT_PIDFILE -# endif -#endif - #ifdef LAME_LOGGING # define LAME_DELEGATION #endif diff --git a/contrib/bind/conf/portability.h b/contrib/bind/conf/portability.h index 388b5ff..f7627d9 100644 --- a/contrib/bind/conf/portability.h +++ b/contrib/bind/conf/portability.h @@ -1,12 +1,10 @@ /* portability.h - include or define things that aren't present on all systems * vixie@decwrl 26dec92 [new] * - * $Id: portability.h,v 8.14 1996/06/06 20:19:09 vixie Exp $ + * $Id: portability.h,v 8.20 1996/11/26 10:11:16 vixie Exp $ */ /* - * ++Copyright++ - * - * Copyright (c) * The Regents of the University of California. All rights reserved. * @@ -37,7 +35,9 @@ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. - * - + */ + +/* * Portions Copyright (c) 1993 by Digital Equipment Corporation. * * Permission to use, copy, modify, and distribute this software for any @@ -55,21 +55,38 @@ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. - * - - * --Copyright-- */ -/* XXX: this file has become a hopeless morass, and will be redone someday. */ +/* + * Portions Copyright (c) 1996 by Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +#ifndef __BIND_PORTABILITY_H +#define __BIND_PORTABILITY_H -#include <string.h> -#include <signal.h> #include <sys/types.h> #include <sys/param.h> +#include <signal.h> +#include <string.h> #ifndef TIME_H_INCLUDED # include <sys/time.h> # define TIME_H_INCLUDED #endif +/* (ISC = INTERACTIVE Systems Corporation in the next #ifdef, btw.) */ #ifdef ISC # ifndef _POSIX_SOURCE # define _POSIX_SOURCE @@ -102,7 +119,15 @@ # define setitimer(a,b,c) __setitimer(a,b,c) #endif -/* This is defined in the Makefile for ISC compiles. */ +/* This is for AIX 4.1.x */ +#ifdef _AIX41 +# include <sys/select.h> +# include <sys/time.h> +# include <time.h> +# define vfork fork +#endif + +/* This is defined in the Makefile for INTERACTIVE compiles. */ #if defined(ISC) # define ftruncate(a,b) __ftruncate(a,b) # define USE_MEMCPY @@ -112,17 +137,23 @@ /* SCO UNIX defines only this unique symbol, apparently. */ #if defined(M_UNIX) -/* XXX - why is this POSIX_SOURCE instead of _POSIX_SOURCE? */ -# undef POSIX_SOURCE # define POSIX_SIGNALS -# define HAVE_FCHMOD 0 -# define writev(a,b,c) __writev(a,b,c) -# define ftruncate(a,b) __ftruncate(a,b) +# if !defined(_SCO_DS) +/* This section is for 3.2v4.2/ODT3.0 and maybe also for 3.2v4.1/3.2v4.0 */ +/* XXX - why is this POSIX_SOURCE instead of _POSIX_SOURCE? */ +# undef POSIX_SOURCE +# define HAVE_FCHMOD 0 +# define NEED_WRITEV +# define writev(a,b,c) __writev(a,b,c) +# define ftruncate(a,b) __ftruncate(a,b) +# endif #endif #ifdef NeXT # define NEED_PUTENV # define NEED_SETENV +# define HAVE_STDLIB_H +# define NEED_STRDUP # define inet_addr(a) __inet_addr(a) #endif @@ -133,9 +164,10 @@ #if defined(SUNOS4) # define BSD 43 +# define NEED_STRTOUL #endif -#if defined(__osf__) && defined(__alpha) +#if defined(__osf__) && defined(__alpha) && defined(BSD) && (BSD < 199103) # undef BSD # define BSD 199103 #endif @@ -148,14 +180,16 @@ # define USE_MEMCPY #endif +#if defined(apollo) +# define HAVE_STDLIB_H +#endif #if defined(SVR4) && !defined(SYSV) # define SYSV #endif #if defined(_POSIX_SOURCE) || defined(__sgi) || defined(__ultrix) || \ - defined(__hpux) || (defined(BSD) && (BSD >= 199103)) || \ - (defined(sun) && defined(SYSV)) + defined(__hpux) || (defined(BSD) && (BSD >= 199103)) || defined(sun) # define USE_POSIX #endif @@ -237,38 +271,43 @@ struct timezoneBSD { # define _TIMEZONE timezone #endif -#if defined(USE_POSIX) +#if defined(USE_POSIX) || defined(HAVE_STDLIB_H) # include <stdlib.h> -# include <unistd.h> -# include <limits.h> # if defined(__ultrix) # define NEED_STRDUP # endif #else -# define NEED_STRTOUL -# define NEED_STRDUP +# if !defined(_SCO_DS) +# define NEED_STRDUP +# define NEED_STRTOUL +# endif -# define STDIN_FILENO 0 -# define STDOUT_FILENO 1 -# define STDERR_FILENO 2 # ifndef NeXT extern char *getenv __P((char *)); # else extern char *getenv __P((const char *)); # endif -extern int errno; # if !defined(DMALLOC) && !defined(NeXT) extern char *malloc(), *realloc(), *calloc(); -# if defined(sun) -extern int free(); -# else extern void free(); -# endif # endif +#endif /*HAVE_STDLIB_H*/ + +#if defined(USE_POSIX) +# include <unistd.h> +# include <limits.h> + +#else + +# define STDIN_FILENO 0 +# define STDOUT_FILENO 1 +# define STDERR_FILENO 2 +extern int errno; + extern int getdtablesize __P((void)); # ifdef SHORT_FNAMES extern long pathconf __P((const char *path, int name)); @@ -323,13 +362,15 @@ int strcasecmp __P((const char *, const char *)); extern void syslog(); # endif extern char *ctime __P((const time_t *clock)); +# if !defined(M_UNIX) extern int close(), setitimer(), recv(), sendto(), sigsetmask(), atoi(), getpid(), fork(), read(), ioctl(), setsockopt(), socket(), bind(); +# endif #endif #if !defined(bcopy) /* some machines have their own macros for this */ -# if defined(USE_POSIX) || \ +# if (defined(USE_POSIX) && !defined(SUNOS4)) || \ (defined(__STDC__) && !defined(sun) && !defined(sequent) \ && !defined(M_UNIX)) /* use ANSI C3.159-1989 (``ANSI C'') functions if possible; @@ -368,13 +409,15 @@ extern int bcmp(); # endif #endif -#if (!defined(BSD) || (BSD < 43)) +#if (!defined(BSD) || (BSD < 43)) && !defined(__hpux) # define NEED_MKSTEMP # if !defined(__ultrix) && !defined(apollo) -# define NEED_STRCASECMP -# define NEED_MKTEMP -# if !defined(SVR4) -# define NEED_STRPBRK +# if !defined(_SCO_DS) +# define NEED_STRCASECMP +# define NEED_MKTEMP +# if !defined(SVR4) +# define NEED_STRPBRK +# endif # endif # endif #endif @@ -411,8 +454,8 @@ extern int bcmp(); #if !defined(ntohl) && !defined(htonl) && defined(BSD) && (BSD <= 43) /* if these aren't null macros in netinet/in.h, extern them here. */ -extern u_short htons(), ntohs(); -extern u_long htonl(), ntohl(); +extern u_short htons __P((u_short)), ntohs __P((u_short)); +extern u_long htonl __P((u_long)), ntohl __P((u_long)); #endif #if defined(USE_POSIX) && !defined(sun) && !defined(__sgi) \ @@ -555,12 +598,11 @@ extern u_long htonl(), ntohl(); # define HAVE_FCHMOD 1 #endif - /* - * Types needed for POSIX but missing on some systems. + * Some systems need _res to be linked into text rather than bss. */ -#if defined(SUNOS4) -typedef int ssize_t; +#if defined(__m88k__) +# define __BIND_RES_TEXT #endif /* @@ -593,3 +635,5 @@ extern int gethostname __P((char *, size_t)); #ifdef NEED_STRDUP extern char *strdup __P((const char *)); #endif + +#endif /*__BIND_PORTABILITY_H*/ diff --git a/contrib/bind/doc/bog/00title.me b/contrib/bind/doc/bog/00title.me index 616202b..c9e708c 100644 --- a/contrib/bind/doc/bog/00title.me +++ b/contrib/bind/doc/bog/00title.me @@ -57,7 +57,7 @@ .b "Name Server Operations Guide" .b "for \s-1BIND\s+1" .sz -\fIRelease 4.9.4\fP +\fIRelease 4.9.5\fP .eh 'SMM:10-%''Name Server Operations Guide for \s-1BIND\s+1' .oh 'Name Server Operations Guide for \s-1BIND\s+1''\s-1SMM\s+1:10-%' .sp diff --git a/contrib/bind/doc/bog/Makefile b/contrib/bind/doc/bog/Makefile index 3cd50eb..32456a0 100644 --- a/contrib/bind/doc/bog/Makefile +++ b/contrib/bind/doc/bog/Makefile @@ -62,6 +62,9 @@ ME= -me NROFF= nroff -rb3 PRINTER= -Pdp TBL= dtbl $(PRINTER) +# For Linux: +#PRINTER= +#TBL= tbl $(PRINTER) TROFF= ditroff $(PRINTER) GROFF= groff -Tps -t $(ME) diff --git a/contrib/bind/doc/bog/files.me b/contrib/bind/doc/bog/files.me index 4a28da4..7e75525 100644 --- a/contrib/bind/doc/bog/files.me +++ b/contrib/bind/doc/bog/files.me @@ -250,7 +250,7 @@ Slave mode is activated by placing the simple command \fIoptions forward-only\fP .)b in the bootfile. If this option is used, then you must specify forwarders. -When in slave mode, the server will forward each query to each of the the +When in slave mode, the server will forward each query to each of the forwarders until an answer is found or the list of forwarders is exhausted. The server will not try to contact any remote name server other than those named in the \fIforwarders\fP list. @@ -829,7 +829,7 @@ protocol per address. Note that RFC1123 says of \fIWKS\fP records: ... The TXT and WKS RR types have not been widely used by Internet sites; as a result, an application cannot rely - on the the existence of a TXT or WKS RR in most + on the existence of a TXT or WKS RR in most domains. .)l .sh 3 "CNAME - Canonical Name" @@ -1046,6 +1046,10 @@ recognize it. .sh 2 "Discussion about the TTL" .pp +The use of different Time To Live fields with in a RRset have been +deprecated and this is enforced by the server when loading a primary +zone. See the Security section for more discussion of differing TTLs. +.pp The Time To Live assigned to the records and to the zone via the Minimum field in the SOA record is very important. High values will lead to lower BIND network traffic and faster response time. Lower diff --git a/contrib/bind/doc/bog/ns.me b/contrib/bind/doc/bog/ns.me index ec3ca3c..b507e94 100644 --- a/contrib/bind/doc/bog/ns.me +++ b/contrib/bind/doc/bog/ns.me @@ -1,5 +1,3 @@ -.\" ++Copyright++ 1986, 1988 -.\" - .\" Copyright (c) 1986, 1988 .\" The Regents of the University of California. All rights reserved. .\" @@ -48,8 +46,6 @@ .\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. -.\" - -.\" --Copyright-- .\" .\" @(#)ns.me 6.3 (Berkeley) 9/19/89 .\" @@ -94,3 +90,38 @@ Berkeley would look as follows: .)b The top level domain for educational organizations is EDU; Berkeley is a subdomain of EDU and monet is the name of the host. +.sh 1 Security +.pp +This section examines some of the know security implications of various +versions of BIND. Some of these have been used to attack the nameservers +in the past. +.sh 2 "Unnecessary Glue" +.pp +Unnecessary glue can lead to incorrect records being loaded into the +server. This can result in connections going to the wrong machines. +.pp +To prevent unnecessary glue being loaded, all the servers of zones being +servered by a server and the servers of the parent zones need to be +upgraded to BIND 4.9.3 or later. +.sh 2 "Insertion of data into a zone that is being servered" +.pp +BIND versions prior to BIND 4.9.2 are subject to the insertion of +resource records into zone that they are serving. +.sh 2 "Denial of Service: Hash Bug Exploit" +.pp +September 1996 saw the COM TLD subject to a denial of service attack by +injecting into the DNS a record with a final label of COM, eight spaces +and COM. This effected BIND 4.9.4 servers. Similar attacks are possible +on BIND 4.9.3 and BIND 4.9.3-P1. +.pp +It is recommend that you run a BIND 4.9.4-P1 or later server to avoid +this exploit. +.sh 2 "Denial of Service: TTL Inconsistency Attacks" +.pp +If you are still using multiple TTL values within a RRset you can be +subject to a denial of service attack. BIND 4.9.5 onwards uses multiple +ttl values within a RRset to reject obviously bad RRset. +.pp +It is recommend that you upgrade to BIND 4.9.5 or later as these server +prevent you loading multiple TTL values and doesn't merge answers received +across the network. diff --git a/contrib/bind/doc/misc/FAQ.1of2 b/contrib/bind/doc/misc/FAQ.1of2 index ab55bea..e1d7c0a 100644 --- a/contrib/bind/doc/misc/FAQ.1of2 +++ b/contrib/bind/doc/misc/FAQ.1of2 @@ -1,382 +1,513 @@ Newsgroups: comp.protocols.tcp-ip.domains,comp.answers,news.answers -Path: vixie!news1.digital.com!uunet!in1.uu.net!usc!rutgers!njitgw.njit.edu!hertz.njit.edu!cdp2582 -From: cdp@njit.edu (Chris Peckham) +Path: vixie!news1.digital.com!su-news-hub1.bbnplanet.com!cpk-news-hub1.bbnplanet.com!news.bbnplanet.com!cam-news-hub1.bbnplanet.com!news.mathworks.com!news.kei.com!uhog.mit.edu!rutgers!njitgw.njit.edu!hertz.njit.edu!cdp2582 +From: cdp2582@hertz.njit.edu (Chris Peckham) Subject: comp.protocols.tcp-ip.domains Frequently Asked Questions (FAQ) (Part 1 of 2) -Message-ID: <cptd-faq-1-810621452@njit.edu> +Message-ID: <cptd-faq-1-849940949@njit.edu> Followup-To: comp.protocols.tcp-ip.domains Originator: cdp2582@hertz.njit.edu Keywords: BIND,DOMAIN,DNS Sender: news@njit.edu -Supersedes: <cptd-faq-1-807632375@njit.edu> +Supersedes: <cptd-faq-1-847336183@njit.edu> Nntp-Posting-Host: hertz.njit.edu -X-Posting-Frequency: posted on the 1st of each month +X-Posting-Frequency: posted during the first week of each month Reply-To: domain-faq@njit.edu (comp.protocols.tcp-ip.domains FAQ comments) Organization: NJIT.EDU - New Jersey Institute of Technology, Newark, NJ, USA -Date: Sat, 9 Sep 1995 04:37:47 GMT +Date: Sat, 7 Dec 1996 06:42:36 GMT Approved: news-answers-request@MIT.EDU -Expires: Sat 14 Oct 95 00:37:32 EDT -Lines: 1319 -Xref: vixie comp.protocols.tcp-ip.domains:6018 comp.answers:13881 news.answers:49918 +Expires: Sat 11 Jan 97 02:42:29 EDT +Lines: 1582 +Xref: vixie comp.protocols.tcp-ip.domains:12904 comp.answers:22440 news.answers:85682 Posted-By: auto-faq 3.1.1.2 Archive-name: internet/tcp-ip/domains-faq/part1 -Revision: 1.6 1995/05/12 18:49:48 +Revision: 1.14 1996/12/07 06:42:05 -This FAQ is edited and maintained by Chris Peckham, <cdp@njit.edu>. -The latest version may always be found for anonymous ftp from +Note that this posting has been split into two parts because of its size. - ftp://rtfm.mit.edu/pub/usenet/news.answers/internet/tcp-ip/domains-faq - ftp://ftp.njit.edu/pub/dns/Comp.protocols.tcp-ip.domains.FAQ +$Id: FAQ.1of2,v 8.4 1996/12/18 04:09:47 vixie Exp $ + +A new version of this document appears monthly. If this copy is more +than a month old it may be out of date. + +This FAQ is edited and maintained by Chris Peckham, <cdp@pfmc.net>. The +most recently posted version may be found for anonymous ftp from + +rtfm.mit.edu : /pub/usenet/news.answers/internet/tcp-ip/domains-faq + +It is also available in HTML from +http://www.users.pfmc.net/~cdp/cptd-faq/. If you can contribute any answers for items in the TODO section, please do -so by sending e-mail to domain-faq@njit.edu ! If you know of any items that -are not included and you feel that they should be, send the relevant -information to domain-faq@njit.edu. - - ------------------------------- - -Date: Fri May 12 14:41:47 EDT 1995 -Subject: Table of Contents - -Table of Contents -================= -Part 1 ------- - 0. TO DO - 1. INTRODUCTION / MISCELLANEOUS - 1.1 What is this newsgroup ? - 1.2 More information - 1.3 What is BIND and where is the latest version of BIND ? - 1.4 How can I find the route between systems ? - 1.5 Finding the hostname if you have the tcp-ip address - 1.6 How to register a domain name - 1.7 Change of Domain name - 1.8 How memory and CPU does DNS use ? - 1.9 Other things to consider when planning your servers - 1.10 Proper way to get NS and reverse IP records into DNS - 1.11 How to get my address assign from NIC? - 1.12 Is there a block of private IP addresses I can use? - 1.13 Cache failed lookups - 1.14 What does an NS record really do ? - 1.15 DNS ports - 1.16 Obtaining the latest cache file - 2. UTILITIES - 2.1 Utilities to administer DNS zone files - 2.2 DIG - Domain Internet Groper - 2.3 DNS packet analyzer - 2.4 host - 2.5 Programming with DNS - 2.6 A source of information relating to DNS - 3. DEFINITIONS - 3.1 TCP/IP Host Naming Conventions - 3.2 Slaves and servers with forwarders - 3.3 When is a server authoritative? - 3.4 Underscore in host-/domain names - 3.5 Lame delegation - 3.6 What does opt-class field do? - 3.7 Top level domains - 3.8 Classes of networks - 3.9 What is CIDR ? - 3.10 What is the rule for glue ? - -Part 2 ------- - 4. CONFIGURATION - 4.1 Changing a Secondary server to a Primary - 4.2 How do I subnet a Class B Address ? - 4.3 Subnetted domain name service - 4.4 Recommended format/style of DNS files - 4.5 DNS on a system not connected to the Internet - 4.6 Multiple Domain configuration - 4.7 wildcard MX records - 4.8 How to identify a wildcard MX record - 4.9 Why are fully qualified domain names recommended ? - 4.10 Distributing load using named - 4.11 Order of returned records - 4.12 resolv.conf - 4.13 Delegating authority - 4.14 DNS instead of NIS on a Sun OS 4.1.x system - 5. PROBLEMS - 5.1 No address for root server - 5.2 Error - No Root Nameservers for Class XX - 5.3 Bind 4.9.x and MX querying? - 5.4 Some root nameservers don't know localhost - 5.5 MX records and CNAMES and separate A records for MX targets - 5.6 NS is a CNAME - 5.7 Nameserver forgets own A record - 5.8 General problems (core dumps !) - 5.9 malloc and DECstations - 6. ACKNOWLEDGEMENTS - ------------------------------- - -Date: Wed May 3 12:55:13 EDT 1995 -Subject: Q0 - TO DO list - - -* How to do an initial installation -* How to change service providers (what happens) -* Explain the difference between BIND (an implementation) and DNS (spec) -* Expand the slave/forward section of Q 3.2 -* Add a definition of a "private domain" in discussion (or cut it out) -* mention mail-to-news gateways for newsgroup, mailing lists, anonymous - ftp, etc in what is newsgroup section -* The evils of wildcard MX records - - - -------------------------------- +so by sending e-mail to <domain-faq@pfmc.net> ! If you know of any items +that are not included and you feel that they should be, send the +relevant information to <domain-faq@pfmc.net>. + +=============================================================================== + +Index + + Section 1. TO DO / UPDATES + Q1.1 Contributions needed + Q1.2 UPDATES / Changes since last posting + + Section 2. INTRODUCTION / MISCELLANEOUS + Q2.1 What is this newsgroup ? + Q2.2 More information + Q2.3 What is BIND ? + Q2.4 What is the difference between BIND and DNS ? + Q2.5 Where is the latest version of BIND located ? + Q2.6 How can I find the path taken between two systems/domains ? + Q2.7 How do you find the hostname given the TCP-IP address ? + Q2.8 How do I register a domain ? + Q2.9 How can I change the IP address of our server ? + Q2.10 Issues when changing your domain name + Q2.11 How memory and CPU does DNS use ? + Q2.12 Other things to consider when planning your servers + Q2.13 Proper way to get NS and reverse IP records into DNS + Q2.14 How do I get my address assigned from the NIC ? + Q2.15 Is there a block of private IP addresses I can use? + Q2.16 Does BIND cache negative answers (failed DNS lookups) ? + Q2.17 What does an NS record really do ? + Q2.18 DNS ports + Q2.19 What is the cache file + Q2.20 Obtaining the latest cache file + Q2.21 Selecting a nameserver/root cache + Q2.22 InterNIC and domain names + + Section 3. UTILITIES + Q3.1 Utilities to administer DNS zone files + Q3.2 DIG - Domain Internet Groper + Q3.3 DNS packet analyser + Q3.4 host + Q3.5 How can I use DNS information in my program? + Q3.6 A source of information relating to DNS + + Section 4. DEFINITIONS + Q4.1 TCP/IP Host Naming Conventions + Q4.2 What are slaves and forwarders ? + Q4.3 When is a server authoritative? + Q4.4 My server does not consider itself authoritative ! + Q4.5 NS records don't configure servers as authoritative ? + Q4.6 underscore in host-/domainnames + Q4.7 What is lame delegation ? + Q4.8 How can I see if the server is "lame" ? + Q4.9 What does opt-class field in a zone file do? + Q4.10 Top level domains + Q4.11 Classes of networks + Q4.12 What is CIDR ? + Q4.13 What is the rule for glue ? + + Section 5. CONFIGURATION + Q5.1 Changing a Secondary server to a Primary server ? + Q5.2 Moving a Primary server to another server + Q5.3 How do I subnet a Class B Address ? + Q5.4 Subnetted domain name service + Q5.5 Recommended format/style of DNS files + Q5.6 DNS on a system not connected to the Internet + Q5.7 Multiple Domain configuration + Q5.8 wildcard MX records + Q5.9 How do you identify a wildcard MX record ? + Q5.10 Why are fully qualified domain names recommended ? + Q5.11 Distributing load using named + Q5.12 Order of returned records + Q5.13 resolv.conf + Q5.14 How do I delegate authority for sub-domains ? + Q5.15 DNS instead of NIS on a Sun OS 4.1.x system + Q5.16 Patches to add functionality to BIND + Q5.17 How to serve multiple domains from one server + + Section 6. PROBLEMS + Q6.1 No address for root server + Q6.2 Error - No Root Nameservers for Class XX + Q6.3 Bind 4.9.x and MX querying? + Q6.4 Do I need to define an A record for localhost ? + Q6.5 MX records, CNAMES and A records for MX targets + Q6.6 Can an NS record point to a CNAME ? + Q6.7 Nameserver forgets own A record + Q6.8 General problems (core dumps !) + Q6.9 malloc and DECstations + Q6.10 Can't resolve names without a "." + Q6.11 Err/TO errors being reported + Q6.12 Why does swapping kill BIND ? + + Section 7. ACKNOWLEDGEMENTS + Q7.1 How is this FAQ generated ? + Q7.2 What formats are available ? + Q7.3 Contributors + +=============================================================================== + +Section 1. TO DO / UPDATES + + Q1.1 Contributions needed + Q1.2 UPDATES / Changes since last posting + +----------------------------------------------------------------------------- + +Question 1.1. Contributions needed + +Date: Fri Dec 6 00:40:00 EST 1996 + +* Expand the slave/forward section + +----------------------------------------------------------------------------- + +Question 1.2. UPDATES / Changes since last posting + +Date: Fri Dec 6 00:40:00 EST 1996 + +* The FAQ is now maintained in BFNN (Bizzare format with No Name). This + allows me to create ASCII, HTML, and GNU info (postscript coming soon) + from one source file. +* References to 4.9.4 changed to 4.9.5. +* memory/CPU usage question - removed uunet map reference. Not there... +* Minor edits of information and questions for new format. +* How do I delegate authority for sub-domains ? - edited answer + +=============================================================================== + +Section 2. INTRODUCTION / MISCELLANEOUS + + Q2.1 What is this newsgroup ? + Q2.2 More information + Q2.3 What is BIND ? + Q2.4 What is the difference between BIND and DNS ? + Q2.5 Where is the latest version of BIND located ? + Q2.6 How can I find the path taken between two systems/domains ? + Q2.7 How do you find the hostname given the TCP-IP address ? + Q2.8 How do I register a domain ? + Q2.9 How can I change the IP address of our server ? + Q2.10 Issues when changing your domain name + Q2.11 How memory and CPU does DNS use ? + Q2.12 Other things to consider when planning your servers + Q2.13 Proper way to get NS and reverse IP records into DNS + Q2.14 How do I get my address assigned from the NIC ? + Q2.15 Is there a block of private IP addresses I can use? + Q2.16 Does BIND cache negative answers (failed DNS lookups) ? + Q2.17 What does an NS record really do ? + Q2.18 DNS ports + Q2.19 What is the cache file + Q2.20 Obtaining the latest cache file + Q2.21 Selecting a nameserver/root cache + Q2.22 InterNIC and domain names + +----------------------------------------------------------------------------- + +Question 2.1. What is this newsgroup ? Date: Thu Dec 1 11:08:28 EST 1994 -Subject: Q1.1 - What is this newsgroup ? -comp.protocols.tcp-ip.domains is the usenet newsgroup for discussion -on issues relating to the Domain Name System (DNS). +comp.protocols.tcp-ip.domains is the usenet newsgroup for discussion on +issues relating to the Domain Name System (DNS). This newsgroup is not for issues directly relating to IP routing and addressing. Issues of that nature should be directed towards comp.protocols.tcp-ip. +----------------------------------------------------------------------------- -------------------------------- +Question 2.2. More information + +Date: Fri Dec 6 00:41:03 EST 1996 +You can find more information concerning DNS in the following places: -Date: Fri May 12 13:54:01 EDT 1995 -Subject: Q1.2 - More information +* The BOG (BIND Operations Guide) - in the BIND distribution +* The FAQ included with BIND 4.9.5 in doc/misc/FAQ +* DNS and BIND by Albitz and Liu (an O'Reilly & Associates Nutshell + handbook) +* A number of RFCs (920, 974, 1032, 1034, 1101, 1123, 1178, 1183, 1348, + 1535, 1536, 1537, 1591, 1706, 1712, 1713, 1912, 1918) +* The DNS Resources Directory (DNSRD) http://www.dns.net/dnsrd/ +* If you are having troubles relating to sendmail and DNS, you may wish to + refer to the USEnet newsgroup comp.mail.sendmail and/or the FAQ for that + newsgroup which may be found for anonymous ftp at rtfm.mit.edu : + /pub/usenet/news.answers/mail/sendmail-faq +* Information concerning some frequently asked questions relating to the + Internet (i.e., what is the InterNIC, what is an RFC, what is the IETF, + etc) may be found for anonymous ftp from ds.internic.net : /fyi/fyi4.txt + A version may also be obtained with the URL + gopher://ds.internic.net/00/fyi/fyi4.txt. +* Information on performing an initial installation of BIND may be found + using the DNS Resources Directory at + http://www.dns.net/dnsrd/docs/basic.txt +* Three other USEnet newsgroups: - You can find more information concerning DNS in the following places: - - * The BOG (BIND Operations Guide) - in the BIND distribution - * The FAQ included with bind4.9.3 doc/misc/FAQ - * DNS and BIND by Albitz and Liu (an O'Reilly & Associates Nutshell - handbook) - * A number of RFCs (920, 974, 1032, 1034, 1101, 1123, 1178, 1183, 1348, - 1535, 1536, 1537, 1591, 1706, 1712, 1713) - * The DNS Resource Directory (DNSRD) - http://www.dns.net/dnsrd - * If you are having troubles relating to sendmail and DNS, you may wish to - refer to the USEnet newsgroup comp.mail.sendmail and/or the FAQ for that - newsgroup - ftp://rtfm.mit.edu/pub/usenet/news.answers/mail/sendmail-faq - * Information concerning some frequently asked questions relating to - the Internet (i.e., what is the InterNIC, what is an RFC, what is the - IETF, etc) may be found for anonymous ftp from - ftp://ds.internic.net/fyi/fyi4.txt - A version may also be obtained with the URL - gopher://ds.internic.net/00/fyi/fyi4.txt - - -------------------------------- - -Date: Fri Aug 4 10:18:58 EDT 1995 -Subject: Q1.3 - What is BIND and where is the latest version of BIND ? - -Q: What is BIND ? - -A: From the BOG Introduction - - - The Berkeley Internet Name Domain (BIND) implements - an Internet name server for the BSD operating system. - The BIND consists of a server (or ``daemon'') and a - resolver library. A name server is a network service - that enables clients to name resources or objects and - share this information with other objects in the network. - This in effect is a distributed data base system for - objects in a computer network. BIND is fully integrated - into BSD (4.3 and later releases) network programs for - use in storing and retrieving host names and address. - The system administrator can configure the system to use - BIND as a replacement to the older host table lookup of - information in the network hosts file /etc/hosts. The - default configuration for BSD uses BIND. - -Q: Where is the latest non-beta version of BIND ? - -A: The latest non-beta version of BIND is version 4.9.2. This can be - found for anonymous ftp from - - ftp://gatekeeper.dec.com/pub/misc/vixie/4.9.2-940221.tar.gz - -Q: Where is the latest version of 4.9.3 located ? + * comp.protocols.dns.bind + * comp.protocols.dns.ops + * comp.protocols.dns.std -A: You can reference this URL: - - http://www.isc.org/isc/ - - At this time, the latest version of 4.9.3 may be found for anonymous ftp - from - - ftp://ftp.vix.com/pub/bind/testing/bind-4.9.3-BETA24.tar.gz +----------------------------------------------------------------------------- - You will need GNU zip, Larry Wall's patch program (if there are any - patch files), and a C compiler to get BIND running from the above - mentioned source. +Question 2.3. What is BIND ? - GNU zip is available for anonymous ftp from +Date: Tue Sep 10 23:15:58 EDT 1996 - ftp://prep.ai.mit.edu/pub/gnu/gzip-1.2.4.tar +From the BOG Introduction - - patch is available for anonymous ftp from +The Berkeley Internet Name Domain (BIND) implements an Internet name +server for the BSD operating system. The BIND consists of a server (or +``daemon'') and a resolver library. A name server is a network +service that enables clients to name resources or objects and share this +information with other objects in the network. This in effect is a +distributed data base system for objects in a computer network. BIND +is fully integrated into BSD (4.3 and later releases) network programs +for use in storing and retrieving host names and address. The system +administrator can configure the system to use BIND as a replacement to +the older host table lookup of information in the network hosts file +/etc/hosts. The default configuration for BSD uses BIND. - ftp://prep.ai.mit.edu/pub/gnu/patch-2.1.tar.gz +----------------------------------------------------------------------------- ------------------------------- +Question 2.4. What is the difference between BIND and DNS ? -Date: Mon Jan 2 13:27:27 EST 1995 -Subject: Q1.4 - How can I find the route between systems +Date: Tue Sep 10 23:15:58 EDT 1996 -Q: How can I find the path taken by packets between two systems/domains ? - -A: Get the source of the 'traceroute' command, compile it and install - it on your system. +(text provided by Andras Salamon) DNS is the Domain Name System, a set of +protocols for a distributed database that was originally designed to +replace /etc/hosts files. DNS is most commonly used by applications to +translate domain names of hosts to IP addresses. A client of the DNS is +called a resolver; resolvers are typically located in the application +layer of the networking software of each TCP/IP capable machine. Users +typically do not interact directly with the resolver. Resolvers query the +DNS by directing queries at name servers that contain parts of the +distributed database that is accessed by using the DNS protocols. In +common usage, `the DNS' usually refers just to the data in the database. - One version of this program with additional functionality may be found - for anonymous ftp from +BIND (Berkeley Internet Name Domain) is an implementation of DNS, both +server and client. Development of BIND is funded by the Internet Software +Consortium and is coordinated by Paul Vixie. BIND has been ported to +Windows NT and VMS, but is most often found on Unix. BIND source code is +freely available and very complex; most of the development on the DNS +protocols is based on this code; and most Unix vendors ship BIND-derived +DNS implementations. As a result, the BIND name server is the most widely +used name server on the Internet. In common usage, `BIND' usually refers +to the name server that is part of the BIND distribution, and sometimes to +name servers in general (whether BIND-derived or not). - ftp://ftp.nikhef.nl/pub/network/traceroute.tar.Z +----------------------------------------------------------------------------- - This package is mirrored at +Question 2.5. Where is the latest version of BIND located ? - ftp://ftp.njit.edu/pub/dns/nikhef/traceroute.tar.Z +Fri Dec 6 00:23:19 EST 1996 - Another version may be found for anonymous ftp from +This information may be found at http://www.vix.com/isc/bind.html - ftp://ftp.psc.edu/pub/net_tools/traceroute.tar +At this time, BIND version of 4.9.5 may be found for anonymous ftp from - ------------------------------- +ftp.vix.com : /pub/bind/release/4.9.5/bind-4.9.5-REL.tar.gz + +Other sites that officially mirror the BIND distribution are + +* bind.fit.qut.edu.au : /pub/bind +* ftp.funet.fi : /pub/unix/tcpip/dns/bind +* ftp.univ-lyon1.fr : /pub/mirrors/unix/bind +* ftp.oleane.net : /pub/mirrors/unix/bind +* ftp.ucr.ac.cr : /pub/Unix/dns/bind +* ftp.luth.se : /pub/unix/dns/bind/beta + +You may need GNU zip, Larry Wall's patch program (if there are any patch +files), and a C compiler to get BIND running from the above mentioned +source. + +GNU zip is available for anonymous ftp from + +prep.ai.mit.edu : /pub/gnu/gzip-1.2.4.tar + +patch is available for anonymous ftp from + +prep.ai.mit.edu : /pub/gnu/patch-2.1.tar.gz + +A version of BIND for Windows NT is available for anonymous ftp from + +ftp.vix.com : /pub/bind/release/4.9.5/contrib/ntdns495relbin.zip + +and + +ftp.vix.com : /pub/bind/release/4.9.5/contrib/ntbind495rel.zip + +----------------------------------------------------------------------------- + +Question 2.6. How can I find the path taken between two systems/domains ? + +Date: Fri Dec 6 00:10:31 EST 1996 + +On a Unix system, use traceroute. If it is not available to you, you may +obtain the source source for 'traceroute', compile it and install it on +your system. + +One version of this program with additional functionality may be found for +anonymous ftp from + +ftp.nikhef.nl : /pub/network/traceroute.tar.Z + +Another version may be found for anonymous ftp from + +ftp.psc.edu : /pub/net_tools/traceroute.tar + +----------------------------------------------------------------------------- + +Question 2.7. How do you find the hostname given the TCP-IP address ? Date: Thu Dec 1 09:55:24 EST 1994 -Subject: Q1.5 - Finding the hostname if you have the tcp-ip address -Q: Can someone tell me how can I find the name of the domain if I know the - tcp-ip address of the domain? Is there some kind of service for this? - -A: For an address a.b.c.d you can always do: - -% nslookup -> set q=ptr -> d.c.b.a.in-addr.arpa. +For an address a.b.c.d you can always do: - Most newer version of nslookup (since 4.8.3) will recognize an address, - so you can just say: + % nslookup + > set q=ptr + > d.c.b.a.in-addr.arpa. -% nslookup a.b.c.d - - DiG will work like this also: - -$ dig -x a.b.c.d +Most newer version of nslookup (since 4.8.3) will recognize an address, so +you can just say: - Host from the contrib/host from the bind distribution may also be used. + % nslookup a.b.c.d -------------------------------- - -Date: Fri Apr 28 13:16:32 EDT 1995 -Subject: Q1.6 - How to register a domain name +DiG will work like this also: -Q: I would like to register a domain. How do I do this ? Can a name be - reserved, or must we already have an IP address and be hooked up to the - Internet before obtaining a domain name? - -A: You can talk to your Internet Service Provider (ISP). They can submit - the registration for you. If you are not going to be directly - connected, they should be able to offer MX records for your domain - for mail delivery (so that mail sent to the new domain will be sent - to your "standard" account). In the case where the registration is - done by the organization itself, it still makes the whole process - much easier if the ISP is approached for secondary servers _before_ - the InterNIC is approached for registration. - - For information about making the registration yourself, look to the - InterNIC ! + % dig -x a.b.c.d - ftp://internic.net/templates/ - gopher://rs.internic.net/ - http://www.internic.net/infoguide.html - http://www.ripe.net - - You will need at least two domain name servers when you register your - domain. Many ISP's are willing to provide primary and/or secondary name - service for their customers. +host from the contrib/host from the bind distribution may also be used. + +----------------------------------------------------------------------------- + +Question 2.8. How do I register a domain ? - Many times, registration of a domain name can be initiated by sending - e-mail to the zone contact. You can obtain the contact in the - SOA record for the country, or in a whois server: +Date: Wed Sep 4 23:59:42 EDT 1996 + +You can talk to your Internet Service Provider (ISP). They can submit the +registration for you. If you are not going to be directly connected, they +should be able to offer MX records for your domain for mail delivery (so +that mail sent to the new domain will be sent to your "standard" account). +In the case where the registration is done by the organization itself, it +still makes the whole process much easier if the ISP is approached for +secondary servers _before_ the InterNIC is approached for registration. + +For information about making the registration yourself, look to the +InterNIC (or other similar organization). + +* anonymout ftp from internic.net : /templates +* gopher://rs.internic.net/ +* http://rs.internic.net/reg/reg-forms.html +* http://www.ripe.net/ + +You will need at least two domain name servers when you register your +domain. Many ISP's are willing to provide primary and/or secondary name +service for their customers. + +Please note that the InterNIC is now charging a fee for domain names in +the "COM", "ORG", and "NET". More information may be found from the +Internic at + +http://rs.internic.net/domain-info/fee-policy.html + +Many times, registration of a domain name can be initiated by sending +e-mail to the zone contact. You can obtain the contact in the SOA record +for the country, or in a whois server: $ nslookup -type=SOA fr. origin = ns1.nic.fr mail addr = nic.nic.fr ... - - The mail address to contact in this case is 'nic@nic.fr' (you must - substitute an '@' for the first dot in the mail addr field). - - An alternate method to obtain the e-mail address of the national NIC - is the 'whois' server at InterNIC. - You may be requested to make your request to another email address or - using a certain information template/application. +The mail address to contact in this case is 'nic@nic.fr' (you must +substitute an '@' for the first dot in the mail addr field). + +An alternate method to obtain the e-mail address of the national NIC is +the 'whois' server at InterNIC. + +You may be requested to make your request to another email address or +using a certain information template/application. + +----------------------------------------------------------------------------- + +Question 2.9. How can I change the IP address of our server ? + +Date: Sun May 5 22:46:28 EDT 1996 +(From Mark Andrews) Before the move. -------------------------------- +* Ensure you are running a modern nameserver. BIND 4.9.3-REL + Patch1 is a + good choice. +* Inform all your secondaries that you are going to change. Have them + install both the current and new addresses in their named.boot's. +* Drop the ttl of the A's associated with the nameserver to something + small (5 min is usually good). +* Drop the refesh and retry times of the zone containing the forward + records for the server. +* Configure the new reverse zone before the move and make sure it is + operational. +* On the day of the move add the new A record(s) for the server. Don't + forget to have these added to parent domains. You will look like you are + multihomed with one interface dead. + +Move the machine after gracefully terminating any other services it is +offering. Then, + +* Fixup the A's, ttl, refresh and retry counters. (If you are running an + all server EDIT out all references to the old addresses in the cache + files). +* Inform all the secondaries the move is complete. +* Inform the parents of all zones you are primary of the new NS/A pairs + for the relevent zones. +* Inform all the administators of zones you are secondaring that the + machine has moved. +* For good measure update the serial no for all zones you are primary for. + This will flush out old A's. + +----------------------------------------------------------------------------- + +Question 2.10. Issues when changing your domain name Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q1.7 - Change of Domain name - -Q: We are preparing for a change of our domain name: - abc.foobar.com -> foobar.net - - What are the tricks and caveats we should be aware of ? - -A: The forward zones are easy and there are a number of ways to do it. - One way is the following: - - Have a single db file for the 2 domains, and have a single machine - be the primary server for both abc.foobar.com and foobar.net. - - To resolve the host foo in both domains, use a single zone file which - merely uses this for the host: - + +If you are changing your domain name from abc.foobar.com to foobar.net, +the forward zones are easy and there are a number of ways to do it. One +way is the following: + +Have a single db file for the 2 domains, and have a single machine be the +primary server for both abc.foobar.com and foobar.net. + +To resolve the host foo in both domains, use a single zone file which +merely uses this for the host: + foo IN A 1.2.3.4 - - Use a "@" wherever the domain would be used ie for the SOA: + +Use a "@" wherever the domain would be used ie for the SOA: @ IN SOA (... - - Then use this pair of lines in your named.boot: + +Then use this pair of lines in your named.boot: primary abc.foobar.com db.foobar primary foobar.net db.foobar - - The reverse zones should either contain PTRs to both names, - or to whichever name you believe to be canonical currently. -------------------------------- +The reverse zones should either contain PTRs to both names, or to +whichever name you believe to be canonical currently. -Date: Fri Apr 28 13:52:20 EDT 1995 -Subject: Q1.8 - How memory and CPU does DNS use ? - -Q: How much memory and CPU does DNS use ? +----------------------------------------------------------------------------- + +Question 2.11. How memory and CPU does DNS use ? + +Date: Fri Dec 6 01:07:56 EST 1996 -A: It can use quite a bit ! The main thing that BIND needs is memory. - It uses very little CPU or network bandwidth. The main - considerations to keep in mind when planning are: +It can use quite a bit ! The main thing that BIND needs is memory. It +uses very little CPU or network bandwidth. The main considerations to +keep in mind when planning are: - 1) How many zones do you have and how large are they ? - 2) How many clients do you expect to serve and how active are they ? +* How many zones do you have and how large are they ? +* How many clients do you expect to serve and how active are they ? - As an example, here is a snapshot of memory usage from CSIRO Division - of Mathematics and Statistics, Australia +As an example, here is a snapshot of memory usage from CSIRO Division of +Mathematics and Statistics, Australia Named takes several days to stabalize its memory usage. Our main server stabalises at ~10Mb. It takes about 3 days to reach this size from 6 M at startup. This is under Sun OS 4.1.3U1. - As another example, here is the configuration of ns.uu.net (from late - 1994): +As another example, here is the configuration of ns.uu.net (from late +1994): ns.uu.net only does nameservice. It is running a version of BIND 4.9.3 on a Sun Classic with 96 MB of RAM, 220 MB of swap (remember @@ -384,22 +515,17 @@ A: It can use quite a bit ! The main thing that BIND needs is memory. running Sun OS 4.1.3_U1. Joseph Malcolm, of Alternet, states that named generally hovers at - 5-10% of the CPU, except after a reload, when it eats it all. He - also states that if you are interested in the network connectivity - around the system (ns.uu.net is located off of Falls-Church4), a - PostScript map is available for anonymous ftp from + 5-10% of the CPU, except after a reload, when it eats it all. - ftp://ftp.uu.net/uunet-info/alternet.map.ps +----------------------------------------------------------------------------- - -------------------------------- +Question 2.12. Other things to consider when planning your servers Date: Mon Jan 2 14:24:51 EST 1995 -Subject: Q1.9 - Other things to consider when planning your servers - - When making the plans to set up your servers, you may want to also - consider the following issues: - + +When making the plans to set up your servers, you may want to also +consider the following issues: + A) Server O/S limitations/capacities (which tend to be widely divergent from vendor to vendor) B) Client resolver behavior (even more widely divergent) @@ -424,147 +550,109 @@ Subject: Q1.9 - Other things to consider when planning your servers traffic among several machines strategically located, possibly larger ones, and/or subdividing your domain itself. There are many options, tradeoffs, and DNS architectural paradigms from which to choose. +----------------------------------------------------------------------------- - ------------------------------- +Question 2.13. Proper way to get NS and reverse IP records into DNS Date: Mon Jan 2 13:03:53 EST 1995 -Subject: Q1.10 - Proper way to get NS and reverse IP records into DNS - -Q: Reverse domain registration is separate from forward domain registration. - How do I get it updated ? - -A: Blocks of network addresses have been delegated by the InterNIC. Check - if your network a.b.c.0 is in such a block by using nslookup: +Reverse domain registration is separate from forward domain registration. +Blocks of network addresses have been delegated by the InterNIC. Check if +your network a.b.c.0 is in such a block by using nslookup: nslookup -type=soa c.b.a.in-addr.arpa. nslookup -type=soa b.a.in-addr.arpa. nslookup -type=soa a.in-addr.arpa. - One of the above should give you the information you are looking for - (the others will return with an error something like `*** No start of - authority (SOA) records available for ...') - This will give you the email address of the person to whom you should - address your change request. - - If none of these works, your network probably has not been delegated - by the InterNIC and you need to contact them directly. - - CIDR has meant that the registration is delegated, but registration - of in-addr.arpa has always been separate from forward zones - and - for good reason - in that the forward and reverse zones may have - different policies, contents etc, may be served by a different set - of nameservers, and exist at different times (usually only at point - of creation). There isn't a one-to-one mapping between the two, so - merging the registration would probably cause more problems than - people forgetting/not-knowing that they had to register in-addr.arpa - zones separately. For example, there are organizations that have - hundreds of networks and two or more domains, with a sprinkling of - machines from each network in each of the domains. +One of the above should give you the information you are looking for (the +others will return with an error something like `*** No start of authority +(SOA) records available for ...') This will give you the email address of +the person to whom you should address your change request. - -------------------------------- - -Date: Mon Jan 2 13:08:38 EST 1995 -Subject: Q1.11 - How to get my address assign from NIC ? +If none of these works, your network probably has not been delegated by +the InterNIC and you need to contact them directly. - -Q: Can anyone tell me how can I get the address from NIC? How many subnets - will NIC give to me? - -A: You should probably ask your Internet provider to give you an address. - These days, addresses are being distributed through the providers, - so that they can assign adjacent blocks of addresses to sites that - go through the same provider, to permit more efficient routing on - the backbones. - - Unless you have thousands of hosts, you probably won't be able to get a - class B these days. Instead, you can get a series of class C networks. - Large requests will be queried, so be ready to provide a network plan if - you ask for more than 16 class C networks. - - If you can't do this through your Internet provider, you can look for a - subnet registration form on rs.internic.net. See the answer in this FAQ - to the question "How to register a domain name" for a URL to these - forms. - -------------------------------- +CIDR has meant that the registration is delegated, but registration of +in-addr.arpa has always been separate from forward zones - and for good +reason - in that the forward and reverse zones may have different +policies, contents etc, may be served by a different set of nameservers, +and exist at different times (usually only at point of creation). There +isn't a one-to-one mapping between the two, so merging the registration +would probably cause more problems than people forgetting/not-knowing that +they had to register in-addr.arpa zones separately. For example, there +are organizations that have hundreds of networks and two or more domains, +with a sprinkling of machines from each network in each of the domains. -Date: Mon Jan 2 13:12:01 EST 1995 -Subject: Q1.12 -Is there a block of private IP addresses I can use? +----------------------------------------------------------------------------- +Question 2.14. How do I get my address assigned from the NIC ? -Q: Is there a block of private IP addresses I can use? - -A: This answer may be found in the FAQ for the newsgroup comp.dcom.sys.cisco - available for anonymous ftp from +Date: Fri Dec 6 01:11:34 EST 1996 - ftp://rtfm.mit.edu/pub/usenet/comp.dcom.sys.cisco +You should probably ask your Internet provider to give you an address. +These days, addresses are being distributed through the providers, so that +they can assign adjacent blocks of addresses to sites that go through the +same provider, to permit more efficient routing on the backbones. - There is a block of private IP addresses that you can use. However - whether you wish to do so is an issue of some debate. - - There are two RFCs which discuss this issue, and present opposing - views: - -1597 Address Allocation for Private Internets. Y. Rekhter, B. - Moskowitz, D. Karrenberg & G. de Groot. March 1994. (Format: - TXT=17430 bytes) - -1627 Network 10 Considered Harmful (Some Practices Shouldn't be - Codified). E. Lear, E. Fair, D. Crocker & T. Kessler. June 1994. - (Format: TXT=18823 bytes) - - Neither one of these RFCs is anything more than a set of informational - guidelines; they are *not* words to live by (remember that RFC stands - for Request For Comments). If you're seriously considering using - private IP addresses, please read them both. - - In any event, RFC 1597 documents the allocation of the following - addresses for use by ``private internets'': +Unless you have thousands of hosts, you probably won't be able to get a +class B these days. Instead, you can get a series of class C networks. +Large requests will be queried, so be ready to provide a network plan if +you ask for more than 16 class C networks. + +If you can't do this through your Internet provider, you can look for a +subnet registration form on rs.internic.net. See the answer in this FAQ +to the question "How do I register a domain" for a URL to these forms. + +----------------------------------------------------------------------------- + +Question 2.15. Is there a block of private IP addresses I can use? + +Date: Sun May 5 23:02:49 EDT 1996 + +Yes there is. Please refer to RFC 1918: + + 1918 Address Allocation for Private Internets. Y. Rekhter, B. + Moskowitz, D. Karrenberg, G. de Groot, & E. Lear. February 1996. + (Format: TXT=22270 bytes) +RFC 1918 documents the allocation of the following addresses for use by +``private internets'': + 10.0.0.0 - 10.255.255.255 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255.255 - - Most importantly, it is vital that nothing using these addresses - should ever connect to the global Internet, or have plans to do so. - Please read the above RFCs before considering implementing such - a policy. +----------------------------------------------------------------------------- -------------------------------- +Question 2.16. Does BIND cache negative answers (failed DNS lookups) ? Date: Mon Jan 2 13:55:50 EST 1995 -Subject: Q1.13 - Cache failed lookups -Q: Does BIND cache negative answers (failed DNS lookups) ? +Yes, BIND 4.9.3 and more recent versions will cache negative answers. -A: Yes, BIND 4.9.3 will cache negative answers. +----------------------------------------------------------------------------- - -------------------------------- +Question 2.17. What does an NS record really do ? -Date: Fri Feb 10 15:35:07 EST 1995 -Subject: Q1.14 - What does an NS record really do ? +Date: Wed Sep 4 22:52:18 EDT 1996 -Q: What does a NS record really do ? +The NS records in your zone data file pointing to the zone's name servers +(as opposed to the servers of delegated subdomains) don't do much. +They're essentially unused, though they are returned in the authority +section of reply packets from your name servers. -A: The NS records in your zone data file pointing to the zone's name - servers (as opposed to the servers of delegated subdomains) don't do - much. They're essentially unused, though they are returned in the - authority section of reply packets from your name servers. +However, the NS records in the zone file of the parent domain are used to +find the right servers to query for the zone in question. These records +are more important than the records in the zone itself. -------------------------------- +----------------------------------------------------------------------------- -Date: Fri Feb 10 15:40:10 EST 1995 -Subject: Q1.15 - DNS ports +Question 2.18. DNS ports -Q: Does anyone out there have any information/experience on exactly which - TCP/UDP ports DNS uses to send and receive queries ? +Date: Fri Feb 10 15:40:10 EST 1995 -A: Use the following chart: +The following table shows what TCP/UDP ports DNS uses to send and receive +queries: Prot Src Dst Use udp 53 53 Queries between servers (eg, recursive queries) @@ -579,40 +667,36 @@ A: Use the following chart: Note: >1023 is for non-priv ports on Un*x clients. On other client types, the limit may be more or less. - Another point to keep in mind when designing filters for DNS is that a - DNS server uses port 53 both as the source and destination for it's - queries. So, a client queries an initial server from an unreserved - port number to UDP port 53. If the server needs to query another - server to get the required info, it sends a UDP query to that server - with both source and destination ports set to 53. The response is then - sent with the same src=53 dest=53 to the first server which then - responds to the original client from port 53 to the original source - port number. - - The point of all this is that putting in filters to only allow UDP - between a high port and port 53 will not work correctly, you must also - allow the port 53 to port 53 UDP to get through. - - Also, ALL versions of BIND use TCP for queries in some cases. The - original query is tried using UDP. If the response is longer than - the allocated buffer, the resolver will retry the query using a TCP - connection. If you block access to TCP port 53 as suggested above, - you may find that some things don't work. - - Newer version of BIND allow you to configure a list of IP addresses - from which to allow zone transfers. This mechanism can be used to - prevent people from outside downloading your entire namespace. +Another point to keep in mind when designing filters for DNS is that a DNS +server uses port 53 both as the source and destination for it's queries. +So, a client queries an initial server from an unreserved port number to +UDP port 53. If the server needs to query another server to get the +required info, it sends a UDP query to that server with both source and +destination ports set to 53. The response is then sent with the same +src=53 dest=53 to the first server which then responds to the original +client from port 53 to the original source port number. +The point of all this is that putting in filters to only allow UDP between +a high port and port 53 will not work correctly, you must also allow the +port 53 to port 53 UDP to get through. -------------------------------- +Also, ALL versions of BIND use TCP for queries in some cases. The +original query is tried using UDP. If the response is longer than the +allocated buffer, the resolver will retry the query using a TCP +connection. If you block access to TCP port 53 as suggested above, you +may find that some things don't work. +Newer version of BIND allow you to configure a list of IP addresses from +which to allow zone transfers. This mechanism can be used to prevent +people from outside downloading your entire namespace. -Date: Fri Apr 28 14:19:10 EDT 1995 -Subject: Q1.16 - Obtaining the latest cache file +----------------------------------------------------------------------------- -Q: What is the cache file and where can I obtain the latest version ? +Question 2.19. What is the cache file -A: From the "Name Server Operations Guide" +Date: Fri Dec 6 01:15:22 EST 1996 + +From the "Name Server Operations Guide" 6.3. Cache Initialization @@ -625,13 +709,27 @@ A: From the "Name Server Operations Guide" higher authorities. The location of this file is specified in the boot file. ... - A copy of the comments in the file available from the InterNIC follow: +----------------------------------------------------------------------------- + +Question 2.20. Obtaining the latest cache file + +Date: Fri Dec 6 01:15:22 EST 1996 + +If you have a version of dig running, you may obtain the information with +the command + + dig @a.root-servers.net. . ns + +A perl script to handle some possible problems when using this method +from behind a firewall and that can also be used to periodically obtain +the latest cache file was posted to comp.protocols.tcp-ip.domains during +early October, 1996. It was posted with the subject "Keeping db.cache +current". It is available at +http://www.users.pfmc.net/~cdp/cptd-faq/current_db_cache.txt. + +The latest cache file may also be obtained from the InterNIC via ftp or +gopher: - ; This file holds the information on root name servers needed to - ; initialize cache of Internet domain name servers - ; (e.g. reference this file in the "cache . <file>" - ; configuration file of BIND domain name servers). - ; ; This file is made available by InterNIC registration services ; under anonymous FTP as ; file /domain/named.root @@ -640,84 +738,142 @@ A: From the "Name Server Operations Guide" ; under menu InterNIC Registration Services (NSI) ; submenu InterNIC Registration Archives ; file named.root - ; - ; last update: Oct 5, 1994 - ; related version of root zone: 1994100500 - ; - If you have a version of dig running, you may obtain the information with - the command +----------------------------------------------------------------------------- - dig @ns.internic.net . ns - +Question 2.21. Selecting a nameserver/root cache -------------------------------- +Date: Mon Aug 5 22:54:11 EDT 1996 +Exactly how is the a root server selected from the root cache? Does the +resolver attempt to pick the closest host or is it random or is it via +sortlist-type workings? If the root server selected is not available (for +whatever reason), will the the query fail instead of attempting another +root server in the list ? -Date: Mon Jan 2 13:13:49 EST 1995 -Subject: Q2.1 - Utilities to administer DNS zone files - -Q: I am wondering if there are utilities available to ease the - administration of the zone files in the DNS. - -A: There are a few. Two common ones are h2n and makezones. Both are perl - scripts. h2n is used to convert host tables into zone data files. It - is available for anonymous ftp from +Every recursive BIND name server (that is, one which is willing to go out +and find something for you if you ask it something it doesn't know) will +remember the measured round trip time to each server it sends queries to. +If it has a choice of several servers for some domain (like "." for +example) it will use the one whose measured RTT is lowest. - ftp://ftp.uu.net/published/oreilly/nutshell/dnsbind/dns.tar.Z. - - makezones works from a single file that looks like a forward zone file, - with some additional syntax for special cases. It is included in the - current BIND distribution. The newest version is always available for - anonymous ftp from +Since the measured RTT of all NS RRs starts at zero (0), every one gets +tried one time. Once all have responded, all RTT's will be nonzero, and +the "fastest server" will get all queries henceforth, until it slows down +for some reason. + +To promote dispersion and good recordkeeping, BIND will penalize the RTT +by a little bit each time a server is reused, and it will penalize the RTT +a _lot_ if it ever has to retransmit a query. For a server to stay "#1", +it has to keep on answering quickly and consistently. + +Note that this is something BIND does that the DNS Specification does not +mention at all. So other servers, those not based on BIND, might behave +very differently. + +----------------------------------------------------------------------------- + +Question 2.22. InterNIC and domain names + +Date: Sun Jun 2 11:23:49 EDT 1996 + +The current InterNIC policy on what to do if someone wants to use a domain +name that is already in use may be found at + +rs.internic.net : /policy/internic/internic-domain-4.txt + +or + +http://rs.internic.net/domain-info/internic-domain-4.html. + +The following information was submitted by Carl Oppedahl +<oppedahl@patents.com> : + +If the jealous party happens to have a trademark registration, it is quite +likely that the domain name owner will lose the domain name, even if they +aren't infringing the trademark. This presents a substantial risk of loss +of a domain name on only 30 days' notice. Anyone who is the manager of an +Internet-connected site should be aware of this risk and should plan for +it. + +See "How do I protect myself from loss of my domain name?" at +http://www.patents.com/weblaw.sht#domloss. + +For an example of an ISP's battle to keep its domain name, see +http://www.patents.com/nsi.sht. + +A compendium of information on the subject may be found at +http://www.law.georgetown.edu/lc/internic/domain1.html. + +=============================================================================== + +Section 3. UTILITIES + + Q3.1 Utilities to administer DNS zone files + Q3.2 DIG - Domain Internet Groper + Q3.3 DNS packet analyser + Q3.4 host + Q3.5 How can I use DNS information in my program? + Q3.6 A source of information relating to DNS + +----------------------------------------------------------------------------- - ftp://ftp.cus.cam.ac.uk/pub/software/programs/DNS/makezones - - This package is mirrored at +Question 3.1. Utilities to administer DNS zone files - ftp://ftp.njit.edu/pub/dns/cus.cam.ac/makezones +Date: Wed Sep 4 22:53:53 EDT 1996 - More information may be found using the DNS Resource Directory +There are a few utilities available to ease the administration of zone +files in the DNS. - http://www.dns.net/dnsrd +Two common ones are h2n and makezones. Both are perl scripts. h2n is +used to convert host tables into zone data files. It is available for +anonymous ftp from +ftp.uu.net : /published/oreilly/nutshell/dnsbind/dns.tar.Z -------------------------------- +makezones works from a single file that looks like a forward zone file, +with some additional syntax for special cases. It is included in the +current BIND distribution. The newest version is always available for +anonymous ftp from + +ftp.cus.cam.ac.uk : /pub/software/programs/DNS/makezones + +More information may be found using the DNS Resources Directory + +http://www.dns.net/dnsrd/. + +----------------------------------------------------------------------------- + +Question 3.2. DIG - Domain Internet Groper Date: Thu Dec 1 11:09:11 EST 1994 -Subject: Q2.2 - DIG - Domain Internet Groper - -Q: Where can I find the latest version of DIG ? - -A: The latest and greatest, official, accept-no-substitutes version of DiG - is the one that comes with BIND. Get the latest kit. -------------------------------- +The latest and greatest, official, accept-no-substitutes version of the +Domain Internet Groper (DiG) is the one that comes with BIND. Get the +latest kit. -Date: Mon May 15 12:57:42 EDT 1995 -Subject: Q2.3 -DNS packet analyser +----------------------------------------------------------------------------- -Q: I'm looking for a Ethernet packet analyser of public domain or standard - (like tcpdump, snoop, packetman) that is able to determine DNS data - field protocol - -A: There is a free ethernet analyser called Ethload available for PC's - running DOS. The latest filename is ETHLD104.ZIP. It understands lots - of protocols including TCP/UDP. It'll look inside there and display - DNS/BOOTP/ICMP packets etc. (Ed. note: something nice for someone to - add to tcpdump ;^) ). Depending on the ethernet controller it's given - it'll perform slightly differently. It handles NDIS/Novell/Packet - drivers. It works best with Novell's promiscuous mode drivers. - A A SimTel mirror site should have the program available for anonymous - ftp. As an example, +Question 3.3. DNS packet analyser - ftp://oak.oakland.edu/SimTel/msdos/lan/ethld104.zip +Date: Wed Sep 4 23:43:57 EDT 1996 +There is a free ethernet analyser called Ethload available for PC's +running DOS. The latest filename is ETHLD104.ZIP. It understands lots of +protocols including TCP/UDP. It'll look inside there and display +DNS/BOOTP/ICMP packets etc. (Ed. note: something nice for someone to add +to tcpdump ;^) ). Depending on the ethernet controller it's given it'll +perform slightly differently. It handles NDIS/Novell/Packet drivers. It +works best with Novell's promiscuous mode drivers. A SimTel mirror site +should have the program available for anonymous ftp. One is -------------------------------- +ftp.coast.net : /SimTel/msdos/lan/ethld104.zip + +----------------------------------------------------------------------------- + +Question 3.4. host Date: Sun Dec 4 21:15:38 EST 1994 -Subject: Q2.4 - host A section from the host man page: @@ -738,289 +894,369 @@ A section from the host man page: numeric Internet addresses. 'host' is compatible with both BIND 4.9 and BIND 4.8 - + 'host' may be found in contrib/host in the BIND distribution. The latest version always available for anonymous ftp from - ftp://ftp.nikhef.nl/pub/network/host.tar.Z +ftp.nikhef.nl : /pub/network/host.tar.Z It may also be found for anonymous ftp from - ftp://ftp.uu.net/networking/ip/dns/host.tar.Z - -------------------------------- +ftp.uu.net : /networking/ip/dns/host.tar.Z + +----------------------------------------------------------------------------- + +Question 3.5. How can I use DNS information in my program? Date: Fri Feb 10 15:25:11 EST 1995 -Subject: Q2.5 - Programming with DNS -Q: How can I use DNS information in my program? - -A: It depends on precisely what you want to do: - - a) Consider whether you need to write a program at all. It may well - be easier to write a shell program (e.g. using awk or perl) to parse - the output of dig, host or nslookup. - - b) If all you need is names and addresses, there will probably be - system routines 'gethostbyname' and 'gethostbyaddr' to provide this - information. - - c) If you need more details, then there are system routines (res_query - and res_search) to assist with making and sending DNS queries. - However, these do not include a routine to parse the resulting answer - (although routines to assist in this task are provided). There is a - separate library available that will take a DNS response and unpick - it into its constituent parts, returning a C structure that can be - used by the program. The source for this library is available for - anonymous ftp from +It depends on precisely what you want to do: - ftp://hpux.csc.liv.ac.uk/hpux/Networking/Admin/resparse-* +* Consider whether you need to write a program at all. It may well be + easier to write a shell program (e.g. using awk or perl) to parse the + output of dig, host or nslookup. +* If all you need is names and addresses, there will probably be system + routines 'gethostbyname' and 'gethostbyaddr' to provide this + information. +* If you need more details, then there are system routines (res_query and + res_search) to assist with making and sending DNS queries. However, + these do not include a routine to parse the resulting answer (although + routines to assist in this task are provided). There is a separate + library available that will take a DNS response and unpick it into its + constituent parts, returning a C structure that can be used by the + program. The source for this library is available for anonymous ftp at + hpux.csc.liv.ac.uk : /hpux/Networking/Admin/resparse-1.2 -------------------------------- +----------------------------------------------------------------------------- +Question 3.6. A source of information relating to DNS -Date: Wed May 3 12:46:50 EDT 1995 -Subject: Q2.6 - A source of information relating to DNS +Date: Tue Nov 5 23:42:21 EST 1996 -Q: Where can I find utilities and tools to help me manage my zone files ? +You may find utilities and tools to help you manage your zone files +(including WWW front-ends) in the "tools" section of the DNS resources +directory: -A: There are several tools available. Please refer to the "tools" section - of the DNS resources directory: +http://www.dns.net/dnsrd/tools.html - http://www.dns.net/dnsrd/tools.html +There are also a number of IP management tools available. Data +Communications had an article on the subject in Sept/Oct of 1996. The +tools mentioned in the article and a few others may be found at the +following sites: +* IP Address management, http://www.accugraph.com +* IP-Track, http://www.on.com +* NetID, http://www.isotro.com +* QIP, http://www.quadritek.com +* UName-It, http://www.esm.com -------------------------------- +=============================================================================== +Section 4. DEFINITIONS -Date: Fri May 12 14:33:40 EDT 1995 -Subject: Q3.1 - TCP/IP Host Naming Conventions + Q4.1 TCP/IP Host Naming Conventions + Q4.2 What are slaves and forwarders ? + Q4.3 When is a server authoritative? + Q4.4 My server does not consider itself authoritative ! + Q4.5 NS records don't configure servers as authoritative ? + Q4.6 underscore in host-/domainnames + Q4.7 What is lame delegation ? + Q4.8 How can I see if the server is "lame" ? + Q4.9 What does opt-class field in a zone file do? + Q4.10 Top level domains + Q4.11 Classes of networks + Q4.12 What is CIDR ? + Q4.13 What is the rule for glue ? -Q: Is a guide available relating to naming systems ? +----------------------------------------------------------------------------- -A: One guide/resource is RFC 1178, "Choosing a Name for Your Computer", - which is available via anonymous FTP from +Question 4.1. TCP/IP Host Naming Conventions - ftp://ftp.internic.netrfc/rfc1178.txt - - RFCs (Request For Comments) are specifications and guidelines for how - many aspects of TCP/IP and the Internet (should) work. Most RFCs are - fairly technical documents, and some have semantics that are hotly - contested in the newsgroups. But a few, like RFC 1178, are actually - good to read for someone who's just starting along a TCP/IP path. +Date: Mon Aug 5 22:49:46 EDT 1996 - -------------------------------- +One guide that may be used when naming hosts is RFC 1178, "Choosing a Name +for Your Computer", which is available via anonymous FTP from + +ftp.internic.net : /rfc/rfc1178.txt + +RFCs (Request For Comments) are specifications and guidelines for how many +aspects of TCP/IP and the Internet (should) work. Most RFCs are fairly +technical documents, and some have semantics that are hotly contested in +the newsgroups. But a few, like RFC 1178, are actually good to read for +someone who's just starting along a TCP/IP path. + +----------------------------------------------------------------------------- + +Question 4.2. What are slaves and forwarders ? Date: Thu Dec 1 10:32:43 EST 1994 -Subject: Q3.2 - What are slaves and forwarders ? - -Q: What are slaves and forwarders ? - -A: "forwarders" is a list of NS records that are _prepended_ to a list - of NS records to query if the data is not available locally. This - allows a rich cache of records to be built up at a centralized - location. This is good for sites that have sporadic or very slow - connections to the Internet. (demand dial-up, for example) It's - also just a good idea for very large distributed sites to increase - the chance that you don't have to go off to the Internet to get an - IP address. (sometimes for addresses across the street!) - - "slave" modifies this to say to replace the list of NS records - with the forwarders entry, instead of prepending to it. This is - for firewalled environments, where the nameserver can't directly - get out to the Internet at all. - "slave" is meaningless (and invalid, in late-model BINDs) without - "forwarders". "forwarders" is an entry in named.boot, and therefore - applies only to the nameserver (not to resolvers). +"forwarders" is a list of NS records that are _prepended_ to a list of NS +records to query if the data is not available locally. This allows a rich +cache of records to be built up at a centralized location. This is good +for sites that have sporadic or very slow connections to the Internet. +(demand dial-up, for example) It's also just a good idea for very large +distributed sites to increase the chance that you don't have to go off to +the Internet to get an IP address. (sometimes for addresses across the +street!) + +"slave" modifies this to say to replace the list of NS records with the +forwarders entry, instead of prepending to it. This is for firewalled +environments, where the nameserver can't directly get out to the Internet +at all. + +"slave" is meaningless (and invalid, in late-model BINDs) without +"forwarders". "forwarders" is an entry in named.boot, and therefore +applies only to the nameserver (not to resolvers). + +----------------------------------------------------------------------------- -------------------------------- +Question 4.3. When is a server authoritative? Date: Mon Jan 2 13:15:13 EST 1995 -Subject: Q3.3 - When is a server authoritative? - - -Q: What criteria does a server use to determine if it is authoritative - for a domain? - -A: In the case of BIND: - 1) The server contains current data in files for the zone in - question (Data must be current for secondaries, as defined - in the SOA) - 2) The server is told that it is authoritative for the zone, by - a 'primary' or 'secondary' keyword in /etc/named.boot. - 3) The server does an error-free load of the zone. - -Q: I have set up a DNS where there is an SOA record for - the domain, but the server still does not consider itself - authoritative. (I used nslookup and set server=the correct machine.) - It seems to me that something is not matching up somewhere. I suspect - that this is because the service provider has not given us control - over the IP numbers in our own domain, and so while the machine listed - has an A record for an address, there is no corresponding PTR record. - -A: That's possible too, but is unrelated to the first question. - You need to be delegated a zone before outside people will start - talking to your server. However, a server can still be authoritative - for a zone even though it hasn't been delegated authority (it's just - that only the people who use that as their server will see the data). - - A server may consider itself non-authoritative even though it's a - primary if there is a syntax error in the zone (see point 3 above). -Q: I always believe that it was the NS record that defined authoritative - servers. +In the case of BIND: + +* The server contains current data in files for the zone in question (Data + must be current for secondaries, as defined in the SOA) +* The server is told that it is authoritative for the zone, by a 'primary' + or 'secondary' keyword in /etc/named.boot. +* The server does an error-free load of the zone. -A: Nope, delegation is a separate issue from authoritativeness. - You can still be authoritative, but not delegated. (you can also be - delegated, but not authoritative -- that's a "lame delegation") +----------------------------------------------------------------------------- -Q: We have had problems in the past from servers that were - authoritative (primary or secondary) but no NS, so other thought they - were not. Some resolvers get very confused when they get non- - authoritative data from the primary server. +Question 4.4. My server does not consider itself authoritative ! + +Date: Mon Jan 2 13:15:13 EST 1995 -A: Yes, that's a lame delegation. That's not caused by what you said, - but rather by a server which is _not_ authoritative for a zone, yet - someone else (the parent) is saying that a server is authoritative - (via the NS records). +The question was: + + What if I have set up a DNS where there is an SOA record for + the domain, but the server still does not consider itself + authoritative. (when using nslookup and set server=the correct machine.) + It seems that something is not matching up somewhere. I suspect + that this is because the service provider has not given us control + over the IP numbers in our own domain, and so while the machine listed + has an A record for an address, there is no corresponding PTR record. +With the answer: + + That's possible too, but is unrelated to the first question. + You need to be delegated a zone before outside people will start + talking to your server. However, a server can still be authoritative + for a zone even though it hasn't been delegated authority (it's just + that only the people who use that as their server will see the data). + + A server may consider itself non-authoritative even though it's a + primary if there is a syntax error in the zone (see the list in the + previous question). +----------------------------------------------------------------------------- - The set of NS records in the parent zone must be a subset of the - authoritative servers to avoid lame delegations. +Question 4.5. NS records don't configure servers as authoritative ? +Date: Fri Dec 6 16:13:34 EST 1996 -------------------------------- +Nope, delegation is a separate issue from authoritativeness. You can +still be authoritative, but not delegated. (you can also be delegated, +but not authoritative -- that's a "lame delegation") -Date: Fri Apr 28 13:26:37 EDT 1995 -Subject: Q3.4 - underscore in host-/domainnames +----------------------------------------------------------------------------- +Question 4.6. underscore in host-/domainnames -Q: I had a quick look on whether underscores are allowed in host- or - domainnames. +Date: Mon Aug 5 22:39:02 EDT 1996 +The question is "Are underscores are allowed in host- or domainnames" ? RFC 1033 allows them. RFC 1035 doesn't. RFC 1123 doesn't. dnswalk complains about them. - Which RFC is the final authority these days? -A: Actually RFC 1035 deals with names of machines or names of - mail domains. i.e "_" is not permitted in a hostname or on the - RHS of the "@" in local@domain. +Which RFC is the final authority these days? + +Actually RFC 1035 deals with names of machines or names of mail domains. +i.e "_" is not permitted in a hostname or on the RHS of the "@" in +local@domain. - Underscore is permitted where ever the domain is NOT one of - these types of addresses. +Underscore is permitted where ever the domain is NOT one of these types +of addresses. - In general the DNS mostly contains hostnames and mail domainnames. - This will change as new resource record types for authenticating DNS - queries start to appear. +In general the DNS mostly contains hostnames and mail domainnames. This +will change as new resource record types for authenticating DNS queries +start to appear. - The latest version of 'host' checks for illegal characters in A/MX - record names and the NS/MX target names. +The latest version of 'host' checks for illegal characters in A/MX record +names and the NS/MX target names. - After saying all of that, remember that RFC 1123 is a Required Internet - Standard (per RFC 1720), and RFC 1033 isn't. Even 1035 isn't a required - standard. Therefore, RFC 1123 wins, no contest. +After saying all of that, remember that RFC 1123 is a Required Internet +Standard (per RFC 1720), and RFC 1033 isn't. Even RFC 1035 isn't a +required standard. Therefore, RFC 1123 wins, no contest. +From RFC 1123, Section 2.1 -------------------------------- + 2.1 Host Names and Numbers -Date: Fri Dec 2 15:03:56 EST 1994 -Subject: Q3.5 - Lame delegation + The syntax of a legal Internet host name was specified in RFC-952 + [DNS:4]. One aspect of host name syntax is hereby changed: the + restriction on the first character is relaxed to allow either a + letter or a digit. Host software MUST support this more liberal + syntax. -Q: What is lame delegation ? + And described by Dave Barr in RFC1912: -A: Two things are required for a lame delegation: - 1) A nameserver X is delegated as authoritative for a zone. - 2) Nameserver X is not performing nameservice for that zone. + Allowable characters in a label for a host name are only ASCII + letters, digits, and the `-' character. Labels may not be all + numbers, but may have a leading digit (e.g., 3com.com). Labels must + end and begin only with a letter or digit. See [RFC 1035] and [RFC + 1123]. (Labels were initially restricted in [RFC 1035] to start with + a letter, and some older hosts still reportedly have problems with + the relaxation in [RFC 1123].) Note there are some Internet + hostnames which violate this rule (411.org, 1776.com). - Try to think of a lame delegation as a long-term condition, brought - about by a misconfiguration somewhere. Bryan Beecher's 1992 LISA - paper on lame delegations is good to read on this. The problem - really lies in misconfigured nameservers, not "lameness" brought - about by transient outages. The latter is common on the Internet - and hard to avoid, while the former is correctable. +Finally, one more piece of information (From Paul Vixie): - In order to be performing nameservice for a zone, it must have - (presumed correct) data for that zone, and it must be answering - authoritatively to resolver queries for that zone. (The AA bit is - set in the flags section) + RFC 1034 says only that domain names have characters in them, though it + says so with enough fancy and indirection that it's hard to tell exactly. - The "classic" lame delegation case is when nameserver X is delegated - as authoritative for domain Y, yet when you ask Y about X, it - returns non-authoritative data. + Generally, for second level domains (i.e., something you would get from + InterNIC or from the US Domain Registrar and probably other ISO 3166 + country code TLDs), RFC 952 is thought to apply. RFC 952 was about host + names rather than domain names, but the rules seemed good enough. - Here's an example that shows what happens most often (using dig, - dnswalk, and doc to find). + <domainname> ::= <hname> - Let's say the domain bogus.com gets registered at the NIC and they - have listed 2 primary name servers, both from their *upstream* - provider: + <hname> ::= <name>*["."<name>] + <name> ::= <let>[*[<let-or-digit-or-hyphen>]<let-or-digit>] +There has been a recent update on this subject which may be found in + +ftp.internic.net : /internet-drafts/draft-andrews-dns-hostnames-03.txt. + +----------------------------------------------------------------------------- + +Question 4.7. What is lame delegation ? + +Date: Mon Aug 5 22:45:02 EDT 1996 + +Two things are required for a lame delegation: + +* A nameserver X is delegated as authoritative for a zone. +* Nameserver X is not performing nameservice for that zone. + +Try to think of a lame delegation as a long-term condition, brought about +by a misconfiguration somewhere. Bryan Beecher's 1992 LISA paper on lame +delegations is good to read on this. The problem really lies in +misconfigured nameservers, not "lameness" brought about by transient +outages. The latter is common on the Internet and hard to avoid, while +the former is correctable. + +In order to be performing nameservice for a zone, it must have (presumed +correct) data for that zone, and it must be answering authoritatively to +resolver queries for that zone. (The AA bit is set in the flags section) + +The "classic" lame delegation case is when nameserver X is delegated as +authoritative for domain Y, yet when you ask Y about X, it returns +non-authoritative data. + +Here's an example that shows what happens most often (using dig, dnswalk, +and doc to find). + +Let's say the domain bogus.com gets registered at the NIC and they have +listed 2 primary name servers, both from their *upstream* provider: + bogus.com IN NS ns.bogus.com bogus.com IN NS upstream.com bogus.com IN NS upstream1.com - So the root servers have this info. But when the admins at - bogus.com actually set up their zone files they put something like: - +So the root servers have this info. But when the admins at bogus.com +actually set up their zone files they put something like: + bogus.com IN NS upstream.com bogus.com IN NS upstream1.com - So your name server may have the nameserver info cached (which it - may have gotten from the root). The root says "go ask ns.bogus.com" - since they are authoritative +So your name server may have the nameserver info cached (which it may have +gotten from the root). The root says "go ask ns.bogus.com" since they are +authoritative - This is usually from stuff being registered at the NIC (either - nic.ddn.mil or rs.internic.net), and then updated later, but the - folks who make the updates later never let the folks at the NIC know - about it. +This is usually from stuff being registered at the NIC (either nic.ddn.mil +or rs.internic.net), and then updated later, but the folks who make the +updates later never let the folks at the NIC know about it. -Q: How can I see if the server is "lame" ? +----------------------------------------------------------------------------- -A: Go to the authoritative servers one level up, and ask them who - they think is authoritative, and then go ask each one of those - delegees if they think that they themselves are authoritative. If any - responds "no", then you know who the lame delegation is, and who is - delegating lamely to them. You can then send off a message to the - administrators of the level above. +Question 4.8. How can I see if the server is "lame" ? - The 'lamers' script from Byran Beecher really takes care of all this - for you. It parses the lame delegation notices from BIND's syslog - and summarizes them for you. It may be found in the contrib section - of the latest BIND distribution. The latest version is available - for anonymous ftp from +Date: Mon Aug 5 22:45:02 EDT 1996 - ftp://terminator.cc.umich.edu/dns/lame-delegations/ +Go to the authoritative servers one level up, and ask them who they think +is authoritative, and then go ask each one of those delegees if they think +that they themselves are authoritative. If any responds "no", then you +know who the lame delegation is, and who is delegating lamely to them. +You can then send off a message to the administrators of the level above. - If you want to actively check for lame delegations, you can use 'doc' - and 'dnswalk'. You can check things manually with 'dig'. +The 'lamers' script from Byran Beecher really takes care of all this for +you. It parses the lame delegation notices from BIND's syslog and +summarizes them for you. It may be found in the contrib section of the +latest BIND distribution. The latest version is available for anonymous +ftp from -------------------------------- +terminator.cc.umich.edu : /dns/lame-delegations/ -Date: Thu Dec 1 11:10:39 EST 1994 -Subject: Q3.6 - What does opt-class field do? + If you want to actively check for lame delegations, you can use 'doc' +and 'dnswalk'. You can check things manually with 'dig'. + +The InterNIC recently announced a new lame delegation that will be in +effect on 01 October, 1996. Here is a summary: + +* After receipt/processing of a name registration template, and at random + intervals thereafter, the InterNIC will perform a DNS query via UDP + Port 53 on domain names for an SOA response for the name being + registered. +* If the query of the domain name returns a non-authoritative response + from all the listed name servers, the query will be repeated four times + over the next 30 days at random intervals approximately 7 days apart, + with notification to all listed whois and nameserver contacts of the + possible pending deletion. If at least one server answers correctly, + but one or more are lame, FYI notifications will be sent to all contacts + and checking will be discontinued. Additionally, e-mail notices will be + provided to the contact for the name servers holding the delegation to + alert them to the "lame" condition. Notifications will state explicitly + the consequences of not correcting the "lame" condition and will be + assigned a descriptive subject as follows: + + Subject: Lame Delegation Notice: DOMAIN_NAME + + The notification will include a timestamp for when the query was + performed. +* If, following 30 days, the name servers still provide no SOA response, + the name will be placed in a "hold" status and the DNS information will + no longer be propagated. The administrative contact will be notified by + postal mail and all whois contacts will be notified by e-mail, with + instructions for taking corrective action. +* Following 60 days in a "hold" status, the name will be deleted and made + available for reregistration. Notification of the final deletion will + be sent to the name server and domain name contacts listed in the NIC + database. + +----------------------------------------------------------------------------- + +Question 4.9. What does opt-class field in a zone file do? -Q: Just something I was wondering about: What does the opt-class - field in an name database do (the one that always says IN)? - What would happen if I put something else there instead? +Date: Thu Dec 1 11:10:39 EST 1994 -A: This field is the address class. From the BOG - +This field is the address class. From the BOG - ...is the address class; currently, only one class is supported: IN for internet addresses and other internet information. Limited support is included for the HS class, which is for MIT/Athena ``Hesiod'' information. +----------------------------------------------------------------------------- -------------------------------- - -Date: Fri Feb 10 14:49:54 EST 1995 -Subject: Q3.7 - Top level domains +Question 4.10. Top level domains +Date: Fri Dec 6 15:13:35 EST 1996 A section from RFC 1591: @@ -1033,12 +1269,35 @@ A section from RFC 1591: letter country codes from ISO-3166. It is extremely unlikely that any other TLDs will be created. -[ Ed note: the ISO-3166 country codes may be found for anonymous ftp from: +----- + +[ Ed note: the ISO-3166 country codes may be found for anonymous ftp +from: + +* ftp.isi.edu : /in-notes/iana/assignments/country-codes +* ftp.ripe.net : /iso3166-codes - ftp://ftp.isi.edu/in-notes/iana/assignments/country-codes - ftp://ftp.ripe.net/iso3166-codes ] +[ Ed note: Since the Internic started charging for registration services, +(and for other reasons) there are a number of groups that want to offer +an alternative to registering a domain under a "standard" TLD. More +information on some of these options may be found at: + +* http://www.alternic.net/ +* http://www.eu.org/ +* http://www.ml.org/mljoin.html + +You may participate in one of the discussions on iTLD proposals at + +* To sign up: http://www.newdom.com/lists +* Old postings: http://www.newdom.com/archive + +] + +----- + + ... Under each TLD may be created a hierarchy of names. Generally, under the generic TLDs the structure is very flat. That is, many organizations are registered directly under the TLD, and any further @@ -1208,43 +1467,44 @@ A section from RFC 1480: state-wide organizations, clubs, or domain parks. For example: <org-name>.GEN.<state-code>.US. - The application form for the US domain may be found for anonymous ftp - from: +The application form for the US domain may be found: - ftp://internic.net/templates/us-domain-template.txt +* for anonymous ftp from internic.net : /templates/us-domain-template.txt +* http://www.isi.edu/us-domain/ - The application form for the EDU, COM, NET, ORG, and GOV domains may be - found for anonymous ftp from: +The application form for the EDU, COM, NET, ORG, and GOV domains may be +found for anonymous ftp from: - ftp://internic.net/templates/domain-template.txt +internic.net : /templates/domain-template.txt - -------------------------------- +----------------------------------------------------------------------------- -Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q3.8 - Classes of networks +Question 4.11. Classes of networks -Q: I am just kind of curious to what exactly the differences in classes - of networks are (class A, B, C). - -A: An Internet Protocol (IP) address is 32 bit in length, divided into - two or three parts (the network address, the subnet address (if present), - and the host address. The subnet addresses are only present if the - network has been divided into subnetworks. The length of the network, - subnet, and host field are all variable. - - There are five different network classes. The leftmost bits indicate - the class of the network. - - # bits in # bits in - network host -Class field field Internet Protocol address in binary Ranges +Date: Wed Sep 4 22:59:27 EDT 1996 + +The usage of 'classes of networks' (class A, B, C) are historical and have +been replaced by CIDR blocks on the Internet. That being said... + +An Internet Protocol (IP) address is 32 bit in length, divided into two +or three parts (the network address, the subnet address (if present), and +the host address. The subnet addresses are only present if the network +has been divided into subnetworks. The length of the network, subnet, and +host field are all variable. + +There are five different network classes. The leftmost bits indicate the +class of the network. + + # of # of + bits in bits in + network host +Class field field Internet Protocol address in binary Ranges ============================================================================ - A 7 24 0NNNNNNN.HHHHHHHH.HHHHHHHH.HHHHHHHH 1-127.x.x.x - B 14 16 10NNNNNN.NNNNNNNN.HHHHHHHH.HHHHHHHH 128-191.x.x.x - C 22 8 110NNNNN.NNNNNNNN.NNNNNNNN.HHHHHHHH 192-223.x.x.x - D NOTE 1 1110xxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx 224-239.x.x.x - E NOTE 2 11110xxx.xxxxxxxx.xxxxxxxx.xxxxxxxx 240-247.x.x.x + A 7 24 0NNNNNNN.HHHHHHHH.HHHHHHHH.HHHHHHHH 1-127.x.x.x + B 14 16 10NNNNNN.NNNNNNNN.HHHHHHHH.HHHHHHHH 128-191.x.x.x + C 22 8 110NNNNN.NNNNNNNN.NNNNNNNN.HHHHHHHH 192-223.x.x.x + D NOTE 1 1110xxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx 224-239.x.x.x + E NOTE 2 11110xxx.xxxxxxxx.xxxxxxxx.xxxxxxxx 240-247.x.x.x where N represents part of the network address and H represents part of the host address. When the subnet address is defined, the needed bits @@ -1254,77 +1514,76 @@ Class field field Internet Protocol address in binary Ranges NOTE 2: Reserved for future use 127.0.0.1 is reserved for local loopback. - - Under the current arrangements, many class A IP numbers will not be - assigned whereas class C usage will be at a premium. - -------------------------------- +----------------------------------------------------------------------------- -Date: Fri Apr 28 13:31:24 EDT 1995 -Subject: Q3.9 - What is CIDR ? +Question 4.12. What is CIDR ? -Q: What is CIDR ? +Date: Tue Nov 5 23:47:29 EST 1996 -A: CIDR is "Classless Inter-Domain Routing (CIDR). From RFC1517: +CIDR is "Classless Inter-Domain Routing (CIDR). From RFC 1517: - ...Classless Inter-Domain Routing (CIDR) attempts to deal with + ...Classless Inter-Domain Routing (CIDR) attempts to deal with these problems by defining a mechanism to slow the growth of routing tables and reduce the need to allocate new IP network numbers. - Much more information may be obtained in RFCs 1467, 1517, 1518, 1520; - with primary reference 1519 +Much more information may be obtained in RFCs 1467, 1517, 1518, 1520; +with primary reference 1519. + +Also please see the CIDR FAQ at +* http://www.ibm.net.il/~hank/cidr.html +* http://www.rain.net/faqs/cidr.faq.html +* http://www.lab.unisource.ch/services/internet/direct/cidr.html -------------------------------- +----------------------------------------------------------------------------- +Question 4.13. What is the rule for glue ? Date: Fri Apr 28 13:31:24 EDT 1995 -Subject: Q3.10 - What is the rule for glue ? -Q: What is the rule for glue ? +A glue record is an A record for a name that appears on the right-hand +side of a NS record. So, if you have this: -A: A glue record is an A record for a name that appears on the right-hand - side of a NS record. So, if you have this: sub.foobar.com. IN NS dns.sub.foobar.com. dns.sub.foobar.com. IN A 1.2.3.4 - then the second record is a glue record (for the NS record above it). - - You need glue records when -- and only when -- you are delegating - authority to a nameserver that "lives" in the domain you are delegating - *and* you aren't a secondary server for that domain. - - In other words, in the example above, you need to add an A record - for dns.sub.foobar.com since it "lives" in the domain it serves. - This boot strapping information is necessary: How are you supposed - to find out the IP address of the nameserver for domain FOO if the - nameserver for FOO "lives" in FOO? - - If you have this NS record: - +then the second record is a glue record (for the NS record above it). + +You need glue records when -- and only when -- you are delegating +authority to a nameserver that "lives" in the domain you are delegating +*and* you aren't a secondary server for that domain. + +In other words, in the example above, you need to add an A record for +dns.sub.foobar.com since it "lives" in the domain it serves. This boot +strapping information is necessary: How are you supposed to find out the +IP address of the nameserver for domain FOO if the nameserver for FOO +"lives" in FOO? + +If you have this NS record: + sub.foobar.com. IN NS dns.xyz123.com. - you do NOT need a glue record, and, in fact, adding one is a very - bad idea. If you add one, and then the folks at xyz123.com change - the address, then you will be passing out incorrect data. - - Also, unless you actually have a machine called something.IN-ADDR.ARPA, - you will never have any glue records present in any of your "reverse" - files. +you do NOT need a glue record, and, in fact, adding one is a very bad +idea. If you add one, and then the folks at xyz123.com change the +address, then you will be passing out incorrect data. + +Also, unless you actually have a machine called something.IN-ADDR.ARPA, +you will never have any glue records present in any of your "reverse" +files. - There is also a sort of implicit glue record that can be useful (or - confusing :^) ). If the parent server (abc.foobar.com domain in example - above) is a secondary server for the child, then the A record will be - fetched from the child server when the zone transfer is done. The glue - is still there but it's a little different, it's in the ip address in - the named.boot line instead of explicitly in the data. In this case - you can leave out the explicit glue A record and leave the manually - configured "glue" in just the one place in the named.boot file. +There is also a sort of implicit glue record that can be useful (or +confusing :^) ). If the parent server (abc.foobar.com domain in example +above) is a secondary server for the child, then the A record will be +fetched from the child server when the zone transfer is done. The glue is +still there but it's a little different, it's in the ip address in the +named.boot line instead of explicitly in the data. In this case you can +leave out the explicit glue A record and leave the manually configured +"glue" in just the one place in the named.boot file. - RFC 1537 says it quite nicely: +RFC 1537 says it quite nicely: 2. Glue records @@ -1337,3 +1596,7 @@ A: A glue record is an A record for a name that appears on the right-hand Old BIND versions ("native" 4.8.3 and older versions) showed the problem that wrong glue records could enter secondary servers in a zone transfer. + + +The remainder of the FAQ is in the next part (Part 2 of 2). + diff --git a/contrib/bind/doc/misc/FAQ.2of2 b/contrib/bind/doc/misc/FAQ.2of2 index ae453c9..40e1649 100644 --- a/contrib/bind/doc/misc/FAQ.2of2 +++ b/contrib/bind/doc/misc/FAQ.2of2 @@ -1,247 +1,227 @@ Newsgroups: comp.protocols.tcp-ip.domains,comp.answers,news.answers -Path: vixie!news1.digital.com!uunet!in1.uu.net!usc!rutgers!njitgw.njit.edu!hertz.njit.edu!cdp2582 -From: cdp@njit.edu (Chris Peckham) +Path: vixie!news1.digital.com!su-news-hub1.bbnplanet.com!news.bbnplanet.com!cam-news-hub1.bbnplanet.com!news.mathworks.com!news.kei.com!uhog.mit.edu!rutgers!njitgw.njit.edu!hertz.njit.edu!cdp2582 +From: cdp2582@hertz.njit.edu (Chris Peckham) Subject: comp.protocols.tcp-ip.domains Frequently Asked Questions (FAQ) (Part 2 of 2) -Message-ID: <cptd-faq-2-810621452@njit.edu> +Message-ID: <cptd-faq-2-849940949@njit.edu> Followup-To: comp.protocols.tcp-ip.domains Originator: cdp2582@hertz.njit.edu Keywords: BIND,DOMAIN,DNS Sender: news@njit.edu -Supersedes: <cptd-faq-2-807632375@njit.edu> +Supersedes: <cptd-faq-2-847336183@njit.edu> Nntp-Posting-Host: hertz.njit.edu -X-Posting-Frequency: posted on the 1st of each month +X-Posting-Frequency: posted during the first week of each month Reply-To: domain-faq@njit.edu (comp.protocols.tcp-ip.domains FAQ comments) Organization: NJIT.EDU - New Jersey Institute of Technology, Newark, NJ, USA -References: <cptd-faq-1-810621452@njit.edu> -Date: Sat, 9 Sep 1995 04:38:21 GMT +References: <cptd-faq-1-849940949@njit.edu> +Date: Sat, 7 Dec 1996 06:42:49 GMT Approved: news-answers-request@MIT.EDU -Expires: Sat 14 Oct 95 00:37:32 EDT -Lines: 1110 -Xref: vixie comp.protocols.tcp-ip.domains:6019 comp.answers:13882 news.answers:49919 +Expires: Sat 11 Jan 97 02:42:29 EDT +Lines: 1277 +Xref: vixie comp.protocols.tcp-ip.domains:12905 comp.answers:22441 news.answers:85683 Posted-By: auto-faq 3.1.1.2 Archive-name: internet/tcp-ip/domains-faq/part2 -Revision: 1.5 1995/05/12 18:50:41 - - -This FAQ is edited and maintained by Chris Peckham, <cdp@njit.edu>. -The latest version may always be found for anonymous ftp from - - ftp://rtfm.mit.edu/pub/usenet/news.answers/internet/tcp-ip/domains-faq - ftp://ftp.njit.edu/pub/dns/Comp.protocols.tcp-ip.domains.FAQ - -If you can contribute any answers for items in the TODO section, please do -so by sending e-mail to domain-faq@njit.edu ! If you know of any items that -are not included and you feel that they should be, send the relevant -information to domain-faq@njit.edu. - - ------------------------------- - -Date: Fri May 12 14:41:47 EDT 1995 -Subject: Table of Contents - -Table of Contents -================= -Part 1 ------- - 0. TO DO - 1. INTRODUCTION / MISCELLANEOUS - 1.1 What is this newsgroup ? - 1.2 More information - 1.3 What is BIND and where is the latest version of BIND ? - 1.4 How can I find the route between systems ? - 1.5 Finding the hostname if you have the tcp-ip address - 1.6 How to register a domain name - 1.7 Change of Domain name - 1.8 How memory and CPU does DNS use ? - 1.9 Other things to consider when planning your servers - 1.10 Proper way to get NS and reverse IP records into DNS - 1.11 How to get my address assign from NIC? - 1.12 Is there a block of private IP addresses I can use? - 1.13 Cache failed lookups - 1.14 What does an NS record really do ? - 1.15 DNS ports - 1.16 Obtaining the latest cache file - 2. UTILITIES - 2.1 Utilities to administer DNS zone files - 2.2 DIG - Domain Internet Groper - 2.3 DNS packet analyzer - 2.4 host - 2.5 Programming with DNS - 2.6 A source of information relating to DNS - 3. DEFINITIONS - 3.1 TCP/IP Host Naming Conventions - 3.2 Slaves and servers with forwarders - 3.3 When is a server authoritative? - 3.4 Underscore in host-/domain names - 3.5 Lame delegation - 3.6 What does opt-class field do? - 3.7 Top level domains - 3.8 Classes of networks - 3.9 What is CIDR ? - 3.10 What is the rule for glue ? - -Part 2 ------- - 4. CONFIGURATION - 4.1 Changing a Secondary server to a Primary - 4.2 How do I subnet a Class B Address ? - 4.3 Subnetted domain name service - 4.4 Recommended format/style of DNS files - 4.5 DNS on a system not connected to the Internet - 4.6 Multiple Domain configuration - 4.7 wildcard MX records - 4.8 How to identify a wildcard MX record - 4.9 Why are fully qualified domain names recommended ? - 4.10 Distributing load using named - 4.11 Order of returned records - 4.12 resolv.conf - 4.13 Delegating authority - 4.14 DNS instead of NIS on a Sun OS 4.1.x system - 5. PROBLEMS - 5.1 No address for root server - 5.2 Error - No Root Nameservers for Class XX - 5.3 Bind 4.9.x and MX querying? - 5.4 Some root nameservers don't know localhost - 5.5 MX records and CNAMES and separate A records for MX targets - 5.6 NS is a CNAME - 5.7 Nameserver forgets own A record - 5.8 General problems (core dumps !) - 5.9 malloc and DECstations - 6. ACKNOWLEDGEMENTS - ------------------------------- - -Date: Fri Dec 2 15:31:06 EST 1994 -Subject: Q4.1 - Changing a Secondary server to a Primary - -Q: Do I need to do anything special when I change a server from a secondary - to a primary ? - -A: For 4.8.3, it's prudent to kill and restart following any changes to - named.boot. - - In BIND 4.9.3, you only have to kill and restart named if you change - a primary zone to a secondary or v-v, or if you delete a zone and - remain authoritative for its parent. Every other case should be - taken care of by a HUP. (Ed. note: 4.9.3b9 may still require you to - kill and restart the server due to some bugs in the HUP code). +Revision: 1.13 1996/12/07 06:42:15 + + +(Continued from Part 1, where you'll find the introduction and +table of contents.) + + +=============================================================================== + +Section 5. CONFIGURATION + + Q5.1 Changing a Secondary server to a Primary server ? + Q5.2 Moving a Primary server to another server + Q5.3 How do I subnet a Class B Address ? + Q5.4 Subnetted domain name service + Q5.5 Recommended format/style of DNS files + Q5.6 DNS on a system not connected to the Internet + Q5.7 Multiple Domain configuration + Q5.8 wildcard MX records + Q5.9 How do you identify a wildcard MX record ? + Q5.10 Why are fully qualified domain names recommended ? + Q5.11 Distributing load using named + Q5.12 Order of returned records + Q5.13 resolv.conf + Q5.14 How do I delegate authority for sub-domains ? + Q5.15 DNS instead of NIS on a Sun OS 4.1.x system + Q5.16 Patches to add functionality to BIND + Q5.17 How to serve multiple domains from one server + +----------------------------------------------------------------------------- + +Question 5.1. Changing a Secondary server to a Primary server ? + +Date: Fri Jul 5 23:54:35 EDT 1996 + +For 4.8.3, it's prudent to kill and restart following any changes to +named.boot. + +In BIND 4.9.3, you only have to kill and restart named if you change a +primary zone to a secondary or v-v, or if you delete a zone and remain +authoritative for its parent. Every other case should be taken care of by +a HUP. (Ed. note: 4.9.3b9 may still require you to kill and restart the +server due to some bugs in the HUP code). + +You will also need to update the server information on the root servers. +You can do this by filing a new domain registration form to inform +InterNIC of the change. They will then update the root server's SOA +records. This process usually takes 10-12 business days after they +receive the request. + +----------------------------------------------------------------------------- - You will also need to update the server information on the root servers. - You can do this by filing a new domain registration form to inform - InterNIC of the change. They will then update the root server's SOA - records. This process usually takes 10-12 business days after they - receive the request. +Question 5.2. Moving a Primary server to another server -------------------------------- +Date: Fri Jul 5 23:54:35 EDT 1996 + +The usual solution is to move the primary to ns.newserver.com, and have +ns.oldserver.com be configured as a secondary server until the change to +the root servers takes place after the request has been made to the +InterNIC. + +If you are moving to a different ISP which will change your IP's, the +recommened setting for the SOA that would minimize problems for your name +servers using the old settings can be done as follows: + +Gradually lower the TTL value in your SOA (that's the last one of the five +numbers) to always be equal to the time left until you change over. +(assuming that none of your resource records have individual TTL's set, if +so, do likewise witht them.) So, the day before, lower to 43200 seconds +(12 hours). Then lower every few hours to be the time remaining until +the change-over. So, an hour before the change, you may just want to +lower it all the way to 60 seconds or so. That way no one can cache +information past the change-over. + +After the change, start gradually incrementing the TTL value, because +you'll probably be making changes to work out problems. Once everything +stabilizes, move the TTL up to whatever your normal values are. + +To minimize name servers from using the "old settings", you can do the +same thing with the "refresh" interval in the SOA (the second number of +the SOA). That will tell the secondaries to refresh every X seconds. +Lower that value as you approach the changeover date. You probably don't +want to go much below an hour or you'll start the primary thrashing as all +the secondaries perpetually refresh. + +Also see the answer to the "How can I change the IP address of our server +?" in the INTRODUCTION section. + +----------------------------------------------------------------------------- + +Question 5.3. How do I subnet a Class B Address ? Date: Fri Apr 28 13:34:52 EDT 1995 -Subject: Q4.2 - How do I subnet a Class B Address ? -Q: I just received a Class B internet address and I am wondering where to - get an RFC or other information on how to properly to the TCP/IP - sub-netting. - -A: That you need to subnet at all is something of a misconception. You - can also think of a class B network as giving you 65,534 individual - hosts, and such a network will work. You can also configure your - class B as 16,384 networks of 2 hosts each. That's obviously not - very practical, but it needs to be made clear that you are not - constrained by the size of an octet (remember that many older - devices would not work in a network configured in this manner). - - So, the question is: why do you need to subnet? One reason is that - it is easier to manage a subnetted network, and in fact, you can - delegate the responsibility for address space management to local - administrators on the various subnets. Also, IP based problems will - end up localized rather than affecting your entire network. - - If your network is a large backbone with numerous segments - individually branching off the backbone, that too suggests - subnetting. - - Subnetting can also be used to improve routing conditions. - - You may wish to partition your network to disallow certain protocols - on certain segments of your net. You can, for example, restrict IP or - IPX to certain segments only by adding a router routing high level - protocols, and across the router you may have to subnet. - - Finally, as far as how many subnets you need depends on the answer to - the above question. As far as subnet masks are concerned, the mask - can be anything from 255.0.0.0 to 255.255.255.252. You'll probably be - looking at 9 or 10 bits for the subnet (last octet 128 or 192 - respectively). RFC1219 discusses the issue of subnetting very well - and leaves the network administrator with a large amount of flexibility - for future growth. - - ------------------------------- - -Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q4.3 -Subnetted domain name service +That you need to subnet at all is something of a misconception. You can +also think of a class B network as giving you 65,534 individual hosts, and +such a network will work. You can also configure your class B as 16,384 +networks of 2 hosts each. That's obviously not very practical, but it +needs to be made clear that you are not constrained by the size of an +octet (remember that many older devices would not work in a network +configured in this manner). -Q: After doing some reading (DNS and BIND, Albitz&Liu), I don't really - find any examples of handling subnetted class C networks as separate - DNS domains. - -A: This is possible, just messy. You need to delegate down to the - fourth octet, so you will have one domain per IP address ! Here is - how you can subdelegate a in-addr.arpa address for non-byte aligned - subnet masks: +So, the question is: why do you need to subnet? One reason is that it is +easier to manage a subnetted network, and in fact, you can delegate the +responsibility for address space management to local administrators on the +various subnets. Also, IP based problems will end up localized rather +than affecting your entire network. - Take as an example the net 192.1.1.x, and example subnet mask - 255.255.255.240. - - We first define the domain for the class C net, - -$origin 1.1.192.in-addr.arpa -@ SOA (usual stuff) -@ ns some.nameserver - ns some.other.nameserver -; delegate a subdomain -one ns one.nameserver - ns some.nameserver -; delegate another -two ns two.nameserver - ns some.nameserver -; CNAME pointers to subdomain one -0 CNAME 0.one -1 CNAME 1.one -; through -15 CNAME 15.one -; CNAME pointers to subdomain two -16 CNAME 16.two -17 CNAME 17.two -31 CNAME 31.two -; CNAME as many as required. - - - Now, in the delegated nameserver, one.nameserver - -$origin one.1.1.192.in-addr.arpa -@ SOA (usual stuff) - NS one.nameserver - NS some.nameserver ; secondary for us -0 PTR onenet.one.domain -1 PTR onehost.one.domain -; through -15 PTR lasthost.one.domain - - And similar for the two.1.1.192.in-addr.arpa delegated domain. - - ------------------------------- +If your network is a large backbone with numerous segments individually +branching off the backbone, that too suggests subnetting. + +Subnetting can also be used to improve routing conditions. + +You may wish to partition your network to disallow certain protocols on +certain segments of your net. You can, for example, restrict IP or IPX to +certain segments only by adding a router routing high level protocols, +and across the router you may have to subnet. + +Finally, as far as how many subnets you need depends on the answer to the +above question. As far as subnet masks are concerned, the mask can be +anything from 255.0.0.0 to 255.255.255.252. You'll probably be looking at +9 or 10 bits for the subnet (last octet 128 or 192 respectively). RFC +1219 discusses the issue of subnetting very well and leaves the network +administrator with a large amount of flexibility for future growth. + +----------------------------------------------------------------------------- + +Question 5.4. Subnetted domain name service + +Date: Mon Aug 5 23:00:16 EDT 1996 + +If you are looking for some examples of handling subnetted class C +networks as separate DNS domains, see the Internet Draft + +draft-ietf-cidrd-classless-inaddr-02.txt + +for more information. This file is available for anonymous ftp at + +ds.internic.net : +/internet-drafts/draft-ietf-cidrd-classless-inaddr-02.txt + +or other IETF mirror sites (ftp.is.ca.za [Africa], nic.nordu.net [Europe], +munnari.oz.au [Pacific Rim], ds.internic.net [US East Coast], or +ftp.isi.edu [US West Coast]). + +Details follow- You need to delegate down to the fourth octet, so you will +have one domain per IP address ! Here is how you can subdelegate a +in-addr.arpa address for non-byte aligned subnet masks: + +Take as an example the net 192.1.1.x, and example subnet mask +255.255.255.240. + +We first define the domain for the class C net, + + $origin 1.1.192.in-addr.arpa + @ SOA (usual stuff) + @ ns some.nameserver + ns some.other.nameserver + ; delegate a subdomain + one ns one.nameserver + ns some.nameserver + ; delegate another + two ns two.nameserver + ns some.nameserver + ; CNAME pointers to subdomain one + 0 CNAME 0.one + 1 CNAME 1.one + ; through + 15 CNAME 15.one + ; CNAME pointers to subdomain two + 16 CNAME 16.two + 17 CNAME 17.two + 31 CNAME 31.two + ; CNAME as many as required. + +Now, in the delegated nameserver, one.nameserver + + $origin one.1.1.192.in-addr.arpa + @ SOA (usual stuff) + NS one.nameserver + NS some.nameserver ; secondary for us + 0 PTR onenet.one.domain + 1 PTR onehost.one.domain + ; through + 15 PTR lasthost.one.domain + +And similar for the two.1.1.192.in-addr.arpa delegated domain. + +There is additional documentation and a perl script that may be used for +this purpose available for anonymous ftp from: + +ftp.vix.com : /pub/bind/contrib/gencidrzone + +----------------------------------------------------------------------------- + +Question 5.5. Recommended format/style of DNS files Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q4.4 - Recommended format/style of DNS files -Q: Are there any suggestions for how to layout DNS configuration files - (both forward and reverse)? - -A: This answer is quoted from an article posted by Paul Vixie: - +This answer is quoted from an article posted by Paul Vixie: + I've gone back and forth on the question of whether the BOG should include a section on this topic. I know what I myself prefer, but I'm wary of ramming my own stylistic preferences down the throat of @@ -399,189 +379,174 @@ pc.home A 192.5.5.3 perl/tcl/awk/python tools) will help you maintain a consistent universe even if it's also a complex one. Editing by hand doesn't have to be deadly but you MUST take care. - ------------------------------- - + +----------------------------------------------------------------------------- + +Question 5.6. DNS on a system not connected to the Internet + Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q4.5 - DNS on a system not connected to the Internet - -Q: How do I use DNS on a system that is not connected to the Internet or - set BIND up with an internal root server ? - -A: You need to create your own root domain name server until you connect - to the internet. Your roots need to delegate to mydomain.com and any - in-addr.arpa subdomains you might have, and that's about it. As - soon as you're connected, rip out the fake roots and use the real - ones. - - It does not actually have to be another server pretending to be the root. - You can set up the name server so that it is primary for each domain - above you and leave them empty (i.e. you are foo.bar.com - claim to be - primary for bar.com and com) - -Q: What if you connect intermittently and want DNS to work when you are - connected, and "fail" when you are not ? - -A: You can point the resolver at the name server at the remote site and - if the connection (SLIP/PPP) isn't up, the resolver doesn't have a - route to the remote server and since there's only one name server in - resolv.conf, the resolver quickly backs off the using /etc/hosts. - No problem. You could do the same with multiple name server and a - resolver that did configurable /etc/hosts fallback. - ------------------------------- - +You need to create your own root domain name server until you connect to +the internet. Your roots need to delegate to mydomain.com and any +in-addr.arpa subdomains you might have, and that's about it. As soon as +you're connected, rip out the fake roots and use the real ones. + +It does not actually have to be another server pretending to be the root. +You can set up the name server so that it is primary for each domain above +you and leave them empty (i.e. you are foo.bar.com - claim to be primary +for bar.com and com) + +If you connect intermittently and want DNS to work when you are connected, +and "fail" when you are not, you can point the resolver at the name server +at the remote site and if the connection (SLIP/PPP) isn't up, the resolver +doesn't have a route to the remote server and since there's only one name +server in resolv.conf, the resolver quickly backs off the using +/etc/hosts. No problem. You could do the same with multiple name server +and a resolver that did configurable /etc/hosts fallback. + +----------------------------------------------------------------------------- + +Question 5.7. Multiple Domain configuration + Date: Fri Dec 2 15:40:49 EST 1994 -Subject: Q4.6 -Multiple Domain configuration - -Q: I have seen sites that seem to have multiple domain names pointing to the - same destination. I would like to implement this and have found no - information explaining how to do it. What I would like to do is: - +If you want to have multiple domain names pointing to the same +destination, such as: + ftp ftp.biff.com connects user to -> ftp.biff.com ftp ftp.fred.com connects user to -> ftp.biff.com ftp ftp.bowser.com connects user to -> ftp.biff.com - -A: This is done through CNAME records: - + +You may do this by using CNAMEs: + ftp.bowser.com. IN CNAME ftp.biff.com. - You can also do the same thing with multiple A records. - - ------------------------------- - +You can also do the same thing with multiple A records. + +----------------------------------------------------------------------------- + +Question 5.8. wildcard MX records + Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q4.7 - wildcard MX records -Q: Does BIND not understand wildcard MX records such as the following? - +Does BIND not understand wildcard MX records such as the following? + *.foo.com MX 0 mail.foo.com. - -A: Explicit RR's at one level of specificity will, by design, "block" a - wildcard at a lesser level of specificity. I suspect that you have - an RR (an A RR, perhaps?) for "bar.foo.com" which is blocking the - application of your "*.foo.com" wildcard. The initial MX query is - thus failing (NOERROR but an answer count of 0), and the backup - query finds the A RR for "bar.foo.com" and uses it to deliver the - mail directly (which is what you DIDN'T want it to do). Adding an - explicit MX RR for the host is therefore the right way to handle - this situation. - - See RFC 1034, Section 4.3.3 ("Wildcards") for more information on - this "blocking" behavior, along with an illustrative example. See - also RFC 974 for an explanation of standard mailer behavior in the - face of an "empty" response to one's MX query. - - Basically, what it boils down to is, there is no point in trying to - use a wildcard MX for a host which is otherwise listed in the DNS. - It just doesn't work. - ------------------------------- -Date: Thu Dec 1 11:10:39 EST 1994 -Subject: Q4.8 - How to identify a wildcard MX record +No. It just doesn't work. +Explicit RR's at one level of specificity will, by design, "block" a +wildcard at a lesser level of specificity. I suspect that you have an RR +(an A RR, perhaps?) for "bar.foo.com" which is blocking the application of +your "*.foo.com" wildcard. The initial MX query is thus failing (NOERROR +but an answer count of 0), and the backup query finds the A RR for +"bar.foo.com" and uses it to deliver the mail directly (which is what you +DIDN'T want it to do). Adding an explicit MX RR for the host is therefore +the right way to handle this situation. -Q: How do you identify a wildcard MX record ? +See RFC 1034, Section 4.3.3 ("Wildcards") for more information on this +"blocking" behavior, along with an illustrative example. See also RFC 974 +for an explanation of standard mailer behavior in the face of an "empty" +response to one's MX query. + +Basically, what it boils down to is, there is no point in trying to use a +wildcard MX for a host which is otherwise listed in the DNS. + +It just doesn't work. + +----------------------------------------------------------------------------- + +Question 5.9. How do you identify a wildcard MX record ? + +Date: Thu Dec 1 11:10:39 EST 1994 + +You don't really need to "identify" a wildcard MX RR. The precedence for +u@dom is: -A: You don't really need to "identify" a wildcard MX RR. The precedence - for u@dom is: - exact match MX exact match A wildcard MX - - One way to implement this is to query for ("dom",IN,MX) and if the - answer name that comes back is "*." something, you know it's a - wildcard, therefore you know there is no exact match MX, and you - therefore query for ("dom",IN,A) and if you get something, use it. - if you don't, use the previous wildcard response. - - RFC 974 explains this pretty well. - ------------------------------- + +One way to implement this is to query for ("dom",IN,MX) and if the answer +name that comes back is "*." something, you know it's a wildcard, +therefore you know there is no exact match MX, and you therefore query for +("dom",IN,A) and if you get something, use it. if you don't, use the +previous wildcard response. + +RFC 974 explains this pretty well. + +----------------------------------------------------------------------------- + +Question 5.10. Why are fully qualified domain names recommended ? Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q4.9 - Why are fully qualified domain names recommended ? - -Q: Why are fully qualified domain names recommended ? - -A: The documentation for BIND 4.9.2 says that the hostname should be set - to the full domain style name (i.e host.our.domain rather than - host). What advantages are there in this, and are there any adverse - consequences if we don't? - -A: Paul Vixie likes to do it :-) He lists a few reasons - - - * Sendmail can be configured to just use Dj$w rather than - Dj$w.mumble where "mumble" is something you have to edit in by - hand. Granted, most people use "mumble" elsewhere in their config - files ("tack on local domain", etc) but why should it be a - requirement ? - - * The real reason is that not doing it violates a very useful invariant: - +The documentation for BIND 4.9.2 says that the hostname should be set to +the full domain style name (i.e host.our.domain rather than host). What +advantages are there in this, and are there any adverse consequences if we +don't? + +Paul Vixie likes to do it :-) He lists a few reasons - + +* Sendmail can be configured to just use Dj$w rather than Dj$w.mumble + where "mumble" is something you have to edit in by hand. Granted, most + people use "mumble" elsewhere in their config files ("tack on local + domain", etc) but why should it be a requirement ? +* The real reason is that not doing it violates a very useful invariant: gethostbyname(gethostname) == gethostbyaddr(primary_interface_address) - - If you take an address and go "backwards" through the PTR's with - it, you'll get a FQDN, and if you push that back through the A - RR's, you get the same address. Or you should. Many multi-homed - hosts violate this uncaringly. - - If you take a non-FQDN hostname and push it "forwards" through the - A RR's, you get an address which, if you push it through the - PTR's, comes back as a FQDN which is not the same as the hostname - you started with. Consider the fact that, absent NIS/YP, there is - no "domainname" command analogous to the "hostname" command. - (NIS/YP's doesn't count, of course, since it's - sometimes-but-only-rarely the same as the Internet domain or - subdomain above a given host's name.) The "domain" keyword in - resolv.conf doesn't specify the parent domain of the current host; - it specifies the default domain of queries initiated on the - current host, which can be a very different thing. (As of RFC - 1535 and BIND 4.9.2's compliance with it, most people use "search" - in resolv.conf, which overrides "domain", anyway.) - - What this means is that there is NO authoritative way to - programmatically discover your host's FQDN unless it is set in the - hostname, or unless every application is willing to grovel the - "netstat -in" tables, find what it hopes is the primary address, - and do a PTR query on it. - - FQDN /bin/hostnames are, intuitively or not, the simplest way to go. - ------------------------------- + + If you take an address and go "backwards" through the PTR's with it, + you'll get a FQDN, and if you push that back through the A RR's, you get + the same address. Or you should. Many multi-homed hosts violate this + uncaringly. + + If you take a non-FQDN hostname and push it "forwards" through the A + RR's, you get an address which, if you push it through the PTR's, comes + back as a FQDN which is not the same as the hostname you started with. + Consider the fact that, absent NIS/YP, there is no "domainname" command + analogous to the "hostname" command. (NIS/YP's doesn't count, of + course, since it's sometimes-but-only-rarely the same as the Internet + domain or subdomain above a given host's name.) The "domain" keyword in + resolv.conf doesn't specify the parent domain of the current host; it + specifies the default domain of queries initiated on the current host, + which can be a very different thing. (As of RFC 1535 and BIND 4.9.2's + compliance with it, most people use "search" in resolv.conf, which + overrides "domain", anyway.) + + What this means is that there is NO authoritative way to + programmatically discover your host's FQDN unless it is set in the + hostname, or unless every application is willing to grovel the "netstat + -in" tables, find what it hopes is the primary address, and do a PTR + query on it. + + FQDN /bin/hostnames are, intuitively or not, the simplest way to go. + +----------------------------------------------------------------------------- + +Question 5.11. Distributing load using named Date: Wed Mar 1 11:04:43 EST 1995 -Subject: Q4.10 - Distributing load using named - -Q: If you attempt to distribute the load on a system using named, won't - the first response be cached, and then later queries use the cached - value? (This would be for requests that come through the same - server.) - -A: Yes. So it can be useful to use a lower TTL on records where this is - important. You can use values like 300 or 500 seconds. - If your local caching server has ROUND_ROBIN, it does not matter - what the authoritative servers have -- every response from the cache - is rotated. +When you attempt to distribute the load on a system using named, the first +response be cached, and then later queries use the cached value (This +would be for requests that come through the same server). Therefore, it +can be useful to use a lower TTL on records where this is important. You +can use values like 300 or 500 seconds. - But if it doesn't, and the authoritative server site is depending on - this feature (or the old "shuffle-A") to do load balancing, then if - one doesn't use small TTLs, one could conceivably end up with a - really nasty situation, e.g., hundreds of workstations at a branch - campus pounding on the same front end at the authoritative server's - site during class registration. +If your local caching server has ROUND_ROBIN, it does not matter what the +authoritative servers have -- every response from the cache is rotated. - Not nice. +But if it doesn't, and the authoritative server site is depending on this +feature (or the old "shuffle-A") to do load balancing, then if one doesn't +use small TTLs, one could conceivably end up with a really nasty +situation, e.g., hundreds of workstations at a branch campus pounding on +the same front end at the authoritative server's site during class +registration. -A: Paul Vixie has an example of the ROUND_ROBIN code in action. Here is - something that he wrote regarding his example: +Not nice. + +Paul Vixie has an example of the ROUND_ROBIN code in action. Here is +something that he wrote regarding his example: >I want users to be distributed evenly among those 3 hosts. @@ -613,46 +578,37 @@ A: Paul Vixie has an example of the ROUND_ROBIN code in action. Here is addresses you probably don't care and would just use a pile of CNAME's pointing directly at real host names. - {hydra.ugly.vix.com} + {hydra.ugly.vix.com name: hydra2.ugly.vix.com aliases: hydra.ugly.vix.com addresses: 10.2.0.2 10.2.0.3 10.2.0.1 - {hydra.ugly.vix.com} + {hydra.ugly.vix.com name: hydra3.ugly.vix.com aliases: hydra.ugly.vix.com addresses: 10.3.0.2 10.3.0.3 10.3.0.1 - {hydra.ugly.vix.com} + {hydra.ugly.vix.com name: hydra1.ugly.vix.com aliases: hydra.ugly.vix.com addresses: 10.1.0.2 10.1.0.3 10.1.0.1 - {hydra.ugly.vix.com} + {hydra.ugly.vix.com name: hydra2.ugly.vix.com aliases: hydra.ugly.vix.com addresses: 10.2.0.3 10.2.0.1 10.2.0.2 - {hydra.ugly.vix.com} + {hydra.ugly.vix.com name: hydra3.ugly.vix.com aliases: hydra.ugly.vix.com addresses: 10.3.0.3 10.3.0.1 10.3.0.2 - ------------------------------- - -Date: Sun Dec 4 22:12:32 EST 1994 -Subject: Q4.11 - Order of returned records +----------------------------------------------------------------------------- -Q: Is there any way to tell named to return records, specifically - address records, in the order in which they are listed in the - database? +Question 5.12. Order of returned records - It would appear that named consistently applies a sorting algorithm - to address records which seems to be virtually guaranteed to be - pessimal for our routers, which have many A records. +Sorting, is the *resolver's* responsibility. RFC 1123: -A: Sorting, is the *resolver's* responsibility. RFC 1123: 6.1.3.4 Multihomed Hosts @@ -672,19 +628,19 @@ A: Sorting, is the *resolver's* responsibility. RFC 1123: configuration information set by the system administrator. - In BIND 4.9.x's resolver code, the "sortlist" directive in resolv.conf - can be used to configure this. +In BIND 4.9.x's resolver code, the "sortlist" directive in resolv.conf +can be used to configure this. ------------------------------- +----------------------------------------------------------------------------- -Date: Fri Feb 10 15:46:17 EST 1995 -Subject: Q4.12 - resolv.conf +Question 5.13. resolv.conf +Date: Fri Feb 10 15:46:17 EST 1995 -Q: Why should I use "real" IP addresses in /etc/resolv.conf and not 0.0.0.0 - or 127.0.0.1. +The question was asked one time, "Why should I use 'real' IP addresses in +/etc/resolv.conf and not 0.0.0.0 or 127.0.0.1" ? -A: Paul Vixie writes on the issue of the contents of resolv.conf: +Paul Vixie writes on the issue of the contents of resolv.conf: It's historical. Some kernels can't unbind a UDP socket's source address, and some resolver versions (notably not including BIND @@ -714,41 +670,40 @@ A: Paul Vixie writes on the issue of the contents of resolv.conf: otherwise share identical copies of your resolv.conf on all the systems on any given subnet, not all of which will be servers. -A: The problem was with older versions of the resolver (4.8.X). If you - listed 127.0.0.1 as the first entry in resolv.conf, and for whatever - reason the local name server wasn't running and the resolver fell - back to the second name server listed, it would send queries to the - name server with the source IP address set to 127.0.0.1 (as it was - set when the resolver was trying to send to 127.0.0.1--you use the - loopback address to send to the loopback address). +The problem was with older versions of the resolver (4.8.X). If you +listed 127.0.0.1 as the first entry in resolv.conf, and for whatever +reason the local name server wasn't running and the resolver fell back to +the second name server listed, it would send queries to the name server +with the source IP address set to 127.0.0.1 (as it was set when the +resolver was trying to send to 127.0.0.1--you use the loopback address to +send to the loopback address). ------------------------------- +----------------------------------------------------------------------------- -Date: Mon Jan 2 13:50:13 EST 1995 -Subject: Q4.13 - Delegating authority +Question 5.14. How do I delegate authority for sub-domains ? -Q: How do I delegate authority for domains within my domain ? +Date: Sat Dec 7 02:04:17 EST 1996 + +When you start having a very big domain that can be broken into logical +and separate entities that can look after their own DNS information, you +will probably want to do this. Maintain a central area for the things +that everyone needs to see and delegate the authority for the other parts +of the organization so that they can manage themselves. + +Another essential piece of information is that every domain that exists +must have it NS records associated with it. These NS records denote the +name servers that are queried for information about that zone. For your +zone to be recognized by the outside world, the server responsible for the +zone above you must have created a NS record for your your new servers +(NOTE that the new servers DO NOT have to be in the new domain). For +example, putting the computer club onto the network and giving them +control over their own part of the domain space we have the following. + +The machine authorative for gu.uwa.edu.au is mackerel and the machine +authorative for ucc.gu.uwa.edu.au is marlin. + +in mackerel's data for gu.uwa.edu.au we have the following -A: When you start having a very big domain that can be broken into logical - and separate entities that can look after their own DNS information, - you will probably want to do this. Maintain a central area for the - things that everyone needs to see and delegate the authority for the - other parts of the organization so that they can manage themselves. - - Another essential piece of information is that every domain that - exists must have it NS records associated with it. These NS records - denote the name servers that are queried for information about that - zone. For your zone to be recognized by the outside world, the - server responsible for the zone above you must have created a NS - record for your machine in your domain. For example, putting the - computer club onto the network and giving them control over their - own part of the domain space we have the following. - - The machine authorative for gu.uwa.edu.au is mackerel and the machine - authorative for ucc.gu.uwa.edu.au is marlin. - - in mackerel's data for gu.uwa.edu.au we have the following - @ IN SOA ... IN A 130.95.100.3 IN MX mackerel.gu.uwa.edu.au. @@ -759,41 +714,118 @@ A: When you start having a very big domain that can be broken into logical ucc IN NS marlin.gu.uwa.edu.au. IN NS mackerel.gu.uwa.edu.au. - Marlin is also given an IP in our domain as a convenience. If they - blow up their name serving there is less that can go wrong because - people can still see that machine which is a start. You could place - "marlin.ucc" in the first column and leave the machine totally - inside the ucc domain as well. - - The second NS line is because mackerel will be acting as secondary name - server for the ucc.gu domain. Do not include this line if you are not - authorative for the information included in the sub-domain. +Marlin is also given an IP in our domain as a convenience. If they blow +up their name serving there is less that can go wrong because people can +still see that machine which is a start. You could place "marlin.ucc" in +the first column and leave the machine totally inside the ucc domain as +well. +The second NS line is because mackerel will be acting as secondary name +server for the ucc.gu domain. Do not include this line if you are not +authorative for the information included in the sub-domain. ------------------------------- +----------------------------------------------------------------------------- -Date: Wed Mar 1 11:45:00 EST 1995 -Subject: Q4.14 - DNS instead of NIS on a Sun OS 4.1.x system +Question 5.15. DNS instead of NIS on a Sun OS 4.1.x system -Q: I would appreciate any comments on whether running bind 4.9.x will - enable sendmail, ftp, telnet and other TCP/IP services to bypass - NIS and connect directly to named. - -A: How to do this is documented quite well in the comp.sys.sun.admin FAQ in - questions one and two. You can get them from: +Date: Sat Dec 7 01:14:17 EST 1996 - ftp://thor.ece.uc.edu/pub/sun-faq/FAQs/sun-faq.general - http://www.cis.ohio-state.edu/hypertext/faq/usenet/comp-sys-sun-faq +Comments relating to running bind 4.9.x on a Sun OS 4.1.x system and the +effect on sendmail, ftp, telnet and other TCP/IP services bypassing NIS +and directly using named is documented quite well in the +comp.sys.sun.admin FAQ in questions one and two. You can get them from: - as well as from rtfm.mit.edu in the usual place, etc. - +* ftp.ece.uc.edu : /pub/sun-faq/FAQs/sun-faq.general +* http://www.cis.ohio-state.edu/hypertext/faq/usenet/comp-sys-sun-faq ------------------------------- +as well as from rtfm.mit.edu in the usual place, etc. + +----------------------------------------------------------------------------- + +Question 5.16. Patches to add functionality to BIND + +Date: Tue Nov 5 23:53:47 EST 1996 + +There are others, but these are listed here: + +* When using the round robin DNS and assigning 3 IPs to a host (for + example), a process to guarantee that all 3 IPs are reachable may be + found at + http://www-leland.stanford.edu/~schemers/docs/lbnamed/lbnamed.html + +* Patches for 4.9.3-REL that will support the IPv6 AAAA record format may + be found at ftp.inria.fr : /network/ipv6/ + +* A patch for 4.9.3-REL that will allow you to turn off forwarding of + information from my server may be found at ftp.vix.com : + /pub/bind/release/4.9.3/contrib/noforward.tar.gz + +* How do I tell a server to listen to a particular interface to listen and + respond to DNS queries on ? + + Mark Andrews has a patch that will tell a 4.9.4 server to listen to a + particular interface and respond to DNS queries. It may be found at an + unofficial location: http://www.ultra.net/~jzp/andrews.patch.txt + +----------------------------------------------------------------------------- + +Question 5.17. How to serve multiple domains from one server + +Date: Tue Nov 5 23:44:02 EST 1996 + +Most name server implementations allow information about multiple domains +to be kept on one server, and questions about those domains to be +answered by that one server. For instance, there are many large servers +on the Internet that each serve information about more than 1000 +different domains. + +To be completely accurate, a server contains information about zones, +which are parts of domains that are kept as a single unit. [Ed note: for +a definition of zones and domains, see Section 2: The Name Service in the +"Name Server Operations Guide" included with the BIND 4.9.5 distribution.] + +In the configuration of the name server, the additional zones need to be +specified. An important consideration is whether a particular server is +primary or secondary for any specific zone--a secondary server maintains +only a copy of the zone, periodically refreshing its copy from another, +specified, server. In BIND, to set up a server as a secondary server for +the x.y.z zone, to the configuration file /etc/named.boot add the line + + secondary x.y.z 10.0.0.1 db.x.y.z + +where 10.0.0.1 is the IP address of the server that the zone will be +copied from, and db.x.y.z is a local filename that will contain the copy +of the zone. + +If this is a question related to how to set up multiple IP numbers on one +system, which you do not need to do to act as a domain server for +multiple domains, see + +http://www.thesphere.com/%7Edlp/TwoServers/. + +=============================================================================== + +Section 6. PROBLEMS + + Q6.1 No address for root server + Q6.2 Error - No Root Nameservers for Class XX + Q6.3 Bind 4.9.x and MX querying? + Q6.4 Do I need to define an A record for localhost ? + Q6.5 MX records, CNAMES and A records for MX targets + Q6.6 Can an NS record point to a CNAME ? + Q6.7 Nameserver forgets own A record + Q6.8 General problems (core dumps !) + Q6.9 malloc and DECstations + Q6.10 Can't resolve names without a "." + Q6.11 Err/TO errors being reported + Q6.12 Why does swapping kill BIND ? + +----------------------------------------------------------------------------- + +Question 6.1. No address for root server Date: Mon Jan 2 13:49:43 EST 1995 -Subject: Q5.1 - No address for root server - Q: I've been getting the following messages lately from bind-4.9.2.. ns_req: no address for root server @@ -803,27 +835,26 @@ We are behind a firewall and have the following for our named.cache file - . 99999999 IN NS POBOX.FOOBAR.COM. 99999999 IN NS FOOHOST.FOOBAR.COM. foobar.com. 99999999 IN NS pobox.foobar.com. - -A: You can't do that. Your nameserver contacts POBOX.FOOBAR.COM, gets the - correct list of root servers from it, then tries again and fails - because of your firewall. - - You will need a 'forwarder' definition, to ensure that all requests - are forwarded to a host which can penetrate the firewall. And - it is unwise to put phony data into 'named.cache'. - ------------------------------- +You can't do that. Your nameserver contacts POBOX.FOOBAR.COM, gets the +correct list of root servers from it, then tries again and fails because +of your firewall. + +You will need a 'forwarder' definition, to ensure that all requests are +forwarded to a host which can penetrate the firewall. And it is unwise to +put phony data into 'named.cache'. + +----------------------------------------------------------------------------- + +Question 6.2. Error - No Root Nameservers for Class XX Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q5.2 - Error - No Root Nameservers for Class XX Q: I've received errors before about "No root nameservers for class XX" but they've been because of network connectivity problems. I believe that Class 1 is Internet Class data. And I think I heard someone say that Class 4 is Hesiod?? Does anyone know what the various Class numbers are? - -A: From RFC 1700: +From RFC 1700: DOMAIN NAME SYSTEM PARAMETERS The Internet Domain Naming System (DOMAIN) includes several @@ -844,44 +875,37 @@ A: From RFC 1700: 65535 Reserved [PM1] DNS information for RFC 1700 was taken from +ftp.isi.edu : /in-notes/iana/assignments/dns-parameters - ftp://ftp.isi.edu/in-notes/iana/assignments/dns-parameters +Hesiod is class 4, and there are no official root nameservers for class 4, +so you can safely declare yourself one if you like. You might want to +put up a packet filter so that no one outside your network is capable of +making Hesiod queries of your machines, if you define yourself to be a +root nameserver for class 4. - Hesiod is class 4, and there are no official root nameservers for class - 4, so you can safely declare yourself one if you like. You might want - to put up a packet filter so that no one outside your network is capable - of making Hesiod queries of your machines, if you define yourself to be - a root nameserver for class 4. +----------------------------------------------------------------------------- + +Question 6.3. Bind 4.9.x and MX querying? ------------------------------- - Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q5.3 - Bind 4.9.x and MX querying? - -Q: If I query a 4.9.x DNS server for MX records, a list of the MX records - as well as a list of the authorative nameservers is returned. Why ? - -A: Bind 4.9.2 returns the list of nameserver that are authorative - for a domain in the response packet, along with their IP - addresses in the additional section. - ------------------------------- +If you query a 4.9.x DNS server for MX records, a list of the MX records +as well as a list of the authorative nameservers is returned. This +happens because bind 4.9.2 returns the list of nameserver that are +authorative for a domain in the response packet, along with their IP +addresses in the additional section. -Date: Sat Sep 9 00:36:01 EDT 1995 -Subject: Q5.4 - Some root nameservers don't know localhost +----------------------------------------------------------------------------- + +Question 6.4. Do I need to define an A record for localhost ? -Q: Do I need to define an A record for localhost ? +Date: Sat Sep 9 00:36:01 EDT 1995 - Where is the A record for 127.0.0.1 defined? I see where - the PTR record is defined pointing to localhost, but can't find - where the A record is. And is the A record supposed to be - localhost.MY_DOMAIN or just localhost ? +Somewhere deep in the BOG (BIND Operations Guide) that came with 4.9.3 +(section 5.4.3), it says that you define this yourself (if need be) in +the same zone files as your "real" IP addresses for your domain. Quoting +the BOG: -A: Somewhere deep in the BOG (BIND Operations Guide) that came with - 4.9.3 (section 5.4.3), it says that you define this yourself - (if need be) in the same zone files as your "real" IP addresses - for your domain. Quoting the BOG: ... As implied by this PTR record, there should be a ``localhost.my.dom.ain'' @@ -890,57 +914,54 @@ A: Somewhere deep in the BOG (BIND Operations Guide) that came with trailing dot when 1.0.0.127.in-addr.arpa is queried for;... - The sample files in the BIND distribution show you what needs to be - done (see the BOG). +The sample files in the BIND distribution show you what needs to be done +(see the BOG). - Some HP boxen (especially those running HP OpenView) will also need - "loopback" defined with this IP address. You may set it as a CNAME - record pointing to the "localhost." record. +Some HP boxen (especially those running HP OpenView) will also need +"loopback" defined with this IP address. You may set it as a CNAME +record pointing to the "localhost." record. + +----------------------------------------------------------------------------- + +Question 6.5. MX records, CNAMES and A records for MX targets ------------------------------- - Date: Sun Nov 27 23:32:41 EST 1994 -Subject: Q5.5 - MX records and CNAMES and separate A records for MX targets - -Q: The O'Reilly "DNS and Bind" book warns against using non-canonical - names in MX records, however, this warning is given in the context - of mail hubs that MX to each other for backup purposes. I don't see - how this applies to mail spokes. RFC 974 has a similar warning, but - I can not see where it specifically prohibits using an alias in an - MX record. - -A: Without the restrictions in the RFC, a MTA must request the A records - for every MX listed to determine if it is in the MX list then reduce - the list. This introduces many more lookups than would other wise be - required. If you are behind a 1200 bps link YOU DON'T WANT TO DO - THIS. The addresses associated with CNAMES are not passed as - additional data so you will force additional traffic to result even - if you are running a caching server locally. - - There is also the problem of how does the MTA find all of it's - IP addresses. This is not straight forward. You have to be able - to do this is you allow CNAMEs (or extra A's) as MX targets. - - The letter of the law is that an MX record should point to an A record. - - There is no "real" reason to use CNAMEs for MX targets or separate - As for nameservers any more. CNAMEs for services other than mail - should be used because there is no specified method for locating the - desired server yet. - - People don't care what the names of MX targets are. They're - invisible to the process anyway. If you have mail for "mary" - redirected to "sue" is totally irrelevant. Having CNAMEs as the - targets of MX's just needlessly complicates things, and is more work - for the resolver. - - Having separate A's for nameservers like "ns.your.domain" is - pointless too, since again nobody cares what the name of your - nameserver is, since that too is invisible to the process. If you - move your nameserver from "mary.your.domain" to "sue.your.domain" - nobody need care except you and your parent domain administrator - (and the InterNIC). Even less so for mail servers, since only you - are affected. + +The O'Reilly "DNS and Bind" book warns against using non-canonical names +in MX records, however, this warning is given in the context of mail hubs +that MX to each other for backup purposes. How does this apply to mail +spokes. RFC 974 has a similar warning, but where is it specifically +prohibited to us an alias in an MX record ? + +Without the restrictions in the RFC, a MTA must request the A records for +every MX listed to determine if it is in the MX list then reduce the list. +This introduces many more lookups than would other wise be required. If +you are behind a 1200 bps link YOU DON'T WANT TO DO THIS. The addresses +associated with CNAMES are not passed as additional data so you will force +additional traffic to result even if you are running a caching server +locally. + +There is also the problem of how does the MTA find all of it's IP +addresses. This is not straight forward. You have to be able to do this is +you allow CNAMEs (or extra A's) as MX targets. + +The letter of the law is that an MX record should point to an A record. + +There is no "real" reason to use CNAMEs for MX targets or separate As for +nameservers any more. CNAMEs for services other than mail should be used +because there is no specified method for locating the desired server yet. + +People don't care what the names of MX targets are. They're invisible to +the process anyway. If you have mail for "mary" redirected to "sue" is +totally irrelevant. Having CNAMEs as the targets of MX's just needlessly +complicates things, and is more work for the resolver. + +Having separate A's for nameservers like "ns.your.domain" is pointless +too, since again nobody cares what the name of your nameserver is, since +that too is invisible to the process. If you move your nameserver from +"mary.your.domain" to "sue.your.domain" nobody need care except you and +your parent domain administrator (and the InterNIC). Even less so for +mail servers, since only you are affected. Q: Given the example - @@ -968,7 +989,7 @@ A: This isn't what the BOG says at all. See below. You can have a CNAME Here's the relevant BOG snippet: - aliases {ttl} addr-class CNAME Canonical name + aliases {ttl addr-class CNAME Canonical name ucbmonet IN CNAME monet The Canonical Name resource record, CNAME, speci- @@ -981,12 +1002,14 @@ A: This isn't what the BOG says at all. See below. You can have a CNAME their value (e.g., NS or MX) must list the canoni- cal name, not the nickname. ------------------------------- - +----------------------------------------------------------------------------- + +Question 6.6. Can an NS record point to a CNAME ? + Date: Wed Mar 1 11:14:10 EST 1995 -Subject: Q5.6 - NS is a CNAME -Q: Can I do this ? Is it legal ? +Can I do this ? Is it legal ? + @ SOA (.........) NS ns.host.this.domain. @@ -994,43 +1017,39 @@ Q: Can I do this ? Is it legal ? ns CNAME third third IN A xxx.xxx.xxx.xxx +No. Only one RR type is allowed to refer, in its data field, to a CNAME, +and that's CNAME itself. So CNAMEs can refer to CNAMEs but NSs and MXs +cannot. -A: No. Only one RR type is allowed to refer, in its data field, to a - CNAME, and that's CNAME itself. So CNAMEs can refer to CNAMEs but - NSs and MXs cannot. - - BIND 4.9.3 (Beta11 and later) explicitly syslogs this case rather than - simply failing as pre-4.9 servers did. Here's a current example: +BIND 4.9.3 (Beta11 and later) explicitly syslogs this case rather than +simply failing as pre-4.9 servers did. Here's a current example: - Dec 7 00:52:18 gw named[17561]: \ - "foobar.com IN NS" points to a CNAME (foobar.foobar.com) + Dec 7 00:52:18 gw named[17561]: "foobar.com IN NS" \ + points to a CNAME (foobar.foobar.com) - Here is the reason why: +Here is the reason why: - Nameservers are not required to include CNAME records in the - Additional Info section returned after a query. It's partly an - implementation decision and partly a part of the spec. The - algorithm described in RFC 1034 (pp24,25; info also in RFC 1035, - section 3.3.11, p 18) says 'Put whatever addresses are available - into the additional section, using glue RRs [if necessary]'. - Since NS records are speced to contain only primary names of - hosts, not CNAMEs, then there's no reason for algorithm to - mention them. If, on the other hand, it's decided to allow CNAMEs - in NS records (and indeed in other records) then there's no - reason that CNAME records might not be included along with A - records. The Additional Info section is intended for any - information that might be useful but which isn't strictly the - answer to the DNS query processed. It's an implementation - decision in as much as some servers used to follow CNAMEs in - NS references. +Nameservers are not required to include CNAME records in the Additional +Info section returned after a query. It's partly an implementation +decision and partly a part of the spec. The algorithm described in RFC +1034 (pp24,25; info also in RFC 1035, section 3.3.11, p 18) says 'Put +whatever addresses are available into the additional section, using glue +RRs [if necessary]'. Since NS records are speced to contain only primary +names of hosts, not CNAMEs, then there's no reason for algorithm to +mention them. If, on the other hand, it's decided to allow CNAMEs in NS +records (and indeed in other records) then there's no reason that CNAME +records might not be included along with A records. The Additional Info +section is intended for any information that might be useful but which +isn't strictly the answer to the DNS query processed. It's an +implementation decision in as much as some servers used to follow CNAMEs +in NS references. +----------------------------------------------------------------------------- ------------------------------- +Question 6.7. Nameserver forgets own A record Date: Fri Dec 2 16:17:31 EST 1994 -Subject: Q5.7 - Nameserver forgets own A record - Q: Lately, I've been having trouble with named 4.9.2 and 4.9.3. Periodically, the nameserver will seem to "forget" its own A record, although the other information stays intact. One theory I had was @@ -1044,17 +1063,14 @@ A: This is invariably due to not removing ALL of the cached zones You get "ignoreds" because the primaries for the relevant zones are running old versions of BIND which pass out more glue than is required. named-xfer trims off this extra glue. - ------------------------------- -Date: Sun Dec 4 22:21:22 EST 1994 -Subject: Q5.8 - General problems (core dumps !) +----------------------------------------------------------------------------- -Q: I am running bind 4.9.3b9p1 on a DEC alpha OSF/1 V3.0 and have had it - core dump while in debug mode. The last lines printed to named.run - were [...] +Question 6.8. General problems (core dumps !) -A: Paul Vixie says: +Date: Sun Dec 4 22:21:22 EST 1994 + +Paul Vixie says: I'm always interested in hearing about cases where BIND dumps core. However, I need a stack trace. Compile with -g and not -O (unless @@ -1067,65 +1083,216 @@ A: Paul Vixie says: dump for a day or so in case I have questions you can answer via gdb/dbx. ------------------------------- +----------------------------------------------------------------------------- + +Question 6.9. malloc and DECstations Date: Mon Jan 2 14:19:22 EST 1995 -Subject: Q5.9 - malloc and DECstations -We have replaced malloc on our DECstations with a malloc that is more -compact in memory usage, and this helped the operation of bind a lot. -The source is now available for anonymous ftp from +We have replaced malloc on our DECstations with a malloc that is more +compact in memory usage, and this helped the operation of bind a lot. The +source is now available for anonymous ftp from - ftp://ftp.cs.wisc.edu/pub/misc/malloc.tar.gz - +ftp.cs.wisc.edu : /pub/misc/malloc.tar.gz + +----------------------------------------------------------------------------- + +Question 6.10. Can't resolve names without a "." + +(Answer written by Mark Andrews) You are not using a RFC 1535 aware +resolver. Depending upon the age of your resolver you could try adding a +search directive to resolv.conf. + + e.g. + domain <domain> + search <domain> [<domain2> ...] + +If that doesn't work you can configure you server to serve the parent and +grandparent domains as this is the default search list. + +"domain langley.af.mil" has an implicit "search langley.af.mil af.mil mil" +in the old resolvers, and you are timing out trying to resolve the +address with one of these domains tacked on. + +When resolving internic.net the following will be tried in order. + internic.net.langley.af.mil + internic.net.af.mil + internic.net.mil + internic.net. + +RFC 1535 aware resolvers try qualified address first. + + internic.net. + internic.net.langley.af.mil + internic.net.af.mil + internic.net.mil +RFC 1535 documents the problems associated with the old search +algorithim, including security issues, and how to alleviate some of the +problems. + +----------------------------------------------------------------------------- + +Question 6.11. Err/TO errors being reported + +Date: Sun May 5 23:46:32 EDT 1996 + +Why are errors like + + Apr 2 20:41:58 nameserver named[25846]: Err/TO getting serial# for + "foobar.domain1.com" + Apr 2 20:41:59 nameserver named[25846]: Err/TO getting serial# for + "foobar.domain2.com" + +reported ? These generally indicate that there is one of the following +problems: + +* A network problem between you and the primary, +* A bad IP address in named.boot, +* The primary is Lame for the zone. + +An external check to see if you can retrieve the SOA is the best way to +work out which it is. + +----------------------------------------------------------------------------- + +Question 6.12. Why does swapping kill BIND ? + +Date: Thu Jul 4 23:20:20 EDT 1996 + +The question was: + + I've been diagnosing a problem with BIND 4.9.x (where x is usually 3BETA9 + or 3REL) for several months now. I finally tracked it down to swap space + utilization on the unix boxes. + + This happens under (at least) under Linux 1.2.9 & 1.2.13, SunOS 4.1.3U1, + 4.1.1, and Solaris 2.5. The symptom is that if these machines get into + swap at all bind quits resolving most, if not all queries. Mind you that + these machines are not "swapping hard", but rather we're talking about a + several hundred K TEMPORARY deficiency. I have noticed while digging + through various archives that there is some referral to "bind thrashing + itself to death". Is this what is happening ? + +And the answer is: + + Yes it is. Bind can't tolerate having even a few pages swapped out. + The time required to send responses climbs to several seconds/request, + and the request queue fills and overflows. ------------------------------- - -Date: Fri Apr 28 13:56:32 EDT 1995 -Subject: Q6 - Acknowledgements - -Listed in e-mail address alphabetical order, the following people have -contributed to this FAQ: - -Benoit.Grange@inria.fr (Benoit.Grange) -D.T.Shield@csc.liv.ac.uk (Dave Shield) -adam@comptech.demon.co.uk (Adam Goodfellow) -andras@is.co.za (Andras Salamon) -barmar@nic.near.net (Barry Margolin) -barr@pop.psu.edu (David Barr) -bj@herbison.com (B.J. Herbison) -bje@cbr.fidonet.org (Ben Elliston) -brad@birch.ims.disa.mil (Brad Knowles) -ckd@kei.com (Christopher Davis) -cdp@hertz.njit.edu (Chris Peckham) -cricket@hp.com (Cricket Liu) -cudep@csv.warwick.ac.uk (Ian 'Vato' Dickinson [ID17]) -dparter@cs.wisc.edu (David Parter) -e07@nikhef.nl (Eric Wassenaar) -fwp@CC.MsState.Edu (Frank Peters) -gah@cco.caltech.edu (Glen A. Herrmannsfeldt) -glenn@popco.com (Glenn Fleishman) -harvey@indyvax.iupui.edu (James Harvey) -hubert@cac.washington.edu (Steve Hubert) -jmalcolm@uunet.uu.net (Joseph Malcolm) -jhawk@panix.com (John Hawkinson) -kevin@cfc.com (Kevin Darcy) -lamont@abstractsoft.com (Sean T. Lamont) -lavondes@tidtest.total.fr (Michel Lavondes) -mark@ucsalf.ac.uk (Mark Powell) -marka@syd.dms.CSIRO.AU (Mark Andrews) -mathias@unicorn.swi.com.sg (Mathias Koerber) -mjo@iao.ford.com (Mike O'Connor) -nick@flapjack.ieunet.ie (Nick Hilliard) -patrick@oes.amdahl.com (Patrick J. Horgan) -ph10@cus.cam.ac.uk (Philip Hazel) -rv@seins.Informatik.Uni-Dortmund.DE (Ruediger Volk) -shields@tembel.org (Michael Shields) -tanner@george.arc.nasa.gov (Rob Tanner) -vixie@vix.com (Paul A Vixie) -wag@swl.msd.ray.com (William Gianopoulos {84718}) -whg@inel.gov (Bill Gray) -wolf@pasteur.fr (Christophe Wolfhugel) + It's possible to shrink memory consumption a lot by undefining STATS + and XSTATS, and recompiling. You could nuke DEBUG too, which will + cut the code size down some, but probably not the data size. If that + doesn't do the job then it sounds like you'll need to move DNS onto a + separate box. + + BIND tends to touch all of its resident pages all of the time with + normal activity... if you look at the RSS verses the total process + size, you will always see the RSS within, usually, 90% of the total + size of the process. This means that *any* paging of named-owned + pages will stall named. Thus, a machine running a heavily accessed + named process cannot afford to swap *at all*. + + (Paul Vixie continues on this subject): + I plan to try to get BIND to exhibit slightly better locality of + reference in some future release. Of course, I can only do this if + the query names also exhibit some kind of hot spots. If someone + queries all your names often, BIND will have to touch all of its VM + pool that often. (Right now, BIND touches everything pretty often + even if you're just hammering on some hot spots -- that's the part + I'd like to fix. Malloc isn't cooperating.) + +=============================================================================== + +Section 7. ACKNOWLEDGEMENTS + + Q7.1 How is this FAQ generated ? + Q7.2 What formats are available ? + Q7.3 Contributors + +----------------------------------------------------------------------------- + +Question 7.1. How is this FAQ generated ? + +Date: Fri Dec 6 16:51:31 EST 1996 + +This FAQ is maintained in BFNN (Bizzarre Format with No Name). This +allows me to create ASCII, HTML, and GNU info (postscript coming soon) +from one source file. + +The perl script "bfnnconv.pl" that is available with the linux FAQ is used +to generate the various output files from the BFNN source. + +----------------------------------------------------------------------------- + +Question 7.2. What formats are available ? + +Date: Fri Dec 6 16:51:31 EST 1996 + +You may obtain one of the following formats for this document: + +* ASCII: http://www.users.pfmc.net/~cdp/cptd-faq/cptd-faq.ascii +* BFNN: http://www.users.pfmc.net/~cdp/cptd-faq/cptd-faq.bfnn +* GNU info: http://www.users.pfmc.net/~cdp/cptd-faq/cptd-faq.info +* HTML: http://www.users.pfmc.net/~cdp/cptd-faq/index.html + +----------------------------------------------------------------------------- + +Question 7.3. Contributors + +Date: Sat Dec 7 01:29:29 EST 1996 + +Many people have helped put this list together. Listed in e-mail address +alphabetical order, the following people have contributed to this FAQ: + +* <Benoit.Grange@inria.fr> (Benoit.Grange) +* <D.T.Shield@csc.liv.ac.uk> (Dave Shield) +* <Todd.Aven@BankersTrust.Com> +* <adam@comptech.demon.co.uk> (Adam Goodfellow) +* <andras@is.co.za> (Andras Salamon) +* <barmar@nic.near.net> (Barry Margolin) +* <barr@pop.psu.edu> (David Barr) +* <bj@herbison.com> (B.J. Herbison) +* <bje@cbr.fidonet.org> (Ben Elliston) +* <brad@birch.ims.disa.mil> (Brad Knowles) +* <ckd@kei.com> (Christopher Davis) +* <cdp2582@hertz.njit.edu> (Chris Peckham) +* <cricket@hp.com> (Cricket Liu) +* <cudep@csv.warwick.ac.uk> (Ian 'Vato' Dickinson [ID17]) +* <dillon@best.com> (Matthew Dillon) +* <dparter@cs.wisc.edu> (David Parter) +* <e07@nikhef.nl> (Eric Wassenaar) +* <fitz@think.com> (Tom Fitzgerald) +* <fwp@CC.MsState.Edu> (Frank Peters) +* <gah@cco.caltech.edu> (Glen A. Herrmannsfeldt) +* <glenn@popco.com> (Glenn Fleishman) +* <harvey@indyvax.iupui.edu> (James Harvey) +* <hubert@cac.washington.edu> (Steve Hubert) +* <ivanl@pacific.net.sg> (Ivan Leong) +* <jhawk@panix.com> (John Hawkinson) +* <jmalcolm@uunet.uu.net> (Joseph Malcolm) +* <jprovo@augustus.ultra.net> (Joe Provo) +* <kevin@cfc.com> (Kevin Darcy) +* <lamont@abstractsoft.com> (Sean T. Lamont) +* <lavondes@tidtest.total.fr> (Michel Lavondes) +* <mark@ucsalf.ac.uk> (Mark Powell) +* <marka@syd.dms.CSIRO.AU> (Mark Andrews) +* <mathias@unicorn.swi.com.sg> (Mathias Koerber) +* <mjo@iao.ford.com> (Mike O'Connor) +* <nick@flapjack.ieunet.ie> (Nick Hilliard) +* <oppedahl@popserver.panix.com> (Carl Oppedahl) +* <patrick@oes.amdahl.com> (Patrick J. Horgan) +* <paul@software.com> (Paul Wren) +* <pb@fasterix.frmug.fr.net> (Pierre Beyssac) +* <ph10@cus.cam.ac.uk> (Philip Hazel) +* <phil@netpart.com> (Phil Trubey) +* <rocky@panix.com> (R. Bernstein) +* <rv@seins.Informatik.Uni-Dortmund.DE> (Ruediger Volk) +* <shields@tembel.org> (Michael Shields) +* <tanner@george.arc.nasa.gov> (Rob Tanner) +* <vixie@vix.com> (Paul A Vixie) +* <wag@swl.msd.ray.com> (William Gianopoulos {84718) +* <whg@inel.gov> (Bill Gray) +* <wolf@pasteur.fr> (Christophe Wolfhugel) Thank you ! diff --git a/contrib/bind/include/arpa/Makefile b/contrib/bind/include/arpa/Makefile index 491252d..2ebfe2c 100644 --- a/contrib/bind/include/arpa/Makefile +++ b/contrib/bind/include/arpa/Makefile @@ -61,7 +61,10 @@ all depend: clean: rm -f *~ *.BAK *.CKP *.orig -install: +install: ${DESTDIR}${DESTINC}/arpa set -x; for x in ${HFILES}; do \ ${INSTALL} -c -m 444 $$x ${DESTDIR}${DESTINC}/arpa/$$x; \ done + +${DESTDIR}${DESTINC}/arpa: + mkdir $@ diff --git a/contrib/bind/include/arpa/inet.h b/contrib/bind/include/arpa/inet.h index 3451a09..2a4460f 100644 --- a/contrib/bind/include/arpa/inet.h +++ b/contrib/bind/include/arpa/inet.h @@ -55,7 +55,7 @@ /* * @(#)inet.h 8.1 (Berkeley) 6/2/93 - * $Id: inet.h,v 8.5 1996/05/22 04:56:29 vixie Exp $ + * $Id: inet.h,v 8.6 1996/08/08 06:54:29 vixie Exp $ */ #ifndef _INET_H_ @@ -76,13 +76,16 @@ unsigned long inet_addr __P((const char *)); int inet_aton __P((const char *, struct in_addr *)); unsigned long inet_lnaof __P((struct in_addr)); struct in_addr inet_makeaddr __P((u_long , u_long)); +char * inet_neta __P((u_long, char *, size_t)); unsigned long inet_netof __P((struct in_addr)); unsigned long inet_network __P((const char *)); +char *inet_net_ntop __P((int, const void *, int, char *, size_t)); +int inet_net_pton __P((int, const char *, void *, size_t)); char *inet_ntoa __P((struct in_addr)); -int inet_pton __P((int af, const char *src, void *dst)); -const char *inet_ntop __P((int af, const void *src, char *dst, size_t s)); -u_int inet_nsap_addr __P((const char *, u_char *, int maxlen)); -char *inet_nsap_ntoa __P((int, const u_char *, char *ascii)); +int inet_pton __P((int, const char *, void *)); +const char *inet_ntop __P((int, const void *, char *, size_t)); +u_int inet_nsap_addr __P((const char *, u_char *, int)); +char *inet_nsap_ntoa __P((int, const u_char *, char *)); __END_DECLS #endif /* !_INET_H_ */ diff --git a/contrib/bind/include/arpa/nameser.h b/contrib/bind/include/arpa/nameser.h index d99bf49..f029e64 100644 --- a/contrib/bind/include/arpa/nameser.h +++ b/contrib/bind/include/arpa/nameser.h @@ -50,12 +50,34 @@ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * --Copyright-- */ /* * @(#)nameser.h 8.1 (Berkeley) 6/2/93 - * $Id: nameser.h,v 8.5 1996/08/05 08:31:28 vixie Exp $ + * $Id: nameser.h,v 8.11 1996/10/08 04:51:02 vixie Exp $ */ #ifndef _NAMESER_H_ @@ -70,10 +92,8 @@ #include <sys/cdefs.h> #ifdef _AUX_SOURCE -#include <sys/types.h> /* ech for A/UX */ -#define res_send ucb_res_send /* already def'd in libc */ -#define _res_close _ucb_res_close /* removing res_send.o from the library */ -#endif /* gives an undefined symbol... */ +# include <sys/types.h> +#endif /* * revision information. this is the release date in YYYYMMDD format. @@ -83,13 +103,13 @@ * is new enough to contain a certain feature. */ -#define __BIND 19950621 /* interface version stamp */ +#define __BIND 19960801 /* interface version stamp */ /* * Define constants based on rfc883 */ #define PACKETSZ 512 /* maximum packet size */ -#define MAXDNAME 256 /* maximum domain name */ +#define MAXDNAME 1025 /* maximum presentation domain name */ #define MAXCDNAME 255 /* maximum compressed domain name */ #define MAXLABEL 63 /* maximum length of domain label */ #define HFIXEDSZ 12 /* #/bytes of fixed data in header */ @@ -113,17 +133,6 @@ #define STATUS 0x2 /* nameserver status query */ /*#define xxx 0x3*/ /* 0x3 reserved */ #define NS_NOTIFY_OP 0x4 /* notify secondary of SOA change */ -#ifdef ALLOW_UPDATES - /* non standard - supports ALLOW_UPDATES stuff from Mike Schwartz */ -# define UPDATEA 0x9 /* add resource record */ -# define UPDATED 0xa /* delete a specific resource record */ -# define UPDATEDA 0xb /* delete all named resource record */ -# define UPDATEM 0xc /* modify a specific resource record */ -# define UPDATEMA 0xd /* modify all named resource record */ -# define ZONEINIT 0xe /* initial zone transfer */ -# define ZONEREF 0xf /* incremental zone referesh */ -#endif - /* * Currently defined response codes */ @@ -133,10 +142,6 @@ #define NXDOMAIN 3 /* non existent domain */ #define NOTIMP 4 /* not implemented */ #define REFUSED 5 /* query refused */ -#ifdef ALLOW_UPDATES - /* non standard */ -# define NOCHANGE 0xf /* update failed to change db */ -#endif /* * Type values for resources and queries @@ -170,12 +175,19 @@ #define T_GPOS 27 /* geographical position (withdrawn) */ #define T_AAAA 28 /* IP6 Address */ #define T_LOC 29 /* Location Information */ +#define T_NXT 30 /* Next Valid Name in Zone */ +#define T_EID 31 /* Endpoint identifier */ +#define T_NIMLOC 32 /* Nimrod locator */ +#define T_SRV 33 /* Server selection */ +#define T_ATMA 34 /* ATM Address */ +#define T_NAPTR 35 /* Naming Authority PoinTeR */ /* non standard */ #define T_UINFO 100 /* user (finger) information */ #define T_UID 101 /* user ID */ #define T_GID 102 /* group ID */ #define T_UNSPEC 103 /* Unspecified format (binary data) */ /* Query type values which do not appear in resource records */ +#define T_IXFR 251 /* incremental zone transfer */ #define T_AXFR 252 /* transfer zone of authority */ #define T_MAILB 253 /* transfer mailbox records */ #define T_MAILA 254 /* transfer mail agent records */ @@ -192,6 +204,48 @@ #define C_ANY 255 /* wildcard match */ /* + * Flags field of the KEY RR rdata + */ +#define KEYFLAG_TYPEMASK 0xC000 /* Mask for "type" bits */ +#define KEYFLAG_TYPE_AUTH_CONF 0x0000 /* Key usable for both */ +#define KEYFLAG_TYPE_CONF_ONLY 0x8000 /* Key usable for confidentiality */ +#define KEYFLAG_TYPE_AUTH_ONLY 0x4000 /* Key usable for authentication */ +#define KEYFLAG_TYPE_NO_KEY 0xC000 /* No key usable for either; no key */ +/* The type bits can also be interpreted independently, as single bits: */ +#define KEYFLAG_NO_AUTH 0x8000 /* Key not usable for authentication */ +#define KEYFLAG_NO_CONF 0x4000 /* Key not usable for confidentiality */ + +#define KEYFLAG_EXPERIMENTAL 0x2000 /* Security is *mandatory* if bit=0 */ +#define KEYFLAG_RESERVED3 0x1000 /* reserved - must be zero */ +#define KEYFLAG_RESERVED4 0x0800 /* reserved - must be zero */ +#define KEYFLAG_USERACCOUNT 0x0400 /* key is assoc. with a user acct */ +#define KEYFLAG_ENTITY 0x0200 /* key is assoc. with entity eg host */ +#define KEYFLAG_ZONEKEY 0x0100 /* key is zone key for the zone named */ +#define KEYFLAG_IPSEC 0x0080 /* key is for IPSEC use (host or user)*/ +#define KEYFLAG_EMAIL 0x0040 /* key is for email (MIME security) */ +#define KEYFLAG_RESERVED10 0x0020 /* reserved - must be zero */ +#define KEYFLAG_RESERVED11 0x0010 /* reserved - must be zero */ +#define KEYFLAG_SIGNATORYMASK 0x000F /* key can sign DNS RR's of same name */ + +#define KEYFLAG_RESERVED_BITMASK ( KEYFLAG_RESERVED3 | \ + KEYFLAG_RESERVED4 | \ + KEYFLAG_RESERVED10| KEYFLAG_RESERVED11) + +/* The Algorithm field of the KEY and SIG RR's is an integer, {1..254} */ +#define ALGORITHM_MD5RSA 1 /* MD5 with RSA */ +#define ALGORITHM_EXPIRE_ONLY 253 /* No alg, no security */ +#define ALGORITHM_PRIVATE_OID 254 /* Key begins with OID indicating alg */ + +/* Signatures */ + /* Size of a mod or exp in bits */ +#define MIN_MD5RSA_KEY_PART_BITS 512 +#define MAX_MD5RSA_KEY_PART_BITS 2552 + /* Total of binary mod and exp, bytes */ +#define MAX_MD5RSA_KEY_BYTES ((MAX_MD5RSA_KEY_PART_BITS+7/8)*2+3) + /* Max length of text sig block */ +#define MAX_KEY_BASE64 (((MAX_MD5RSA_KEY_BYTES+2)/3)*4) + +/* * Status return codes for T_UNSPEC conversion routines */ #define CONV_SUCCESS 0 @@ -259,7 +313,9 @@ typedef struct { unsigned rd: 1; /* recursion desired */ /* fields in fourth byte */ unsigned ra: 1; /* recursion available */ - unsigned unused :3; /* unused bits (MBZ as of 4.9.3a3) */ + unsigned unused :1; /* unused bits (MBZ as of 4.9.3a3) */ + unsigned ad: 1; /* authentic data from named */ + unsigned cd: 1; /* checking disabled by resolver */ unsigned rcode :4; /* response code */ #endif #if BYTE_ORDER == LITTLE_ENDIAN || BYTE_ORDER == PDP_ENDIAN @@ -271,7 +327,9 @@ typedef struct { unsigned qr :1; /* response flag */ /* fields in fourth byte */ unsigned rcode :4; /* response code */ - unsigned unused :3; /* unused bits (MBZ as of 4.9.3a3) */ + unsigned cd: 1; /* checking disabled by resolver */ + unsigned ad: 1; /* authentic data from named */ + unsigned unused :1; /* unused bits (MBZ as of 4.9.3a3) */ unsigned ra :1; /* recursion available */ #endif /* remaining bytes */ @@ -286,18 +344,6 @@ typedef struct { */ #define INDIR_MASK 0xc0 -/* - * Structure for passing resource records around. - */ -struct rrec { - int16_t r_zone; /* zone number */ - int16_t r_class; /* class number */ - int16_t r_type; /* type number */ - u_int32_t r_ttl; /* time to live */ - int r_size; /* size of data area */ - char *r_data; /* pointer to data */ -}; - extern u_int16_t _getshort __P((const u_char *)); extern u_int32_t _getlong __P((const u_char *)); diff --git a/contrib/bind/include/resolv.h b/contrib/bind/include/resolv.h index c9c7bf3..52e115f 100644 --- a/contrib/bind/include/resolv.h +++ b/contrib/bind/include/resolv.h @@ -55,7 +55,7 @@ /* * @(#)resolv.h 8.1 (Berkeley) 6/2/93 - * $Id: resolv.h,v 8.11 1996/06/02 08:20:38 vixie Exp $ + * $Id: resolv.h,v 8.17 1996/11/26 10:11:20 vixie Exp $ */ #ifndef _RESOLV_H_ @@ -71,14 +71,14 @@ #include <stdio.h> /* - * revision information. this is the release date in YYYYMMDD format. - * it can change every day so the right thing to do with it is use it - * in preprocessor commands such as "#if (__RES > 19931104)". do not + * Revision information. This is the release date in YYYYMMDD format. + * It can change every day so the right thing to do with it is use it + * in preprocessor commands such as "#if (__RES > 19931104)". Do not * compare for equality; rather, use it to determine whether your resolver * is new enough to contain a certain feature. */ -#define __RES 19960229 +#define __RES 19960801 /* * Resolver configuration file. @@ -110,9 +110,9 @@ struct __res_state { struct sockaddr_in nsaddr_list[MAXNS]; /* address of name server */ #define nsaddr nsaddr_list[0] /* for backward compatibility */ - u_short id; /* current packet id */ + u_short id; /* current message id */ char *dnsrch[MAXDNSRCH+1]; /* components of domain to search */ - char defdname[MAXDNAME]; /* default domain */ + char defdname[256]; /* default domain (deprecated) */ u_long pfcode; /* RES_PRF_ flags - see below. */ unsigned ndots:4; /* threshold for initial abs. query */ unsigned nsort:4; /* number of elements in sort_list[] */ @@ -121,7 +121,7 @@ struct __res_state { struct in_addr addr; u_int32_t mask; } sort_list[MAXRESOLVSORT]; - char pad[72]; /* On an i38this means 512b total. */ + char pad[72]; /* on an i386 this means 512b total */ }; /* @@ -182,16 +182,30 @@ typedef res_sendhookact (*res_send_rhook)__P((const struct sockaddr_in *ns, int anssiz, int *resplen)); +struct res_sym { + int number; /* Identifying number, like T_MX */ + char * name; /* Its symbolic name, like "MX" */ + char * humanname; /* Its fun name, like "mail exchanger" */ +}; + extern struct __res_state _res; +extern const struct res_sym __p_class_syms[]; +extern const struct res_sym __p_type_syms[]; /* Private routines shared between libc/net, named, nslookup and others. */ #define res_hnok __res_hnok #define res_ownok __res_ownok #define res_mailok __res_mailok #define res_dnok __res_dnok +#define sym_ston __sym_ston +#define sym_ntos __sym_ntos +#define sym_ntop __sym_ntop +#define b64_ntop __b64_ntop +#define b64_pton __b64_pton #define loc_ntoa __loc_ntoa #define loc_aton __loc_aton #define dn_skipname __dn_skipname +#define fp_resstat __fp_resstat #define fp_query __fp_query #define fp_nquery __fp_nquery #define hostalias __hostalias @@ -200,55 +214,83 @@ extern struct __res_state _res; #define p_class __p_class #define p_time __p_time #define p_type __p_type +#define p_query __p_query #define p_cdnname __p_cdnname #define p_cdname __p_cdname +#define p_fqnname __p_fqnname #define p_fqname __p_fqname #define p_rr __p_rr #define p_option __p_option +#define p_secstodate __p_secstodate +#define dn_count_labels __dn_count_labels +#define dn_comp __dn_comp #define res_randomid __res_randomid +#define res_send __res_send #define res_isourserver __res_isourserver #define res_nameinquery __res_nameinquery #define res_queriesmatch __res_queriesmatch +#define res_close __res_close + +#ifdef BIND_RES_POSIX3 +#define dn_expand __dn_expand +#define res_init __res_init +#define res_query __res_query +#define res_search __res_search +#define res_querydomain __res_querydomain +#define res_mkquery __res_mkquery +#endif + __BEGIN_DECLS -int __res_hnok __P((const char *)); -int __res_ownok __P((const char *)); -int __res_mailok __P((const char *)); -int __res_dnok __P((const char *)); -int __loc_aton __P((const char *ascii, u_char *binary)); -char * __loc_ntoa __P((const u_char *binary, char *ascii)); -int __dn_skipname __P((const u_char *, const u_char *)); -void __fp_resstat __P((struct __res_state *, FILE *)); -void __fp_query __P((const u_char *, FILE *)); -void __fp_nquery __P((const u_char *, int, FILE *)); -char *__hostalias __P((const char *)); -void __putlong __P((u_int32_t, u_char *)); -void __putshort __P((u_int16_t, u_char *)); -char *__p_time __P((u_int32_t)); -void __p_query __P((const u_char *)); -const u_char *__p_cdnname __P((const u_char *, const u_char *, int, FILE *)); -const u_char *__p_cdname __P((const u_char *, const u_char *, FILE *)); -const u_char *__p_fqname __P((const u_char *, const u_char *, FILE *)); -const u_char *__p_rr __P((const u_char *, const u_char *, FILE *)); -const char *__p_type __P((int)); -const char *__p_class __P((int)); -const char *__p_option __P((u_long option)); -int dn_comp __P((const char *, u_char *, int, u_char **, u_char **)); -int dn_expand __P((const u_char *, const u_char *, const u_char *, - char *, int)); -int res_init __P((void)); -u_int16_t res_randomid __P((void)); -int res_query __P((const char *, int, int, u_char *, int)); -int res_search __P((const char *, int, int, u_char *, int)); -int res_querydomain __P((const char *, const char *, int, int, - u_char *, int)); -int res_mkquery __P((int, const char *, int, int, const u_char *, int, - const u_char *, u_char *, int)); -int res_send __P((const u_char *, int, u_char *, int)); -int res_isourserver __P((const struct sockaddr_in *)); -int res_nameinquery __P((const char *, int, int, - const u_char *, const u_char *)); -int res_queriesmatch __P((const u_char *, const u_char *, - const u_char *, const u_char *)); +int res_hnok __P((const char *)); +int res_ownok __P((const char *)); +int res_mailok __P((const char *)); +int res_dnok __P((const char *)); +int sym_ston __P((const struct res_sym *, char *, int *)); +const char * sym_ntos __P((const struct res_sym *, int, int *)); +const char * sym_ntop __P((const struct res_sym *, int, int *)); +int b64_ntop __P((u_char const *, size_t, char *, size_t)); +int b64_pton __P((char const *, u_char *, size_t)); +int loc_aton __P((const char *, u_char *)); +const char * loc_ntoa __P((const u_char *, char *)); +int dn_skipname __P((const u_char *, const u_char *)); +void fp_resstat __P((struct __res_state *, FILE *)); +void fp_query __P((const u_char *, FILE *)); +void fp_nquery __P((const u_char *, int, FILE *)); +const char * hostalias __P((const char *)); +void putlong __P((u_int32_t, u_char *)); +void putshort __P((u_int16_t, u_char *)); +const char * p_class __P((int)); +const char * p_time __P((u_int32_t)); +const char * p_type __P((int)); +void p_query __P((const u_char *)); +const u_char * p_cdnname __P((const u_char *, const u_char *, int, FILE *)); +const u_char * p_cdname __P((const u_char *, const u_char *, FILE *)); +const u_char * p_fqnname __P((const u_char *cp, const u_char *msg, + int, char *, int)); +const u_char * p_fqname __P((const u_char *, const u_char *, FILE *)); +const u_char * p_rr __P((const u_char *, const u_char *, FILE *)); +const char * p_option __P((u_long option)); +char * p_secstodate __P((u_long)); +int dn_count_labels __P((char *)); +int dn_comp __P((const char *, u_char *, int, + u_char **, u_char **)); +int dn_expand __P((const u_char *, const u_char *, const u_char *, + char *, int)); +int res_init __P((void)); +u_int res_randomid __P((void)); +int res_query __P((const char *, int, int, u_char *, int)); +int res_search __P((const char *, int, int, u_char *, int)); +int res_querydomain __P((const char *, const char *, int, int, + u_char *, int)); +int res_mkquery __P((int, const char *, int, int, const u_char *, int, + const u_char *, u_char *, int)); +int res_send __P((const u_char *, int, u_char *, int)); +int res_isourserver __P((const struct sockaddr_in *)); +int res_nameinquery __P((const char *, int, int, + const u_char *, const u_char *)); +int res_queriesmatch __P((const u_char *, const u_char *, + const u_char *, const u_char *)); +void res_close __P((void)); __END_DECLS #endif /* !_RESOLV_H_ */ diff --git a/contrib/bind/man/gethostbyname.3 b/contrib/bind/man/gethostbyname.3 index 23432a0..034904b 100644 --- a/contrib/bind/man/gethostbyname.3 +++ b/contrib/bind/man/gethostbyname.3 @@ -103,8 +103,10 @@ The first address in h_addr_list; this is for backward compatibility. .PP When using the nameserver, .I gethostbyname -will search for the named host in the current domain and its parents -unless the name ends in a dot. +will search for the named host in each parent domain given in the ``search'' +directive of +.IR resolv.conf (5) +unless the name contains a dot. If the name contains no dot, and if the environment variable ``HOSTALAIASES'' contains the name of an alias file, the alias file will first be searched for an alias matching the input name. diff --git a/contrib/bind/man/named.8 b/contrib/bind/man/named.8 index fae5d51..d65770c 100644 --- a/contrib/bind/man/named.8 +++ b/contrib/bind/man/named.8 @@ -128,22 +128,23 @@ The following is a small example: ; directory /usr/local/adm/named -.ta \w'forwarders\ 'u +\w'6.32.128.IN-ADDR.ARPA\ 'u +\w'128.32.137.8 128.32.137.3\ 'u +.ta \w'check-names\ 'u +\w'6.32.128.IN-ADDR.ARPA\ 'u +\w'128.32.137.8 128.32.137.3\ 'u ; type domain source host/file backup file -cache . root.cache +cache . root.cache primary Berkeley.EDU berkeley.edu.zone primary 32.128.IN-ADDR.ARPA ucbhosts.rev secondary CC.Berkeley.EDU 128.32.137.8 128.32.137.3 cc.zone.bak secondary 6.32.128.IN-ADDR.ARPA 128.32.137.8 128.32.137.3 cc.rev.bak -primary 0.0.127.IN-ADDR.ARPA localhost.rev +primary 0.0.127.IN-ADDR.ARPA localhost.rev forwarders 10.0.0.78 10.2.0.78 limit transfers-in 10 limit datasize 64M +limit files 256 options forward-only query-log fake-iquery -check-names primary fail -check-names secondary warn -check-names response ignore +check-names primary fail +check-names secondary warn +check-names response ignore .DT .fi @@ -241,6 +242,10 @@ a warning message. which \s-1BIND\s+1 will spawn at any one time. \fBtransfers-per-ns\fP's argument is the maximum number of zone transfers to be simultaneously initiated to any given remote name server. +\fBfiles\fP's argument sets the number of file descriptors available to +the process. \fINote:\fP not all systems provide a call to implement +this -- on such systems, the use of the \fBfiles\fP parameter of ``limit'' +will result in a warning message. .LP The ``options'' directive introduces a boolean specifier that changes the behaviour of \s-1BIND\s+1. More than one option can be specified in a single @@ -263,7 +268,7 @@ bogus reply to ``inverse queries'' rather than responding with an error -- this is helpful if you have a lot of microcomputers or SunOS hosts or both. .LP The ``check-names'' directive tells \s-1BIND\s+1 to check names in either -``primary'' or ``secondary'' zone files, or in messages (``response'') +``primary'' or ``secondary'' zone files, or in messages (``response'') received during recursion (for example, those which would be forwarded back to a firewalled requestor). For each type of name, \s-1BIND\s+1 can be told to ``fail'', such that a zone would not be loaded @@ -356,12 +361,13 @@ Each master zone file should begin with an SOA record for the zone. An example SOA record is as follows: .LP .nf -@ IN SOA ucbvax.Berkeley.EDU. rwh.ucbvax.Berkeley.EDU. ( - 1989020501 ; serial - 10800 ; refresh - 3600 ; retry - 3600000 ; expire - 86400 ) ; minimum +@ IN SOA ucbvax.Berkeley.EDU. rwh.ucbvax.Berkeley.EDU. ( +.ta \w'x\ IN\ SOA\ 'u +\w'1989020501\ 'u + 1989020501 ; serial + 10800 ; refresh + 3600 ; retry + 3600000 ; expire + 86400 ) ; minimum .fi .LP The SOA specifies a serial number, which should be changed each time the diff --git a/contrib/bind/named/Makefile b/contrib/bind/named/Makefile index edd6533..777cbb9 100644 --- a/contrib/bind/named/Makefile +++ b/contrib/bind/named/Makefile @@ -1,6 +1,6 @@ # # @(#)Makefile.dist 5.4 (Berkeley) 8/15/90 -# $Id: Makefile,v 8.7 1995/12/22 10:20:30 vixie Exp $ +# $Id: Makefile,v 8.10 1996/09/22 00:13:10 vixie Exp $ # ## ++Copyright++ 1987, 1988, 1990 @@ -89,7 +89,8 @@ CDEBUG= -g LIBS= COMPLIB= ../compat/lib/lib44bsd.a PATH_XFER = ${DESTEXEC}/${XFER_INDOT}named-xfer -DEFS = -D_PATH_XFER=\"${PATH_XFER}\" -D_PATH_PIDFILE=\"${PIDDIR}/named.pid\" +DEFS = -D_PATH_XFER=\"${PATH_XFER}\" -D_PATH_PIDFILE=\"${PIDDIR}/named.pid\" \ + -DKSYMS=\"${KSYMS}\" -DKMEM=\"${KMEM}\" -DUDPSUM=\"${UDPSUM}\" INSTALL = install PS=ps IOT=ABRT @@ -101,14 +102,14 @@ SRCS= db_dump.c db_load.c db_lookup.c db_reload.c db_save.c db_update.c \ db_secure.c db_glue.c \ ns_forw.c ns_init.c ns_main.c ns_maint.c ns_req.c ns_resp.c \ ns_sort.c ns_stats.c ns_validate.c ns_ncache.c \ - storage.c dmalloc.c tree.c + storage.c tree.c ns_udp.c OBJS= db_dump.o db_load.o db_lookup.o db_reload.o db_save.o db_update.o \ db_secure.o db_glue.o \ ns_forw.o ns_init.o ns_main.o ns_maint.o ns_req.o ns_resp.o \ ns_sort.o ns_stats.o ns_validate.o ns_ncache.o \ - storage.o dmalloc.o tree.o + storage.o tree.o ns_udp.o XFERSRCS= named-xfer.c -XFEROBJ= named-xfer.o db_glue.o storage.o dmalloc.o version.o +XFEROBJ= named-xfer.o db_glue.o storage.o version.o all: named named-xfer named.reload named.restart ndc diff --git a/contrib/bind/named/db_defs.h b/contrib/bind/named/db_defs.h index 7356818..7882393 100644 --- a/contrib/bind/named/db_defs.h +++ b/contrib/bind/named/db_defs.h @@ -1,6 +1,6 @@ /* * from db.h 4.16 (Berkeley) 6/1/90 - * $Id: db_defs.h,v 8.4 1996/05/17 09:10:46 vixie Exp $ + * $Id: db_defs.h,v 8.5 1996/08/27 08:33:23 vixie Exp $ */ /* @@ -90,16 +90,15 @@ struct databuf { int16_t d_zone; /* zone number or 0 for the cache */ int16_t d_class; /* class number */ int16_t d_type; /* type number */ - int16_t d_mark; /* place to mark data */ int16_t d_size; /* size of data area */ #ifdef NCACHE - int16_t d_rcode; /* rcode added for negative caching */ + unsigned d_rcode :4; /* rcode added for negative caching */ #endif - int16_t d_rcnt; + unsigned d_rcnt :12; #ifdef STATS struct nameser *d_ns; /* NS from whence this came */ #endif -/*XXX*/ u_int32_t d_nstime; /* NS response time, milliseconds */ + u_int16_t d_nstime; /* NS response time, milliseconds */ u_char d_data[sizeof(char*)]; /* malloc'd (padded) */ }; #define DATASIZE(n) (sizeof(struct databuf) - sizeof(char*) + n) @@ -108,6 +107,7 @@ struct databuf { * d_flags definitions */ #define DB_F_HINT 0x01 /* databuf belongs to fcachetab */ +#define DB_F_ACTIVE 0x02 /* databuf is linked into a cache */ /* * d_cred definitions diff --git a/contrib/bind/named/db_dump.c b/contrib/bind/named/db_dump.c index 421c121..09e96d3 100644 --- a/contrib/bind/named/db_dump.c +++ b/contrib/bind/named/db_dump.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)db_dump.c 4.33 (Berkeley) 3/3/91"; -static char rcsid[] = "$Id: db_dump.c,v 8.14 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: db_dump.c,v 8.19 1996/10/08 04:51:03 vixie Exp $"; #endif /* not lint */ /* @@ -55,6 +55,28 @@ static char rcsid[] = "$Id: db_dump.c,v 8.14 1996/08/05 08:31:30 vixie Exp $"; * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * --Copyright-- */ @@ -260,42 +282,6 @@ doadump() syslog(LOG_NOTICE, "finished dumping nameserver data\n"); } -#ifdef ALLOW_UPDATES -/* Create a disk database to back up zones - */ -void -zonedump(zp) - register struct zoneinfo *zp; -{ - FILE *fp; - char *fname; - struct hashbuf *htp; - char *op; - struct stat st; - - /* Only dump zone if there is a cache specified */ - if (zp->z_source && *(zp->z_source)) { - dprintf(1, (ddt, "zonedump(%s)\n", zp->z_source)); - - if ((fp = fopen(zp->z_source, "w")) == NULL) - return; - if (op = strchr(zp->z_origin, '.')) - op++; - gettime(&tt); - htp = hashtab; - if (nlookup(zp->z_origin, &htp, &fname, 0) != NULL) { - db_dump(htp, fp, zp-zones, (op == NULL ? "" : op)); - zp->z_flags &= ~Z_CHANGED; /* Checkpointed */ - } - (void) my_fclose(fp); - if (stat(zp->z_source, &st) == 0) - zp->z_ftime = st.st_mtime; - } else { - dprintf(1, (ddt, "zonedump: no zone to dump\n")); - } -} -#endif - int zt_dump(fp) FILE *fp; @@ -365,7 +351,12 @@ db_dump(htp, fp, zone, origin) register u_char *cp; u_char *end; char *proto, *sep; + int16_t type; int found_data = 0, tab, printed_origin = 0; + u_int16_t keyflags; + u_char *sigdata; + u_char *savecp; + char temp_base64[MAX_KEY_BASE64]; npp = htp->h_tab; nppend = npp + htp->h_size; @@ -407,7 +398,7 @@ db_dump(htp, fp, zone, origin) fprintf(fp, ".%s.\t", origin); /* ??? */ } else fprintf(fp, "%s\t", NAME(*np)); - if (NAMELEN(*np) < (size_t)8) + if (NAMELEN(*np) < (unsigned)8) tab = 1; found_data++; } else { @@ -432,27 +423,29 @@ db_dump(htp, fp, zone, origin) p_type(dp->d_type)); cp = (u_char *)dp->d_data; sep = "\t;"; + type = dp->d_type; #ifdef NCACHE -#ifdef RETURNSOA - if (dp->d_rcode == NOERROR_NODATA) { - fprintf(fp, "NODATA%s-$", sep); - goto eoln; - } -#else if (dp->d_rcode == NXDOMAIN || dp->d_rcode == NOERROR_NODATA) { +#ifdef RETURNSOA + if (dp->d_size == 0) { +#endif fprintf(fp, "%s%s-$", (dp->d_rcode == NXDOMAIN) ?"NXDOMAIN" :"NODATA", sep); goto eoln; - } +#ifdef RETURNSOA + } else { + type = T_SOA; + } #endif + } #endif /* * Print type specific data */ - switch (dp->d_type) { + switch (type) { case T_A: switch (dp->d_class) { case C_IN: @@ -486,24 +479,28 @@ db_dump(htp, fp, zone, origin) break; case T_HINFO: - case T_ISDN: + case T_ISDN: { + char buf[256]; if ((n = *cp++) != '\0') { - fprintf(fp, "\"%.*s\"", (int)n, cp); + bcopy(cp, buf, n); buf[n] = '\0'; + fprintf(fp, "\"%.*s\"", (int)n, buf); cp += n; } else fprintf(fp, "\"\""); - if ((n = *cp++) != '\0') - fprintf(fp, " \"%.*s\"", (int)n, cp); - else + if ((n = *cp++) != '\0') { + bcopy(cp, buf, n); buf[n] = '\0'; + fprintf(fp, " \"%.*s\"", (int)n, buf); + } else fprintf(fp, " \"\""); break; + } case T_SOA: fprintf(fp, "%s.", cp); cp += strlen((char *)cp) + 1; fprintf(fp, " %s. (\n", cp); #if defined(RETURNSOA) && defined(NCACHE) - if (dp->d_rcode == NXDOMAIN) + if (dp->d_rcode) fputs(";", fp); #endif cp += strlen((char *)cp) + 1; @@ -518,8 +515,11 @@ db_dump(htp, fp, zone, origin) GETLONG(n, cp); fprintf(fp, " %lu )", (u_long)n); #if defined(RETURNSOA) && defined(NCACHE) - if (dp->d_rcode == NXDOMAIN) { - fprintf(fp,";%s.;NXDOMAIN%s-$",cp,sep); + if (dp->d_rcode) { + fprintf(fp,";%s.;%s%s-$",cp, + (dp->d_rcode == NXDOMAIN) ? + "NXDOMAIN" : "NODATA", + sep); } #endif break; @@ -540,21 +540,28 @@ db_dump(htp, fp, zone, origin) fprintf(fp, " %s.", cp); break; - case T_TXT: case T_X25: + if ((n = *cp++) != '\0') + fprintf(fp, " \"%.*s\"", (int)n, cp); + else + fprintf(fp, " \"\""); + break; + + case T_TXT: end = (u_char *)dp->d_data + dp->d_size; - (void) putc('"', fp); while (cp < end) { - if ((n = *cp++) != '\0') { - for (j = n ; j > 0 && cp < end ; j--) - if (*cp == '\n') { - (void) putc('\\', fp); - (void) putc(*cp++, fp); - } else - (void) putc(*cp++, fp); - } + (void) putc('"', fp); + if ((n = *cp++) != '\0') { + for (j = n ; j > 0 && cp < end ; j--) { + if (*cp == '\n' || *cp == '"' || *cp == '\\') + (void) putc('\\', fp); + (void) putc(*cp++, fp); + } + } + (void) putc('"', fp); + if (cp < end) + (void) putc(' ', fp); } - (void) fputs("\"", fp); break; case T_NSAP: @@ -580,6 +587,43 @@ db_dump(htp, fp, zone, origin) break; } #endif /* LOC_RR */ + + case T_NAPTR: { + u_int order, preference; + + GETSHORT(order, cp); + fprintf(fp, "%lu", (u_long)order); + + GETSHORT(preference, cp); + fprintf(fp, "%lu", (u_long)preference); + + if (n = *cp++) { + fprintf(fp, "\"%.*s\"", (int)n, cp); + cp += n; + } + if (n = *cp++) { + fprintf(fp, "\"%.*s\"", (int)n, cp); + cp += n; + } + if (n = *cp++) { + fprintf(fp, " \"%.*s\"", (int)n, cp); + cp += n; + } + fprintf(fp, " %s.", cp); + + break; + } + + case T_SRV: { + u_int priority, weight, port; + + GETSHORT(priority, cp); + GETSHORT(weight, cp); + GETSHORT(port, cp); + fprintf(fp, "\t%u %u %u %s.", + priority, weight, port, cp); + break; + } case T_UINFO: fprintf(fp, "\"%s\"", cp); break; @@ -619,6 +663,63 @@ db_dump(htp, fp, zone, origin) cp += strlen((char *)cp) + 1; fprintf(fp, " %s.", cp); break; + + case T_KEY: + savecp = cp; /* save the beginning */ + /*>>> Flags (unsigned_16) */ + GETSHORT(keyflags,cp); + fprintf(fp, "0x%04x ", keyflags); + /*>>> Protocol (8-bit decimal) */ + fprintf(fp, "%3u ", *cp++); + /*>>> Algorithm id (8-bit decimal) */ + fprintf(fp, "%3u ", *cp++); + + /*>>> Public-Key Data (multidigit BASE64) */ + /* containing ExponentLen, Exponent, and Modulus */ + i = b64_ntop(cp, dp->d_size - (cp - savecp), + temp_base64, + sizeof temp_base64); + if (i < 0) + fprintf(fp, "; BAD BASE64"); + else + fprintf(fp, "%s", temp_base64); + break; + + case T_SIG: + sigdata = cp; + /* RRtype (char *) */ + GETSHORT(n,cp); + fprintf(fp, "%s ", p_type(n)); + /* Algorithm id (8-bit decimal) */ + fprintf(fp, "%d ", *cp++); + /* Labels (8-bit decimal) (not saved in file) */ + /* FIXME -- check value and print err if bad */ + cp++; + /* OTTL (u_long) */ + GETLONG(n, cp); + fprintf(fp, "%lu ", n); + /* Texp (u_long) */ + GETLONG(n, cp); + fprintf(fp, "%s ", p_secstodate (n)); + /* Tsig (u_long) */ + GETLONG(n, cp); + fprintf(fp, "%s ", p_secstodate (n)); + /* Kfootprint (unsigned_16) */ + GETSHORT(n, cp); + fprintf(fp, "%lu ", n); + /* Signer's Name (char *) */ + fprintf(fp, "%s ", cp); + cp += strlen((char *)cp) + 1; + /* Signature (base64 of any length) */ + i = b64_ntop(cp, dp->d_size - (cp - sigdata), + temp_base64, + sizeof temp_base64); + if (i < 0) + fprintf(fp, "; BAD BASE64"); + else + fprintf(fp, "%s", temp_base64); + break; + #ifdef ALLOW_T_UNSPEC case T_UNSPEC: /* Dump binary data out in an ASCII-encoded @@ -860,7 +961,7 @@ byte_btoa(c, bufp) register int32_t tmpword = word; if (tmpword < 0) { - /* Because some don't support unsigned long */ + /* Because some don't support u_long */ tmp = 32; tmpword -= (int32_t)(85 * 85 * 85 * 85 * 32); } diff --git a/contrib/bind/named/db_func.h b/contrib/bind/named/db_func.h index 60b7f32..5d3929d 100644 --- a/contrib/bind/named/db_func.h +++ b/contrib/bind/named/db_func.h @@ -1,6 +1,6 @@ /* db_proc.h - prototypes for functions in db_*.c * - * $Id: db_func.h,v 8.9 1996/06/02 08:20:39 vixie Exp $ + * $Id: db_func.h,v 8.12 1996/09/22 00:13:10 vixie Exp $ */ /* ++from db_update.c++ */ @@ -9,6 +9,7 @@ extern int db_update __P((char name[], struct databuf *newdp, int flags, struct hashbuf *htp)), + db_cmp __P((struct databuf *,struct databuf *)), findMyZone __P((struct namebuf *np, int class)); /* --from db_update.c-- */ @@ -18,16 +19,7 @@ extern void db_reload __P((void)); /* ++from db_save.c++ */ extern struct namebuf *savename __P((const char *, int)); -#ifdef DMALLOC -extern struct databuf *savedata_tagged __P((char *, int, - int, int, u_int32_t, - u_char *, int)); -#define savedata(class, type, ttl, data, size) \ - savedata_tagged(__FILE__, __LINE__, class, type, ttl, data, size) -#else -extern struct databuf *savedata __P((int, int, u_int32_t, - u_char *, int)); -#endif +extern struct databuf *savedata __P((int, int, u_int32_t, u_char *, int)); extern struct hashbuf *savehash __P((struct hashbuf *)); /* --from db_save.c-- */ @@ -37,9 +29,6 @@ extern int db_dump __P((struct hashbuf *, FILE *, int, char *)), atob __P((char *, int, char *, int, int *)); extern void doachkpt __P((void)), doadump __P((void)); -#ifdef ALLOW_UPDATES -extern void zonedump __P((struct zoneinfo *)); -#endif extern u_int db_getclev __P((const char *)); /* --from db_dump.c-- */ @@ -97,6 +86,7 @@ extern char * ctimel __P((long)); extern struct in_addr data_inaddr __P((const u_char *data)); extern void setsignal __P((int, int, SIG_FN (*)())), resignal __P((int, int, SIG_FN (*)())); +extern void db_free __P((struct databuf *)); /* --from db_glue.c-- */ /* ++from db_lookup.c++ */ diff --git a/contrib/bind/named/db_glob.h b/contrib/bind/named/db_glob.h index b339b5b..bd9235f 100644 --- a/contrib/bind/named/db_glob.h +++ b/contrib/bind/named/db_glob.h @@ -1,6 +1,6 @@ /* * from db.h 4.16 (Berkeley) 6/1/90 - * $Id: db_glob.h,v 8.3 1995/12/06 20:34:38 vixie Exp $ + * $Id: db_glob.h,v 8.4 1996/08/27 08:33:23 vixie Exp $ */ /* @@ -63,10 +63,10 @@ */ /* ONE_WEEK maximum ttl */ -DECL int max_cache_ttl INIT(7*24*60*60); +DECL u_int max_cache_ttl INIT(7*24*60*60); /* no minimum ttl */ -DECL int min_cache_ttl INIT(0); +DECL u_int min_cache_ttl INIT(0); /* current line number */ DECL int lineno; diff --git a/contrib/bind/named/db_glue.c b/contrib/bind/named/db_glue.c index 647ae80..4f6deb0 100644 --- a/contrib/bind/named/db_glue.c +++ b/contrib/bind/named/db_glue.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)db_glue.c 4.4 (Berkeley) 6/1/90"; -static char rcsid[] = "$Id: db_glue.c,v 8.13 1996/06/02 08:20:39 vixie Exp $"; +static char rcsid[] = "$Id: db_glue.c,v 8.16 1996/09/22 00:13:10 vixie Exp $"; #endif /* not lint */ /* @@ -481,23 +481,33 @@ rm_datum(dp, np, pdp) np->n_data = ndp; else pdp->d_next = ndp; -#ifdef DATUMREFCNT + if ((dp->d_flags & DB_F_ACTIVE) == 0) + panic(-1, "rm_datum: DB_F_ACTIVE not set"); + dp->d_flags &= ~DB_F_ACTIVE; + dp->d_next = NULL; if (--(dp->d_rcnt)) { +#ifdef DEBUG + int32_t ii; +#endif + switch(dp->d_type) { case T_NS: dprintf(1, (ddt, "rm_datum: %s rcnt = %d\n", dp->d_data, dp->d_rcnt)); break; case T_A: + +#ifdef DEBUG + bcopy(dp->d_data, &ii, sizeof(ii)); +#endif dprintf(1, (ddt, "rm_datum: %08.8X rcnt = %d\n", - *(int32_t*)(dp->d_data), dp->d_rcnt)); + ii, dp->d_rcnt)); break; default: dprintf(1, (ddt, "rm_datum: rcnt = %d\n", dp->d_rcnt)); } } else -#endif - free((char *)dp); + db_free(dp); return (ndp); } @@ -551,7 +561,7 @@ getname(np, buf, buflen) cp = buf; while (np != NULL) { - i = NAMELEN(*np); + i = (int) NAMELEN(*np); if (i + 1 >= buflen) { *cp = '\0'; syslog(LOG_INFO, "domain name too long: %s...\n", buf); @@ -718,45 +728,93 @@ samedomain(a, b) const char *a, *b; { size_t la, lb; + int diff, i, escaped; const char *cp; la = strlen(a); lb = strlen(b); - /* don't count trailing dots, if any. */ - if (la && a[la-1]=='.') - la--; - if (lb && b[lb-1]=='.') - lb--; + /* ignore a trailing label separator (i.e. an unescaped dot) in 'a' */ + if (la && a[la-1] == '.') { + escaped = 0; + /* note this loop doesn't get executed if la==1 */ + for (i = la - 2; i >= 0; i--) + if (a[i] == '\\') { + if (escaped) + escaped = 0; + else + escaped = 1; + } else { + break; + } + if (!escaped) + la--; + } + /* ignore a trailing label separator (i.e. an unescaped dot) in 'b' */ + if (lb && b[lb-1] == '.') { + escaped = 0; + /* note this loop doesn't get executed if lb==1 */ + for (i = lb - 2; i >= 0; i--) + if (b[i] == '\\') { + if (escaped) + escaped = 0; + else + escaped = 1; + } else { + break; + } + if (!escaped) + lb--; + } - /* lb==0 means b is the root domain, so a must be in b. */ + /* lb==0 means 'b' is the root domain, so 'a' must be in 'b'. */ if (lb == 0) return (1); - /* b longer than a means a can't be in b. */ + /* 'b' longer than 'a' means 'a' can't be in 'b'. */ if (lb > la) return (0); /* We use strncasecmp because we might be trying to - * ignore trailing dots. */ + * ignore a trailing dot. */ if (lb == la) return (strncasecmp(a, b, lb) == 0); /* Ok, we know la > lb. */ - /* Point at the character before the last 'lb' characters of a. */ - cp = a + (la - lb - 1); + diff = la - lb; - /* If it isn't '.', can't be a match (this lets us avoid - * having "foobar.com" match "bar.com"). */ - if (*cp != '.') + /* If 'a' is only 1 character longer than 'b', then it can't be + a subdomain of 'b' (because of the need for the '.' label + separator). */ + if (diff < 2) return (0); - cp++; + /* If the character before the last 'lb' characters of 'b' + isn't '.', then it can't be a match (this lets us avoid + having "foobar.com" match "bar.com"). */ + if (a[diff-1] != '.') + return (0); + /* We're not sure about that '.', however. It could be escaped + and thus not a really a label separator. */ + escaped=0; + for (i = diff-2; i >= 0; i--) + if (a[i] == '\\') { + if (escaped) + escaped = 0; + else + escaped = 1; + } + else + break; + if (escaped) + return (0); + /* We use strncasecmp because we might be trying to * ignore trailing dots. */ - return (strncasecmp(cp, b, lb)==0); + cp = a + diff; + return (strncasecmp(cp, b, lb) == 0); } /* @@ -784,8 +842,8 @@ data_inaddr(data) struct in_addr ret; u_int32_t tmp; - bcopy((char *)data, (char *)&tmp, INADDRSZ); - ret.s_addr = tmp; + GETLONG(tmp, data); + ret.s_addr = htonl(tmp); return (ret); } @@ -833,3 +891,19 @@ resignal(catch, block, handler) setsignal(catch, block, handler); #endif } + +void +db_free(dp) + struct databuf *dp; +{ + int bytes = DATASIZE(dp->d_size); + + if (dp->d_rcnt != 0) + panic(-1, "db_free: d_rcnt != 0"); + if (dp->d_flags & DB_F_ACTIVE) + panic(-1, "db_free: DB_F_ACTIVE set"); + if (dp->d_next) + panic(-1, "db_free: d_next != 0"); + memset(dp, 0x5E, bytes); + free((char*)dp); +} diff --git a/contrib/bind/named/db_load.c b/contrib/bind/named/db_load.c index dda27c9..6b0a11a 100644 --- a/contrib/bind/named/db_load.c +++ b/contrib/bind/named/db_load.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)db_load.c 4.38 (Berkeley) 3/2/91"; -static char rcsid[] = "$Id: db_load.c,v 8.22 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: db_load.c,v 8.31 1996/12/18 04:09:48 vixie Exp $"; #endif /* not lint */ /* @@ -55,6 +55,28 @@ static char rcsid[] = "$Id: db_load.c,v 8.22 1996/08/05 08:31:30 vixie Exp $"; * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * --Copyright-- */ @@ -66,88 +88,45 @@ static char rcsid[] = "$Id: db_load.c,v 8.22 1996/08/05 08:31:30 vixie Exp $"; #include <sys/param.h> #include <sys/stat.h> #include <sys/socket.h> + #include <netinet/in.h> #include <arpa/nameser.h> #include <arpa/inet.h> -#include <stdio.h> -#include <syslog.h> + #include <ctype.h> +#include <errno.h> #include <netdb.h> #include <resolv.h> -#include <errno.h> +#include <stdio.h> +#include <syslog.h> +#include <time.h> #include "named.h" +#define ALLOW_LONG_TXT_RDATA + static int gettoken __P((register FILE *, const char *)), getnonblank __P((FILE *, const char *)), getprotocol __P((FILE *, const char *)), - getservices __P((int, char *, FILE *, const char *)); + getservices __P((int, char *, FILE *, const char *)), + getcharstring __P((char *, char *, int, int, int, FILE *, const char *)); static void makename __P((char *, const char *)); static int makename_ok __P((char *name, const char *origin, int class, enum transport transport, enum context context, + const char *owner, const char *filename, int lineno)); +static int getmlword __P((char *, int, FILE *, int)); +static int getallwords __P((char *, int, FILE *, int)); +static u_int32_t wordtouint32 __P((char *)); +static u_int32_t datetosecs __P((char *, int *)); +static int wordtouint32_error = 0; static int empty_token = 0; -int getnum_error; +static int getmlword_nesting = 0; -/* - * Map class and type names to number - */ -struct map { - char token[8]; - int val; -}; - -struct map m_class[] = { - { "in", C_IN }, -#ifdef notdef - { "any", C_ANY }, /* any is a QCLASS, not CLASS */ -#endif - { "chaos", C_CHAOS }, - { "hs", C_HS }, -}; -#define M_CLASS_CNT (sizeof(m_class) / sizeof(struct map)) - -struct map m_type[] = { - { "a", T_A }, - { "ns", T_NS }, - { "cname", T_CNAME }, - { "soa", T_SOA }, - { "mb", T_MB }, - { "mg", T_MG }, - { "mr", T_MR }, - { "null", T_NULL }, - { "wks", T_WKS }, - { "ptr", T_PTR }, - { "hinfo", T_HINFO }, - { "minfo", T_MINFO }, - { "mx", T_MX }, - { "uinfo", T_UINFO }, - { "txt", T_TXT }, - { "rp", T_RP }, - { "afsdb", T_AFSDB }, - { "x25", T_X25 }, - { "isdn", T_ISDN }, - { "rt", T_RT }, - { "nsap", T_NSAP }, - { "nsap_ptr", T_NSAP_PTR }, - { "uid", T_UID }, - { "gid", T_GID }, - { "px", T_PX }, - { "aaaa", T_AAAA }, -#ifdef notdef - { "any", T_ANY }, /* any is a QTYPE, not TYPE */ -#endif -#ifdef LOC_RR - { "loc", T_LOC }, -#endif /* LOC_RR */ -#ifdef ALLOW_T_UNSPEC - { "unspec", T_UNSPEC }, -#endif /* ALLOW_T_UNSPEC */ -}; -#define M_TYPE_CNT (sizeof(m_type) / sizeof(struct map)) +int getnum_error; /* * Parser token values @@ -160,11 +139,11 @@ struct map m_type[] = { #define ORIGIN 6 #define ERROR 7 -static int clev; /* a zone deeper in a heirachy has more credability */ +static int clev; /* a zone deeper in a hierachy has more credability */ #define MAKENAME_OK(N) if (!makename_ok(N, origin, class, \ transport, context, \ - filename, lineno)) { \ + domain, filename, lineno)) { \ errs++; \ sprintf(buf, "bad name \"%s\"", N); \ goto err; \ @@ -188,14 +167,13 @@ db_load(filename, in_origin, zp, def_domain) { static int read_soa, read_ns, rrcount; register char *cp; - register struct map *mp; char domain[MAXDNAME]; char origin[MAXDNAME]; char tmporigin[MAXDNAME]; char buf[MAXDATA]; char data[MAXDATA]; - const char *cp1, *op; - int c, class, type, dbflags, dataflags, multiline; + const char *op; + int c, someclass, class, type, dbflags, dataflags, multiline; u_int32_t ttl; struct databuf *dp; FILE *fp; @@ -206,10 +184,19 @@ db_load(filename, in_origin, zp, def_domain) int escape; enum transport transport; enum context context; + u_int32_t sig_type; + u_int32_t keyflags; + int success; + int dateerror; #ifdef DO_WARN_SERIAL u_int32_t serial; #endif +/* Simple macro for setting error messages about RR's being parsed, + before jumping to err label. If no SETERR is done, the last word + scanned into "buf" by getword will be printed. */ +#define SETERR(x) strcpy (buf, x); + switch (zp->z_type) { case Z_PRIMARY: case Z_CACHE: @@ -347,41 +334,49 @@ db_load(filename, in_origin, zp, def_domain) if (!getword((char *)buf, sizeof(buf), fp, 0)) break; } - for (mp = m_class; mp < m_class+M_CLASS_CNT; mp++) - if (!strcasecmp((char *)buf, mp->token)) { - class = mp->val; - (void) getword((char *)buf, - sizeof(buf), fp, 0); - break; - } - for (mp = m_type; mp < m_type+M_TYPE_CNT; mp++) - if (!strcasecmp((char *)buf, mp->token)) { - type = mp->val; - goto fndtype; - } - dprintf(1, (ddt, "%s: Line %d: Unknown type: %s.\n", - filename, lineno, buf)); - errs++; - syslog(LOG_NOTICE, "%s: Line %d: Unknown type: %s.\n", - filename, lineno, buf); - break; - fndtype: + + /* Parse class (IN, etc) */ + someclass = sym_ston(__p_class_syms, + (char *)buf, &success); + if (success && someclass != C_ANY) { + class = someclass; + (void) getword((char *)buf, + sizeof(buf), fp, 0); + } + + /* Parse RR type (A, MX, etc) */ + type = sym_ston(__p_type_syms, + (char *)buf, &success); + if ((!success) || type == T_ANY) { + dprintf(1, (ddt, "%s: Line %d: Unknown type: %s.\n", + filename, lineno, buf)); + errs++; + syslog(LOG_INFO, "%s: Line %d: Unknown type: %s.\n", + filename, lineno, buf); + break; + } + context = ns_ownercontext(type, transport); - if (!ns_nameok(domain, class, transport, context)) { + if (!ns_nameok(domain, class, transport, context, + domain, inaddr_any)) { errs++; syslog(LOG_NOTICE, "%s:%d: owner name error\n", filename, lineno); break; } -#ifdef ALLOW_T_UNSPEC - /* Don't do anything here for T_UNSPEC... - * read input separately later - */ - if (type != T_UNSPEC) { -#endif + context = domain_ctx; switch (type) { +#ifdef ALLOW_T_UNSPEC + case T_UNSPEC: +#endif + case T_KEY: + case T_SIG: + /* Don't do anything here for these types -- + they read their own input separately later */ + goto dont_get_word; + case T_SOA: case T_MINFO: case T_RP: @@ -402,13 +397,11 @@ db_load(filename, in_origin, zp, def_domain) (ddt, "d='%s', c=%d, t=%d, ttl=%d, data='%s'\n", domain, class, type, ttl, buf)); -#ifdef ALLOW_T_UNSPEC - } -#endif /* * Convert the ascii data 'buf' to the proper format * based on the type and pack into 'data'. */ + dont_get_word: switch (type) { case T_A: if (!inet_aton(buf, &ina)) @@ -419,55 +412,6 @@ db_load(filename, in_origin, zp, def_domain) n = INT32SZ; break; - case T_HINFO: - case T_ISDN: - n = strlen((char *)buf); - if (n > 255) { - syslog(LOG_INFO, - "%s: line %d: %s too long", - filename, lineno, (type == T_ISDN) ? - "ISDN-address" : "CPU type"); - n = 255; - } - data[0] = n; - bcopy(buf, (char *)data + 1, (int)n); - if (n == 0) - goto err; - n++; - if (!getword((char *)buf, sizeof(buf), fp, 0)) - i = 0; - else { - endline(fp); - i = strlen((char *)buf); - } - if (i == 0) { - if (type == T_ISDN) { - data[n++] = 0; - break; - } - else - /* goto err; */ - /* XXX tolerate for now */ - data[n++] = 1; - data[n++] = '?'; - syslog(LOG_INFO, - "%s: line %d: OS-type missing", - filename, - empty_token ? (lineno - 1) : lineno); - break; - } - if (i > 255) { - syslog(LOG_INFO, - "%s:%d: %s too long", - filename, lineno, (type == T_ISDN) ? - "ISDN-sa" : "OS type"); - i = 255; - } - data[n] = i; - bcopy(buf, data + n + 1, i); - n += i + 1; - break; - case T_SOA: context = hostname_ctx; goto soa_rp_minfo; @@ -481,7 +425,8 @@ db_load(filename, in_origin, zp, def_domain) MAKENAME_OK(data); cp = data + strlen((char *)data) + 1; if (!getword((char *)cp, - (sizeof data) - (cp - data), + (sizeof data) - + (cp - (char *)data), fp, 1)) goto err; if (type == T_RP) @@ -491,7 +436,7 @@ db_load(filename, in_origin, zp, def_domain) MAKENAME_OK(cp); cp += strlen((char *)cp) + 1; if (type != T_SOA) { - n = cp - data; + n = cp - (char *)data; break; } if (class != zp->z_class) { @@ -572,18 +517,81 @@ db_load(filename, in_origin, zp, def_domain) } n = (u_int32_t) zp->z_minimum; PUTLONG (n, cp); - n = cp - data; + n = cp - (char *)data; if (multiline) { if (getnonblank(fp, filename) != ')') goto err; + endline(fp); } read_soa++; - if (zp->z_expire < zp->z_refresh ) { + if (zp->z_type != Z_PRIMARY) + break; + /* sanity checks PRIMARY ONLY */ + /* + * sanity: give enough time for the + * zone to transfer (retry) + */ + if (zp->z_expire < + (zp->z_refresh+zp->z_retry)) { + syslog(LOG_NOTICE, + "%s: WARNING SOA expire value is less then SOA refresh + retry (%lu < %lu + %lu)", + filename, zp->z_expire, zp->z_refresh, + zp->z_retry); + } + /* BIND specific */ + if (zp->z_expire < maint_interval) { + syslog(LOG_NOTICE, + "%s: WARNING SOA expire value is less then maintainance interval (%lu < %lu)", + filename, zp->z_expire, maint_interval); + } + /* BIND Specific */ + if (zp->z_refresh < maint_interval) { syslog(LOG_WARNING, - "%s: WARNING SOA expire value is less then SOA refresh (%lu < %lu)", - filename, zp->z_expire, zp->z_refresh); + "%s: WARNING SOA refresh value is less then maintainance interval (%lu < %lu)", + filename, zp->z_refresh, maint_interval); + } + /* BIND specific */ + if (zp->z_retry < maint_interval) { + syslog(LOG_WARNING, + "%s: WARNING SOA retry value is less then maintainance interval (%lu < %lu)", + filename, zp->z_retry, maint_interval); + } + /* sanity */ + if (zp->z_expire < + (zp->z_refresh + 10 * zp->z_retry)) { + syslog(LOG_WARNING, + "%s: WARNING SOA expire value is less then refresh + 10 * retry (%lu < (%lu + 10 * %lu))", + filename, zp->z_expire, zp->z_refresh, + zp->z_retry); + } + /* + * sanity: most harware/telco faults are + * detected and fixed within a week, + * secondaries should continue to + * operate for this time. + * (minimum of 4 days for long weekends) + */ + if (zp->z_expire < (7 * 24 * 3600)) { + syslog(LOG_WARNING, + "%s: WARNING SOA expire value is less then 7 days (%lu)", + filename, zp->z_expire); + } + /* + * sanity: maximum down time + * if we havn't talked for six months + * war must have broken out + */ + if (zp->z_expire > ( 183 * 24 * 3600)) { + syslog(LOG_WARNING, + "%s: WARNING SOA expire value is greater then 6 months (%lu)", + filename, zp->z_expire); + } + /* sanity */ + if (zp->z_refresh < (zp->z_retry * 2)) { + syslog(LOG_WARNING, + "%s: WARNING SOA refresh value is less than 2 * retry (%lu < %lu * 2)", + filename, zp->z_refresh, zp->z_retry); } - endline(fp); break; case T_UID: @@ -652,9 +660,66 @@ db_load(filename, in_origin, zp, def_domain) (char *)buf); n = strlen((char *)data) + 1; break; + + case T_NAPTR: + /* Order Preference Flags Service Replacement Regexp */ + n = 0; + cp = buf; + /* Order */ + while (isdigit(*cp)) + n = n * 10 + (*cp++ - '0'); + /* catch bad values */ + if ((cp == buf) || (n > 65535)) + goto err; + cp = data; + PUTSHORT((u_int16_t)n, cp); + /* Preference */ + n = getnum(fp, filename, GETNUM_NONE); + if (getnum_error || n > 65536) + goto err; + PUTSHORT((u_int16_t)n, cp); + + /* Flags */ + if (!getword((char *)buf, sizeof(buf), fp, 0)) + goto err; + n = strlen((char *)buf); + *cp++ = n; + bcopy(buf, (char *)cp, (int)n); + cp += n; + + /* Service Classes */ + if (!getword((char *)buf, sizeof(buf), fp, 0)) + goto err; + n = strlen((char *)buf); + *cp++ = n; + bcopy(buf, (char *)cp, (int)n); + cp += n; + + /* Pattern */ + if (!getword((char *)buf, sizeof(buf), fp, 0)) + goto err; + n = strlen((char *)buf); + *cp++ = n; + bcopy(buf, (char *)cp, (int)n); + cp += n; + + /* Replacement */ + if (!getword((char *)buf, sizeof(buf), fp, 1)) + goto err; + (void) strcpy((char *)cp, (char *)buf); + context = domain_ctx; + MAKENAME_OK(cp); + /* advance pointer to end of data */ + cp += strlen((char *)cp) +1; + + /* now save length */ + n = (cp - (char *)data); + break; + case T_MX: case T_AFSDB: case T_RT: + case T_SRV: n = 0; cp = buf; while (isdigit(*cp)) @@ -662,10 +727,21 @@ db_load(filename, in_origin, zp, def_domain) /* catch bad values */ if ((cp == buf) || (n > 65535)) goto err; - cp = data; PUTSHORT((u_int16_t)n, cp); + if (type == T_SRV) { + n = getnum(fp, filename, GETNUM_NONE); + if (getnum_error || n > 65536) + goto err; + PUTSHORT((u_int16_t)n, cp); + + n = getnum(fp, filename, GETNUM_NONE); + if (getnum_error || n > 65536) + goto err; + PUTSHORT((u_int16_t)n, cp); + } + if (!getword((char *)buf, sizeof(buf), fp, 1)) goto err; (void) strcpy((char *)cp, (char *)buf); @@ -675,7 +751,7 @@ db_load(filename, in_origin, zp, def_domain) cp += strlen((char *)cp) +1; /* now save length */ - n = (cp - data); + n = (cp - (char *)data); break; case T_PX: @@ -705,36 +781,31 @@ db_load(filename, in_origin, zp, def_domain) cp += strlen((char *)cp) + 1; /* now save length */ - n = (cp - data); + n = (cp - (char *)data); + break; + + case T_HINFO: + n = getcharstring(buf, data, type, 2, 2, fp, filename); + if (n == 0) + goto err; + break; + + case T_ISDN: + n = getcharstring(buf, data, type, 1, 2, fp, filename); + if (n == 0) + goto err; break; case T_TXT: + n = getcharstring(buf, data, type, 1, 0, fp, filename); + if (n == 0) + goto err; + break; + case T_X25: - i = strlen((char *)buf); - cp = data; - cp1 = buf; - /* - * there is expansion here so make sure we - * don't overflow data - */ - if (i > (sizeof data) * 255 / 256) { - syslog(LOG_INFO, - "%s: line %d: TXT record truncated", - filename, lineno); - i = (sizeof data) * 255 / 256; - } - while (i > 255) { - *cp++ = 255; - bcopy(cp1, cp, 255); - cp += 255; - cp1 += 255; - i -= 255; - } - *cp++ = i; - bcopy(cp1, cp, i); - cp += i; - n = cp - data; - endline(fp); + n = getcharstring(buf, data, type, 1, 1, fp, filename); + if (n == 0) + goto err; break; case T_NSAP: @@ -750,6 +821,459 @@ db_load(filename, in_origin, zp, def_domain) n = IN6ADDRSZ; endline(fp); break; + + case T_KEY: { + /* The KEY record looks like this in the db file: + * Name Cl KEY Flags Proto Algid PublicKeyData + * where: + * Name,Cl per usual + * KEY RR type + * Flags 4 digit hex value (unsigned_16) + * Proto 8 bit u_int + * Algid 8 bit u_int + * PublicKeyData + * a string of base64 digits, + * skipping any embedded whitespace. + */ + u_int32_t al, pr; + int nk, klen; + char *expstart; + u_int expbytes, modbytes; + + i = 0; + data[i] = '\0'; + cp = data; + getmlword_nesting = 0; /* KLUDGE err recov. */ + /*>>> Flags (unsigned_16) */ + if (!getmlword((char*)buf, sizeof(buf), fp, 0) + ) { + SETERR("No flags field"); + goto err; + } + keyflags = wordtouint32(buf); + if (wordtouint32_error || 0xFFFF < keyflags) + goto err; + if (keyflags & KEYFLAG_RESERVED_BITMASK) { + SETERR("Reserved flag bits are set"); + goto err; + } + PUTSHORT(keyflags, cp); + + /*>>> Protocol (8-bit decimal) */ + if (!getmlword((char*)buf, sizeof(buf), fp, 0) + ) { + SETERR("No protocol field"); + goto err; + } + pr = wordtouint32(buf); + if (wordtouint32_error || 255 < pr) + goto err; + *cp++ = (u_char) pr; + + /*>>> Algorithm id (8-bit decimal) */ + if (!getmlword((char*)buf, sizeof(buf), fp, 0) + ) { + SETERR("No algorithm ID") + goto err; + } + al = wordtouint32(buf); + if (wordtouint32_error || + 0 == al || 255 == al || 255 < al) + goto err; + *cp++ = (u_char) al; + + /*>>> Public Key data is in BASE64. + * We don't care what algorithm it uses or what + * the internal structure of the BASE64 data is. + */ + if (!getallwords((char *)buf, MAXDATA, fp, 0)) + klen = 0; + else { + /* Convert from BASE64 to binary. */ + klen = b64_pton(buf, (u_char*)cp, + sizeof data - + (cp - (char *)data)); + if (klen < 0) + goto err; + } + + /* set total length */ + n = cp + klen - (char *)data; + + /* + * Now check for valid key flags & algs & etc, + * from the RFC. + */ + + if (keyflags & (KEYFLAG_ZONEKEY | KEYFLAG_IPSEC + | KEYFLAG_EMAIL)) + pr |= 1; /* A nonzero proto. */ + if (KEYFLAG_TYPE_NO_KEY == + (keyflags & KEYFLAG_TYPEMASK)) + nk = 1; /* No-key */ + else + nk = 0; /* have a key */ + if ((keyflags & KEYFLAG_ZONEKEY) && + (KEYFLAG_TYPE_CONF_ONLY == + (keyflags & KEYFLAG_TYPEMASK))) { + /* Zone key must have Authentication bit + set ogud@tis.com */ + SETERR("Zonekey needs authentication bit"); + goto err; + } + + if (al == 0 && nk == 0) { + SETERR("Key specified, but no alg"); + goto err; + } + if (al != 0 && pr == 0) { + SETERR("Alg specified, but no protos"); + goto err; + } + + if (nk == 1 && klen != 0) { + SETERR("No-key flags set but key fnd"); + goto err; + } + + if (nk == 0 && klen == 0) { + SETERR("Key type spec'd, but no key"); + goto err; + } + + /* Check algorithm-ID and key structure, for + the algorithm-ID's that we know about. */ + switch (al) { + case ALGORITHM_MD5RSA: + if (klen == 0) + break; + expstart = cp; + expbytes = *expstart++; + if (expbytes == 0) + GETSHORT(expbytes, expstart); + + if (expbytes < 1) { + SETERR("Exponent too short"); + goto err; + } + if (expbytes > + (MAX_MD5RSA_KEY_PART_BITS + 7) / 8 + ) { + SETERR("Exponent too long"); + goto err; + } + if (*expstart == 0) { + SETERR("Exponent starts w/ 0"); + goto err; + } + + modbytes = klen - + (expbytes + (expstart - cp)); + if (modbytes < + (MIN_MD5RSA_KEY_PART_BITS + 7) / 8 + ) { + SETERR("Modulus too short"); + goto err; + } + if (modbytes > + (MAX_MD5RSA_KEY_PART_BITS + 7) / 8 + ) { + SETERR("Modulus too long"); + goto err; + } + if (*(expstart+expbytes) == 0) { + SETERR("Modulus starts w/ 0"); + goto err; + } + break; + + case ALGORITHM_EXPIRE_ONLY: + if (klen != 0) { + SETERR( + "Key provided for expire-only algorithm"); + goto err; + } + break; + case ALGORITHM_PRIVATE_OID: + if (klen == 0) { + SETERR("No ObjectID in key"); + goto err; + } + break; + } + + endline(fp); /* flush the rest of the line */ + break; + } /*T_KEY*/ + + case T_SIG: + { + /* The SIG record looks like this in the db file: + Name Cl SIG RRtype Algid [OTTL] Texp Tsig Kfoot Signer Sig + + where: Name and Cl are as usual + SIG is a keyword + RRtype is a char string + ALGid is 8 bit u_int + OTTL is 32 bit u_int (optionally present) + Texp is YYYYMMDDHHMMSS + Tsig is YYYYMMDDHHMMSS + Kfoot is 16-bit unsigned decimal integer + Signer is a char string + Sig is 64 to 319 base-64 digits + A missing OTTL is detected by the magnitude of the Texp value + that follows it, which is larger than any u_int. + The Labels field in the binary RR does not appear in the + text RR. + + It's too crazy to run these pages of SIG code at the right + margin. I'm exdenting them for readability. + */ + int siglen; + u_int32_t al; + u_int32_t signtime, exptime, timetilexp; + u_int32_t origTTL; + time_t now; + + /* The TTL gets checked against the Original TTL, + and bounded by the signature expiration time, which + are both under the signature. We can't let TTL drift + based on the SOA record. If defaulted, fix it now. + (It's not clear to me why USE_MINIMUM isn't eliminated + before putting ALL RR's into the database. -gnu@toad.com) */ + if (ttl == USE_MINIMUM) + ttl = zp->z_minimum; + + i = 0; + data[i] = '\0'; + getmlword_nesting = 0; /* KLUDGE err recovery */ + + /* RRtype (char *) */ + if (!getmlword((char*)buf, sizeof(buf), fp, 0)) { + SETERR("SIG record doesn't specify type"); + goto err; + } + sig_type = sym_ston(__p_type_syms, (char *)buf, &success); + if (!success || sig_type == T_ANY) { + /* + * We'll also accept a numeric RR type, + * for signing RR types that this version + * of named doesn't yet understand. + * In the T_ANY case, we rely on wordtouint32 + * to fail when scanning the string "ANY". + */ + sig_type = wordtouint32 (buf); + if (wordtouint32_error || sig_type > 0xFFFF) { + SETERR("Unknown RR type in SIG record"); + goto err; + } + } + cp = &data[i]; + PUTSHORT((u_int16_t)sig_type, cp); + i += 2; + + /* Algorithm id (8-bit decimal) */ + if (!getmlword((char *)buf, sizeof(buf), fp, 0)) { + SETERR("Missing algorithm ID"); + goto err; + } + al = wordtouint32(buf); + if (0 == al || wordtouint32_error || 255 <= al) + goto err; + data[i] = (u_char) al; + i++; + + /* + * Labels (8-bit decimal) + * Not given in the file. Must compute. + */ + n = dn_count_labels(domain); + if (0 >= n || 255 < n) { + SETERR ("SIG label count invalid"); + goto err; + } + data[i] = (u_char) n; + i++; + + /* + * OTTL (optional u_int32_t) and + * Texp (u_int32_t date) + */ + if (!getmlword((char *)buf, sizeof(buf), fp, 0)) { + SETERR("OTTL and expiration time missing"); + goto err; + } + /* + * See if OTTL is missing and this is a date. + * This relies on good, silent error checking + * in datetosecs. + */ + exptime = datetosecs(buf, &dateerror); + if (!dateerror) { + /* Output TTL as OTTL */ + origTTL = ttl; + cp = &data[i]; + PUTLONG (origTTL, cp); + i += 4; + } else { + /* Parse and output OTTL; scan TEXP */ + origTTL = wordtouint32(buf); + if (0 >= origTTL || wordtouint32_error || + (origTTL > 0x7fffffff)) + goto err; + cp = &data[i]; + PUTLONG(origTTL, cp); + i += 4; + if (!getmlword((char *)buf, sizeof(buf), fp, 0)) { + SETERR ("Expiration time missing"); + goto err; + } + exptime = datetosecs(buf, &dateerror); + } + if (dateerror || exptime > 0x7fffffff || exptime <= 0) { + SETERR("Invalid expiration time"); + goto err; + } + cp = &data[i]; + PUTLONG(exptime, cp); + i += 4; + + /* Tsig (u_int32_t) */ + if (!getmlword((char *)buf, sizeof(buf), fp, 0)) { + SETERR("Missing signature time"); + goto err; + } + signtime = datetosecs(buf, &dateerror); + if (0 == signtime || dateerror) { + SETERR("Invalid signature time"); + goto err; + } + cp = &data[i]; + PUTLONG(signtime, cp); + i += 4; + + /* Kfootprint (unsigned_16) */ + if (!getmlword((char *)buf, sizeof(buf), fp, 0)) { + SETERR("Missing key footprint"); + goto err; + } + n = wordtouint32(buf); + if (wordtouint32_error || n >= 0x0ffff) { + SETERR("Invalid key footprint"); + goto err; + } + cp = &data[i]; + PUTSHORT((u_int16_t)n, cp); + i += 2; + + /* Signer's Name */ + if (!getmlword((char*)buf, sizeof(buf), fp, 0)) { + SETERR("Missing signer's name"); + goto err; + } + cp = &data[i]; + strcpy(cp,buf); + context = domain_ctx; + MAKENAME_OK(cp); + i += strlen(cp) + 1; + + /* + * Signature (base64 of any length) + * We don't care what algorithm it uses or what + * the internal structure of the BASE64 data is. + */ + if (!getallwords((char *)buf, sizeof(buf), fp, 0)) { + siglen = 0; + } else { + cp = &data[i]; + siglen = b64_pton(buf, (u_char*)cp, sizeof data - i); + if (siglen < 0) + goto err; + } + + /* set total length and we're done! */ + n = i + siglen; + + /* + * Check signature time, expiration, and adjust TTL. Note + * that all time values are in GMT (UTC), *not* local time. + */ + + now = time (0); + + /* Don't let bogus name servers increase the signed TTL */ + if (ttl > origTTL) { + SETERR("TTL is greater than signed original TTL"); + goto err; + } + + /* Don't let bogus signers "sign" in the future. */ + if (signtime > now) { + SETERR("signature time is in the future"); + goto err; + } + + /* Ignore received SIG RR's that are already expired. */ + if (exptime <= now) { + SETERR("expiration time is in the past"); + goto err; + } + + /* Lop off the TTL at the expiration time. */ + timetilexp = exptime - now; + if (timetilexp < ttl) { + dprintf(1, (ddt, + "shrinking expiring %s SIG TTL from %d to %d\n", + p_secstodate(exptime), ttl, timetilexp)); + ttl = timetilexp; + } + + /* + * Check algorithm-ID and key structure, for + * the algorithm-ID's that we know about. + */ + switch (al) { + case ALGORITHM_MD5RSA: + if (siglen == 0) { + SETERR("No key for RSA algorithm"); + goto err; + } + if (siglen < 1) { + SETERR("Signature too short"); + goto err; + } + if (siglen > (MAX_MD5RSA_KEY_PART_BITS + 7) / 8) { + SETERR("Signature too long"); + goto err; + } + /* We rely on cp from parse */ + if (*cp == 0) { + SETERR("Signature starts with zeroes"); + goto err; + } + break; + + case ALGORITHM_EXPIRE_ONLY: + if (siglen != 0) { + SETERR( + "Signature supplied to expire-only algorithm" + ); + goto err; + } + break; + case ALGORITHM_PRIVATE_OID: + if (siglen == 0) { + SETERR("No ObjectID in key"); + goto err; + } + break; + } + + endline(fp); /* flush the rest of the line */ + + break; /* Accept this RR. */ + } + #ifdef LOC_RR case T_LOC: cp = buf + (n = strlen(buf)); @@ -832,7 +1356,7 @@ db_load(filename, in_origin, zp, def_domain) fprintf(ddt, "update failed %s %d\n", domain, type); #endif - free((char*) dp); + db_free(dp); } else { rrcount++; } @@ -885,8 +1409,10 @@ db_load(filename, in_origin, zp, def_domain) zoneTypeString(zp), zp->z_origin, errs ? "rejected due to errors" : "loaded", (u_long)zp->z_serial); - if (errs) + if (errs) { zp->z_flags |= Z_DB_BAD; + zp->z_ftime = 0; + } #ifdef BIND_NOTIFY /* XXX: this needs to be delayed, both according to the spec, and * because the metadata needed by sysnotify() (and its sysquery()) @@ -962,7 +1488,7 @@ gettoken(fp, src) * fp - file to read from * preserve - should we preserve \ before \\ and \.? * return value: - * 0 = no word; perhaps EOL or EOF + * 0 = no word; perhaps EOL or EOF; lineno was incremented. * 1 = word was read */ int @@ -1063,6 +1589,84 @@ getword(buf, size, fp, preserve) return (cp != buf); } +/* Get multiline words. Same parameters as getword. Handles any + number of leading ('s or )'s in the words it sees. + FIXME: We kludge recognition of ( and ) for multiline input. + Each paren must appear at the start of a (blank-separated) word, + which is particularly counter-intuitive for ). Good enough for now, + until Paul rewrites the parser. +*/ +static int +getmlword(buf, size, fp, preserve) + char *buf; + int size; + FILE *fp; + int preserve; +{ + char *p; + + do { + while (!getword (buf, size, fp, preserve)) { + /* No more words on this line. See if doing the + multiline thing. */ + if (!getmlword_nesting) { /* Nope... */ + ungetc('\n', fp); /* Push back newline */ + lineno--; /* Unbump the lineno */ + empty_token = 0; /* Undo this botch */ + return 0; + } + if (feof(fp) || ferror(fp)) + return 0; /* Error, no terminating ')' */ + /* Continue reading til we get a word... */ + } + while ('(' == *buf) { + /* Word starts with paren. Multiline mode. + Move the rest of the word down over the paren. */ + getmlword_nesting++; + p = buf; + while (0 != (p[0]=p[1])) p++; + } + while (')' == *buf) { + getmlword_nesting--; + p = buf; + while (0 != (p[0]=p[1])) p++; + } + } while (buf[0] == 0); /* loop til we get a non-( non-) word */ + + return 1; /* Got a word... */ +} + +/* Get all the remaining words on a line, concatenated into one big + long (not too long!) string, with the whitespace squeezed out. + This routine, like getword(), does not swallow the newline if words seen. + This routine, unlike getword(), never swallows the newline if no words. + Parameters are the same as getword(). Result is: + 0 got no words at all + 1 got one or more words + -1 got too many words, they don't all fit; or missing close paren +*/ +static int +getallwords(buf, size, fp, preserve) + char *buf; + int size; + FILE *fp; + int preserve; +{ + char *runningbuf = buf; + int runningsize = size; + int len; + + while (runningsize > 0) { + if (!getmlword (runningbuf, runningsize, fp, preserve)) { + return runningbuf!=buf; /* 1 or 0 */ + } + len = strlen(runningbuf); + runningbuf += len; + runningsize -= len; + } + return -1; /* Error, String too long */ +} + /* From: kagotani@cs.titech.ac.jp Message-Id: <9007040716.AA26646@saeko.cs.titech.ac.jp> @@ -1249,19 +1853,20 @@ makename(name, origin) } static int -makename_ok(name, origin, class, transport, context, filename, lineno) +makename_ok(name, origin, class, transport, context, owner, filename, lineno) char *name; const char *origin; int class; enum transport transport; enum context context; + const char *owner; const char *filename; int lineno; { int ret = 1; makename(name, origin); - if (!ns_nameok(name, class, transport, context)) { + if (!ns_nameok(name, class, transport, context, owner, inaddr_any)) { syslog(LOG_INFO, "%s:%d: database naming error\n", filename, lineno); ret = 0; @@ -1297,7 +1902,7 @@ getprotocol(fp, src) char b[MAXLEN]; (void) getword(b, sizeof(b), fp, 0); - + k = protocolnumber(b); if (k == -1) syslog(LOG_INFO, "%s: line %d: unknown protocol: %s.", @@ -1354,7 +1959,7 @@ getservices(n, data, fp, src) } else { syslog(LOG_INFO, - "%s: line %d: port no. (%d) too big\n", + "%s: line %d: port no. (%d) too big", src, lineno, k); dprintf(1, (ddt, "%s: line %d: port no. (%d) too big\n", @@ -1362,7 +1967,7 @@ getservices(n, data, fp, src) } } if (bracket) - syslog(LOG_INFO, "%s: line %d: missing close paren\n", + syslog(LOG_INFO, "%s: line %d: missing close paren", src, lineno); maxl = maxl/8+1; bcopy(bm, data+n, maxl); @@ -1404,7 +2009,7 @@ get_netlist(fp, netlistp, allow, print_tag) if (!inet_aton(buf, &ntp->my_addr)) { syslog(LOG_INFO, "%s contains bogus element (%s)", print_tag, buf); - continue; + continue; } if (maskp) { if (!inet_aton(maskp, &ina)) { @@ -1440,7 +2045,7 @@ get_netlist(fp, netlistp, allow, print_tag) } if (ntp) free((char *)ntp); - + dprintf(1, (ddt, "\n")); #ifdef DEBUG if (debug > 2) @@ -1499,3 +2104,186 @@ free_netlist(netlistp) } *netlistp = NULL; } + +/* + * Converts a word to a u_int32_t. Error if any non-numeric + * characters in the word, except leading or trailing white space. + */ +static u_int32_t +wordtouint32(buf) + char *buf; +{ + u_long result; + u_int32_t res2; + char *bufend; + + wordtouint32_error = 0; + result = strtoul(buf, &bufend, 0); + if (bufend == buf) + wordtouint32_error = 1; + else + while ('\0' != *bufend) { + if (isspace(*bufend)) + bufend++; + else { + wordtouint32_error = 1; + break; + } + } + /* Check for truncation between u_long and u_int32_t */ + res2 = result; + if (res2 != result) + wordtouint32_error = 1; + return (res2); +} + + +/* + * Parse part of a date. Set error flag if any error. + * Don't reset the flag if there is no error. + */ +static int +datepart(buf, size, min, max, errp) + char *buf; + int size, min, max, *errp; +{ + int result = 0; + int i; + + for (i = 0; i < size; i++) { + if (!isdigit(buf[i])) + *errp = 1; + result = (result * 10) + buf[i] - '0'; + } + if (result < min) + *errp = 1; + if (result > max) + *errp = 1; + return (result); +} + + +/* Convert a date in ASCII into the number of seconds since + 1 January 1970 (GMT assumed). Format is yyyymmddhhmmss, all + digits required, no spaces allowed. */ + +static u_int32_t +datetosecs(cp, errp) + char *cp; + int *errp; +{ + struct tm time; + u_int32_t result; + int mdays, i; + static const int days_per_month[12] = + {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}; + + if (strlen(cp) != 14) { + *errp = 1; + return 0; + } + *errp = 0; + + bzero((char *)&time, sizeof time); + time.tm_year = datepart(cp + 0, 4, 1990, 9999, errp) - 1900; + time.tm_mon = datepart(cp + 4, 2, 01, 12, errp) - 1; + time.tm_mday = datepart(cp + 6, 2, 01, 31, errp); + time.tm_hour = datepart(cp + 8, 2, 00, 23, errp); + time.tm_min = datepart(cp + 10, 2, 00, 59, errp); + time.tm_sec = datepart(cp + 12, 2, 00, 59, errp); + if (*errp) /* Any parse errors? */ + return (0); + + /* + * OK, now because timegm() is not available in all environments, + * we will do it by hand. Roll up sleeves, curse the gods, begin! + */ + +#define SECS_PER_DAY ((u_int32_t)24*60*60) +#define isleap(y) ((((y) % 4) == 0 && ((y) % 100) != 0) || ((y) % 400) == 0) + + result = time.tm_sec; /* Seconds */ + result += time.tm_min * 60; /* Minutes */ + result += time.tm_hour * (60*60); /* Hours */ + result += (time.tm_mday - 1) * SECS_PER_DAY; /* Days */ + + /* Months are trickier. Look without leaping, then leap */ + mdays = 0; + for (i = 0; i < time.tm_mon; i++) + mdays += days_per_month[i]; + result += mdays * SECS_PER_DAY; /* Months */ + if (time.tm_mon > 1 && isleap (1900+time.tm_year)) + result += SECS_PER_DAY; /* Add leapday for this year */ + + /* First figure years without leapdays, then add them in. */ + /* The loop is slow, FIXME, but simple and accurate. */ + result += (time.tm_year - 70) * (SECS_PER_DAY*365); /* Years */ + for (i = 70; i < time.tm_year; i++) + if (isleap (1900+i)) + result += SECS_PER_DAY; /* Add leapday for prev year */ + + return (result); +} + + +#define MAXCHARSTRING 255 + +static int +getcharstring(buf, data, type, minfields, maxfields, fp, src) + char *buf; + char *data; + int type; + int minfields; + int maxfields; + FILE *fp; + const char *src; +{ + int nfield = 0, done = 0, n = 0, i; + char *b = buf; + + do { + nfield++; + i = strlen(buf); +#ifdef ALLOW_LONG_TXT_RDATA + b = buf; + if (type == T_TXT || type == T_X25) { + while (i > MAXCHARSTRING + && n + MAXCHARSTRING + 1 < MAXDATA) { + data[n] = MAXCHARSTRING; + bcopy(b, data + n + 1, MAXCHARSTRING); + n += MAXCHARSTRING + 1; + b += MAXCHARSTRING; + i -= MAXCHARSTRING; + } + } +#endif /* ALLOW_LONG_TXT_RDATA */ + if (i > MAXCHARSTRING) { + syslog(LOG_INFO, + "%s: line %d: RDATA field %d too long", + src, lineno, nfield); + return (0); + } + if (n + i + 1 > MAXDATA) { + syslog(LOG_INFO, + "%s: line %d: total RDATA too long", + src, lineno); + return (0); + } + data[n] = i; + bcopy(b, data + n + 1, (int)i); + n += i + 1; + done = (maxfields && nfield >= maxfields); + } while (!done && getword(buf, MAXDATA, fp, 0)); + + if (nfield < minfields) { + syslog(LOG_INFO, + "%s: line %d: expected %d RDATA fields, only saw %d", + src, lineno, minfields, nfield); + return (0); + } + + if (done) + endline(fp); + + return (n); +} diff --git a/contrib/bind/named/db_lookup.c b/contrib/bind/named/db_lookup.c index 4582589..fce3ffd 100644 --- a/contrib/bind/named/db_lookup.c +++ b/contrib/bind/named/db_lookup.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)db_lookup.c 4.18 (Berkeley) 3/21/91"; -static char rcsid[] = "$Id: db_lookup.c,v 8.7 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: db_lookup.c,v 8.9 1996/09/22 00:13:10 vixie Exp $"; #endif /* not lint */ /* @@ -119,7 +119,8 @@ nlookup(name, htpp, fname, insert) /* rotate left HASHSHIFT */ hval = (hval << HASHSHIFT) | (hval>>((sizeof(hval)*8)-HASHSHIFT)); - hval += (isupper(c) ? tolower(c) : c) & HASHMASK; + hval += ((isascii(c) && isupper(c)) ? tolower(c) : c) + & HASHMASK; if (escaped) escaped = 0; else if (c == '\\') @@ -133,7 +134,7 @@ nlookup(name, htpp, fname, insert) np != NULL; np = np->n_next) { if (np->n_hashval == hval && - (NAMELEN(*np) == (cp - name)) && + ((size_t)NAMELEN(*np) == (cp - name)) && (strncasecmp(name, NAME(*np), cp - name) == 0)) { *fname = name; return (np); diff --git a/contrib/bind/named/db_reload.c b/contrib/bind/named/db_reload.c index 46fa7fe..640f5bd 100644 --- a/contrib/bind/named/db_reload.c +++ b/contrib/bind/named/db_reload.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)db_reload.c 4.22 (Berkeley) 3/21/91"; -static char rcsid[] = "$Id: db_reload.c,v 8.2 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: db_reload.c,v 8.3 1996/08/27 08:33:23 vixie Exp $"; #endif /* not lint */ /* @@ -98,7 +98,7 @@ db_reload() #if 0 /* someday we'll need this.. (untested since before 1990) */ void -db_free(htp) +ht_free(htp) struct hashbuf *htp; { register struct databuf *dp, *nextdp; @@ -114,7 +114,7 @@ db_free(htp) (void) free((char *)np->n_dname); for (dp = np->n_data; dp != NULL; ) { nextdp = dp->d_next; - (void) free((char *)dp); + db_free(dp); dp = nextdp; } nextnp = np->n_next; diff --git a/contrib/bind/named/db_save.c b/contrib/bind/named/db_save.c index 88b31d1..277b008 100644 --- a/contrib/bind/named/db_save.c +++ b/contrib/bind/named/db_save.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)db_save.c 4.16 (Berkeley) 3/21/91"; -static char rcsid[] = "$Id: db_save.c,v 8.4 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: db_save.c,v 8.6 1996/09/22 00:13:10 vixie Exp $"; #endif /* not lint */ /* @@ -84,12 +84,12 @@ savename(name, len) { register struct namebuf *np; - assert(len >= 0 && len <= (MAXLABEL * 2)); + assert(len >= 0 && len <= (MAXLABEL * 4)); np = (struct namebuf *) malloc(NAMESIZE(len)); if (np == NULL) panic(errno, "savename: malloc"); bzero((char*)np, NAMESIZE(len)); - NAMELEN(*np) = len; + NAMELEN(*np) = (unsigned)len; bcopy(name, NAME(*np), len); NAME(*np)[len] = '\0'; return (np); @@ -99,28 +99,16 @@ savename(name, len) * Allocate a data buffer & save data. */ struct databuf * -#ifdef DMALLOC -savedata_tagged(file, line, class, type, ttl, data, size) - char *file; - int line; -#else savedata(class, type, ttl, data, size) -#endif int class, type; u_int32_t ttl; u_char *data; int size; { register struct databuf *dp; - int bytes = (type == T_NS) ? DATASIZE(size)+INT32SZ : DATASIZE(size); + int bytes = DATASIZE(size); - dp = (struct databuf *) -#ifdef DMALLOC - dmalloc(file, line, bytes) -#else - malloc(bytes) -#endif - ; + dp = (struct databuf *)malloc(bytes); if (dp == NULL) panic(errno, "savedata: malloc"); bzero((char*)dp, bytes); @@ -129,7 +117,6 @@ savedata(class, type, ttl, data, size) dp->d_class = class; dp->d_ttl = ttl; dp->d_size = size; - dp->d_mark = 0; dp->d_flags = 0; dp->d_cred = 0; dp->d_clev = 0; diff --git a/contrib/bind/named/db_update.c b/contrib/bind/named/db_update.c index c706c66..bacc7f7 100644 --- a/contrib/bind/named/db_update.c +++ b/contrib/bind/named/db_update.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)db_update.c 4.28 (Berkeley) 3/21/91"; -static char rcsid[] = "$Id: db_update.c,v 8.12 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: db_update.c,v 8.18 1996/10/08 04:51:03 vixie Exp $"; #endif /* not lint */ /* @@ -72,8 +72,6 @@ static char rcsid[] = "$Id: db_update.c,v 8.12 1996/08/05 08:31:30 vixie Exp $"; #include "named.h" static void fixttl __P((struct databuf *)); -static int db_cmp __P((struct databuf *, - struct databuf *)); /* int * isRefByNS(name, htp) @@ -218,6 +216,7 @@ db_update(name, odp, newdp, flags, htp) register struct databuf *dp, *pdp; register struct namebuf *np; int zn, isHintNS; + int check_ttl = 0; const char *fname; dprintf(3, (ddt, "db_update(%s, 0x%lx, 0x%lx, 0%o, 0x%lx)%s\n", @@ -226,6 +225,9 @@ db_update(name, odp, newdp, flags, htp) np = nlookup(name, &htp, &fname, newdp != NULL); if (np == NULL || fname != name) return (NONAME); + + if (newdp && zones[newdp->d_zone].z_type == Z_PRIMARY) + check_ttl = 1; /* don't let nonauthoritative updates write in authority zones */ if (newdp && ((zn = findMyZone(np, newdp->d_class)) != DB_Z_CACHE) && @@ -312,7 +314,7 @@ db_update(name, odp, newdp, flags, htp) != OK) { dprintf(3, (ddt, "db_update: hint %lx freed\n", (u_long)dp)); - (void) free((char *)dp); + db_free(dp); } } @@ -325,10 +327,18 @@ db_update(name, odp, newdp, flags, htp) /* {class,type} doesn't match. these are * the aggregation cases. */ - if ((dp->d_type == T_CNAME || - odp->d_type == T_CNAME) && + /* Check that CNAMEs are only accompanied by + * Secure DNS RR's (KEY, SIG, and NXT). + */ + if (((dp->d_type == T_CNAME && + odp->d_type != T_KEY && + odp->d_type != T_SIG && + odp->d_type != T_NXT) || + (odp->d_type == T_CNAME && + dp->d_type != T_KEY && + dp->d_type != T_SIG && + dp->d_type != T_NXT)) && odp->d_class == dp->d_class && - odp->d_mark == dp->d_mark && #ifdef NCACHE /* neither the odp nor the new dp are * negatively cached records... @@ -338,7 +348,7 @@ db_update(name, odp, newdp, flags, htp) #endif /*NCACHE*/ zones[odp->d_zone].z_type != Z_CACHE) { syslog(LOG_INFO, - "%s has CNAME and other data (illegal)\n", + "%s has CNAME and other data (invalid)\n", name); goto skip; } @@ -520,6 +530,19 @@ db_update(name, odp, newdp, flags, htp) !bcmp(dp->d_data, newdp->d_data, INT32SZ + sizeof(u_char))) goto delete; + if (check_ttl) { + if (newdp->d_ttl != dp->d_ttl) + syslog(LOG_WARNING, + "%s %s %s differing ttls: corrected", + name[0]?name:".", + p_class(dp->d_class), + p_type(dp->d_type)); + if (newdp->d_ttl > dp->d_ttl) { + newdp->d_ttl = dp->d_ttl; + } else { + dp->d_ttl = newdp->d_ttl; + } + } } if ((flags & DB_NODATA) && !db_cmp(dp, odp)) { /* refresh ttl if cache entry */ @@ -552,6 +575,10 @@ db_update(name, odp, newdp, flags, htp) if (odp->d_size > 0) if (db_cmp(dp, odp)) goto skip; + if (odp->d_clev < dp->d_clev) + goto skip; + if (odp->d_cred < dp->d_cred) + goto skip; foundRR = 1; if (flags & DB_DELETE) { delete: dp = rm_datum(dp, np, pdp); @@ -588,9 +615,10 @@ db_update(name, odp, newdp, flags, htp) /* Add to end of list, generally preserving order */ newdp->d_next = NULL; if ((dp = np->n_data) == NULL) { -#ifdef DATUMREFCNT newdp->d_rcnt = 1; -#endif + if (newdp->d_flags & DB_F_ACTIVE) + panic(-1, "db_update: DB_F_ACTIVE set"); + newdp->d_flags |= DB_F_ACTIVE; np->n_data = newdp; return (OK); } @@ -601,9 +629,10 @@ db_update(name, odp, newdp, flags, htp) } if ((flags & DB_NODATA) && !db_cmp(dp, newdp)) return (DATAEXISTS); -#ifdef DATUMREFCNT newdp->d_rcnt = 1; -#endif + if (newdp->d_flags & DB_F_ACTIVE) + panic(-1, "db_update: DB_F_ACTIVE set"); + newdp->d_flags |= DB_F_ACTIVE; dp->d_next = newdp; return (OK); } @@ -628,7 +657,7 @@ fixttl(dp) * Must be case insensitive for some domain names. * Return 0 if equivalent, nonzero otherwise. */ -static int +int db_cmp(dp1, dp2) register struct databuf *dp1, *dp2; { @@ -639,8 +668,6 @@ db_cmp(dp1, dp2) return (1); if (dp1->d_size != dp2->d_size) return (1); - if (dp1->d_mark != dp2->d_mark) - return (1); /* old and new RR's are distinct */ #ifdef NCACHE if (dp1->d_rcode && dp2->d_rcode) return ((dp1->d_rcode == dp1->d_rcode)?0:1); @@ -650,6 +677,8 @@ db_cmp(dp1, dp2) switch (dp1->d_type) { + case T_SIG: + case T_KEY: case T_A: case T_UID: case T_GID: @@ -705,13 +734,64 @@ db_cmp(dp1, dp2) cp2 += strlen((char *)cp2) + 1; return (bcmp(cp1, cp2, INT32SZ * 5)); + case T_NAPTR: { + int t1,t2; + + if (dp1->d_size != dp2->d_size) + return (1); + cp1 = dp1->d_data; + cp2 = dp2->d_data; + + /* Order */ + if (*cp1++ != *cp2++ || *cp1++ != *cp2++) + return (1); + + /* Preference */ + if (*cp1++ != *cp2++ || *cp1++ != *cp2++) + return (1); + + /* Flags */ + t1 = *cp1++; t2 = *cp2++; + if (t1 != t2 || bcmp(cp1, cp2, t1)) + return (1); + cp1 += t1; cp2 += t2; + + /* Services */ + t1 = *cp1++; t2 = *cp2++; + if (t1 != t2 || bcmp(cp1, cp2, t1)) + return (1); + cp1 += t1; cp2 += t2; + + /* Regexp */ + t1 = *cp1++; t2 = *cp2++; + if (t1 != t2 || bcmp(cp1, cp2, t1)) + return (1); + cp1 += t1; cp2 += t2; + + /* Replacement */ + t1 = strlen((char *)cp1); t2 = strlen((char *)cp2); + if (t1 != t2 || bcmp(cp1, cp2, t1)) + return (1); + cp1 += t1 + 1; cp2 += t2 + 1; + + /* they all checked out! */ + return (0); + } + case T_MX: case T_AFSDB: case T_RT: + case T_SRV: cp1 = dp1->d_data; cp2 = dp2->d_data; if (*cp1++ != *cp2++ || *cp1++ != *cp2++) /* cmp prio */ return (1); + if (dp1->d_type == T_SRV) { + if (*cp1++ != *cp2++ || *cp1++ != *cp2++) /* weight */ + return (1); + if (*cp1++ != *cp2++ || *cp1++ != *cp2++) /* port */ + return (1); + } return (strcasecmp((char *)cp1, (char *)cp2)); case T_PX: diff --git a/contrib/bind/named/named-xfer.c b/contrib/bind/named/named-xfer.c index b71ebfb..1772b84 100644 --- a/contrib/bind/named/named-xfer.c +++ b/contrib/bind/named/named-xfer.c @@ -58,6 +58,28 @@ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * --Copyright-- */ @@ -70,7 +92,7 @@ char copyright[] = #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)named-xfer.c 4.18 (Berkeley) 3/7/91"; -static char rcsid[] = "$Id: named-xfer.c,v 8.15 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: named-xfer.c,v 8.22 1996/12/02 09:17:21 vixie Exp $"; #endif /* not lint */ #include <sys/types.h> @@ -347,8 +369,7 @@ main(argc, argv) (void) signal(SIGFPE, SIG_IGN); #endif /* SIGUSR1&&SIGUSR2 */ - dprintf(1, (ddt, - "domain `%s'; file `%s'; serial %lu; closed %d\n", + dprintf(1, (ddt, "domain `%s'; file `%s'; serial %lu; closed %d\n", domain, dbfile, (u_long)serial_no, closed)); buildservicelist(); @@ -425,20 +446,16 @@ main(argc, argv) (void) unlink(tmpname); exit(XFER_UPTODATE); + default: + result = XFER_FAIL; + /* fall through */ case XFER_TIMEOUT: -#ifdef DEBUG - if (!debug) -#endif - (void) unlink(tmpname); - exit(XFER_TIMEOUT); /* servers not reachable exit */ - case XFER_FAIL: - default: #ifdef DEBUG if (!debug) #endif (void) unlink(tmpname); - exit(XFER_FAIL); /* yuck exit */ + exit(result); /* error or timeout */ } /*NOTREACHED*/ } @@ -663,6 +680,7 @@ getzone(zp, serial_no, port) goto tryagain; } #endif +#ifndef ultrix syslog(LOG_NOTICE, "[%s] %s for %s, SOA query got rcode %d, aa %d, ancount %d, aucount %d", inet_ntoa(sin.sin_addr), @@ -671,6 +689,7 @@ getzone(zp, serial_no, port) : "not authoritative"), zp->z_origin[0] != '\0' ? zp->z_origin : ".", hp->rcode, hp->aa, ancount, aucount); +#endif error++; (void) my_close(s); continue; @@ -711,13 +730,40 @@ getzone(zp, serial_no, port) (void) my_close(s); continue; } - /* ... Answer Section. */ - n = dn_expand(buf, eom, tmp, name2, sizeof name2); - if (n < 0) { - badsoa_msg = "aname error"; - goto badsoa; - } - tmp += n; + /* ... Answer Section. + * We may have to loop a little, to bypass SIG SOA's in + * the response. + */ + do { + u_char *cp4; + u_short type, class, dlen; + u_long ttl; + + n = dn_expand(buf, eom, tmp, name2, sizeof name2); + if (n < 0) { + badsoa_msg = "aname error"; + goto badsoa; + } + tmp += n; + + /* Are type, class, and ttl OK? */ + cp4 = tmp; /* Leave tmp pointing to type field */ + if (eom - cp4 < 3 * INT16SZ + INT32SZ) { + badsoa_msg = "zinfo too short"; + goto badsoa; + } + GETSHORT(type, cp4); + GETSHORT(class, cp4); + GETLONG(ttl, cp4); + GETSHORT(dlen, cp4); + if (type == T_SOA) + break; + /* Skip to next record, if any. */ + dprintf (1, (ddt, "skipping %s %s RR in response\n", + name2, p_type (type))); + tmp = cp4 + dlen; + } while (1); + if (strcasecmp(zp->z_origin, name2) != 0) { syslog(LOG_INFO, "wrong answer in resp from [%s], zone %s: [%s %s %s]\n", @@ -860,24 +906,34 @@ getzone(zp, serial_no, port) #ifdef STUBS if (zp->z_type == Z_STUB) { ancount = ntohs(hp->ancount); - for (cnt = 0 ; cnt < ancount ; cnt++) { - + for (n = cnt = 0 ; cnt < ancount ; cnt++) { n = print_output(buf, bufsize, cp); + if (n < 0) + break; cp += n; } - if (hp->nscount) { + if (n >= 0 && hp->nscount) { /* we should not get here */ ancount = ntohs(hp->nscount); for (cnt = 0 ; cnt < ancount ; cnt++) { n = print_output(buf, bufsize, cp); - cp += n; + if (n < 0) + break; + cp += n; } } ancount = ntohs(hp->arcount); - for (cnt = 0 ; cnt < ancount ; cnt ++) { + for (cnt = 0 ; n >= 0 && cnt < ancount ; cnt++) { n = print_output(buf, bufsize, cp); cp += n; } + if (n < 0) { + syslog(LOG_INFO, + "print_output: unparseable answer (%d), zone %s", + hp->rcode, zp->z_origin); + error++; + break; + } if (cp != eom) { syslog(LOG_INFO, "print_output: short answer (%d, %d), zone %s", @@ -889,10 +945,19 @@ getzone(zp, serial_no, port) } else { #endif /*STUBS*/ ancount = ntohs(hp->ancount); - for (cnt = 0; cnt < ancount; cnt++) { + for (n = cnt = 0; cnt < ancount; cnt++) { n = print_output(buf, bufsize, cp); + if (n < 0) + break; cp += n; } + if (n < 0) { + syslog(LOG_INFO, + "print_output: unparseable answer (%d), zone %s", + hp->rcode, zp->z_origin); + error++; + break; + } if (cp != eom) { syslog(LOG_INFO, "print_output: short answer (%d, %d), zone %s", @@ -1029,7 +1094,7 @@ getzone(zp, serial_no, port) #else (void) sigvec(SIGALRM, &osv, (struct sigvec *)0); #endif - if (error) + if (!error) return (XFER_TIMEOUT); return (XFER_FAIL); } @@ -1162,7 +1227,8 @@ print_output(msg, msglen, rrp) int i, j, tab, result, class, type, dlen, n1, n; char data[BUFSIZ]; u_char *cp1, *cp2, *temp_ptr; - char *cdata, *origin, *proto, dname[MAXDNAME]; + u_char *cdata; + char *origin, *proto, dname[MAXDNAME]; char *ignore = ""; cp = rrp; @@ -1187,6 +1253,11 @@ print_output(msg, msglen, rrp) dname, type, class, ttl)); /* * Convert the resource record data into the internal database format. + * CP points to the raw resource record. + * After this switch: + * CP has been updated to point past the RR. + * CP1 points to the internal database version. + * N is the length of the internal database version. */ switch (type) { case T_A: @@ -1201,6 +1272,7 @@ print_output(msg, msglen, rrp) case T_AAAA: case T_UID: case T_GID: + case T_KEY: cp1 = cp; n = dlen; cp += n; @@ -1255,14 +1327,59 @@ print_output(msg, msglen, rrp) cp1 = (u_char *)data; break; + case T_NAPTR: + /* Grab weight and port. */ + bcopy(cp, data, INT16SZ*2); + cp1 = (u_char *) (data + INT16SZ*2); + cp += INT16SZ*2; + + /* Flags */ + n = *cp++; + *cp1++ = n; + bcopy(cp, cp1, n); + cp += n; cp1 += n; + + /* Service */ + n = *cp++; + *cp1++ = n; + bcopy(cp, cp1, n); + cp += n; cp1 += n; + + /* Regexp */ + n = *cp++; + *cp1++ = n; + bcopy(cp, cp1, n); + cp += n; cp1 += n; + + /* Replacement */ + n = dn_expand(msg, msg + msglen, cp, (char *)cp1, + sizeof data - ((char *)cp1 - data)); + if (n < 0) + return (-1); + cp += n; + + /* compute end of data */ + cp1 += strlen((char *)cp1) + 1; + /* compute size of data */ + n = cp1 - (u_char *)data; + cp1 = (u_char *)data; + break; + case T_MX: case T_AFSDB: case T_RT: + case T_SRV: /* grab preference */ bcopy((char *)cp, data, INT16SZ); cp1 = (u_char *)data + INT16SZ; cp += INT16SZ; + if (type == T_SRV) { + bcopy((char *)cp, data, INT16SZ*2); + cp1 += INT16SZ*2; + cp += INT16SZ*2; + } + /* get name */ n = dn_expand(msg, msg + msglen, cp, (char *)cp1, sizeof data - INT16SZ); @@ -1302,12 +1419,46 @@ print_output(msg, msglen, rrp) cp1 = (u_char *)data; break; + case T_SIG: + /* CP is the raw resource record as it arrived. + * CP1, after this switch, points to the internal database version. */ + cp1 = (u_char *)data; + + /* first just copy over the type_covered, algorithm, */ + /* labels, orig ttl, two timestamps, and the footprint */ + bcopy( cp, cp1, 18 ); + cp += 18; + cp1 += 18; + + /* then the signer's name */ + n = dn_expand(msg, msg + msglen, cp, + (char *)cp1, (sizeof data) - 18); + if (n < 0) + return (-1); + cp += n; + cp1 += strlen((char*)cp1)+1; + + /* finally, we copy over the variable-length signature. + Its size is the total data length, minus what we copied. */ + n = dlen - (18 + n); + if (n > (sizeof data) - (cp1 - (u_char *)data)) + return (-1); /* out of room! */ + bcopy(cp, cp1, n); + cp += n; + cp1 += n; + + /* compute size of data */ + n = cp1 - (u_char *)data; + cp1 = (u_char *)data; + break; + default: syslog(LOG_INFO, "\"%s %s %s\" - unknown type (%d)", dname, p_class(class), p_type(type), type); hp->rcode = NOTIMP; return (-1); } + if (n > MAXDATA) { dprintf(1, (ddt, "update type %d: %d bytes is too much data\n", @@ -1315,7 +1466,7 @@ print_output(msg, msglen, rrp) hp->rcode = FORMERR; return (-1); } - cdata = (char *) cp1; + cdata = cp1; result = cp - rrp; /* @@ -1424,7 +1575,7 @@ print_output(msg, msglen, rrp) (void) putc('\t', dbfp); (void) fprintf(dbfp, "%s\t%s\t", p_class(class), p_type(type)); - cp = (u_char *) cdata; + cp = cdata; /* * Print type specific data @@ -1455,7 +1606,7 @@ print_output(msg, msglen, rrp) break; case T_NS: - cp = (u_char *) cdata; + cp = cdata; if (cp[0] == '\0') (void) fprintf(dbfp, ".\t"); else @@ -1528,8 +1679,8 @@ print_output(msg, msglen, rrp) case T_TXT: case T_X25: cp1 = cp + n; - (void) putc('"', dbfp); while (cp < cp1) { + (void) putc('"', dbfp); if (i = *cp++) { for (j = i; j > 0 && cp < cp1; j--) { if (strchr("\n\"\\", *cp)) @@ -1537,8 +1688,11 @@ print_output(msg, msglen, rrp) (void) putc(*cp++, dbfp); } } + (void) putc('"', dbfp); + if (cp < cp1) + (void) putc(' ', dbfp); } - (void) fputs("\"\n", dbfp); + (void) putc('\n', dbfp); break; case T_NSAP: @@ -1550,17 +1704,65 @@ print_output(msg, msglen, rrp) fprintf(dbfp, "%s\n", inet_ntop(AF_INET6, cp, t, sizeof t)); break; - } + } case T_UINFO: (void) fprintf(dbfp, "\"%s\"\n", cp); break; #ifdef LOC_RR - case T_LOC: - (void) fprintf(dbfp, "%s\n", loc_ntoa(cp, NULL)); + case T_LOC: { + char t[255]; + + (void) fprintf(dbfp, "%s\n", loc_ntoa(cp, t)); break; + } #endif /* LOC_RR */ + case T_NAPTR: { + u_int order, preference; + + /* Order */ + GETSHORT(order, cp); + fprintf(dbfp, "%lu", (u_long)order); + + /* Preference */ + GETSHORT(preference, cp); + fprintf(dbfp, " %lu", (u_long)preference); + + /* Flags */ + if (n = *cp++) { + fprintf(dbfp, " \"%.*s\"", (int)n, cp); + cp += n; + } + + /* Service */ + if (n = *cp++) { + fprintf(dbfp, " \"%.*s\"", (int)n, cp); + cp += n; + } + + /* Regexp */ + if (n = *cp++) { + fprintf(dbfp, " \"%.*s\"", (int)n, cp); + cp += n; + } + + /* Replacement */ + fprintf(dbfp, " %s.\n", cp); + + break; + } + case T_SRV: { + u_int priority, weight, port; + + GETSHORT(priority, cp); + GETSHORT(weight, cp); + GETSHORT(port, cp); + fprintf(dbfp, "\t%u %u %u %s.\n", + priority, weight, port, cp); + break; + } + case T_UID: case T_GID: if (n == INT32SZ) { @@ -1578,7 +1780,7 @@ print_output(msg, msglen, rrp) cp += sizeof(char); (void) fprintf(dbfp, "%s ", proto); i = 0; - while (cp < (u_char *) cdata + n) { + while (cp < cdata + n) { j = *cp++; do { if (j & 0200) @@ -1597,7 +1799,76 @@ print_output(msg, msglen, rrp) (void) fprintf(dbfp, " %s.\n", cp); break; + case T_KEY: { + char databuf[16+MAX_KEY_BASE64]; /* 16 for slop */ + u_int16_t keyflags; + + /* get & format key flags */ + keyflags = _getshort(cp); + (void) fprintf(dbfp, "0x%04x ", keyflags); + cp += INT16SZ; + + /* protocol id */ + (void) fprintf(dbfp, " %u", *cp++); + + /* algorithm id */ + (void) fprintf(dbfp, " %u ", *cp++); + + /* key itself (which may have zero length) */ + n = b64_ntop(cp, (cp1 + n) - cp, databuf, sizeof databuf); + if (n < 0) + fprintf(dbfp, "; BAD BASE64\n"); + else + fprintf(dbfp, "%s\n", databuf); + break; + } + + case T_SIG: { + char databuf[16+MAX_KEY_BASE64]; /* 16 for slop */ + + /* get & format rr type which signature covers */ + (void) fprintf(dbfp,"%s", p_type(_getshort((u_char*)cp))); + cp += INT16SZ; + + /* algorithm id */ + (void) fprintf(dbfp," %d",*cp++); + + /* labels (# of labels in name) - skip in textual record */ + cp++; + + /* orig time to live (TTL)) */ + (void) fprintf(dbfp," %d", _getlong((u_char*)cp)); + cp += INT32SZ; + + /* expiration time */ + (void) fprintf(dbfp," %s", p_secstodate(_getlong((u_char*)cp))); + cp += INT32SZ; + + /* time signed */ + (void) fprintf(dbfp," %s", p_secstodate(_getlong((u_char*)cp))); + cp += INT32SZ; + + /* Key footprint */ + (void) fprintf(dbfp," %d", _getshort((u_char*)cp)); + cp += INT16SZ; + + /* signer's name */ + (void) fprintf(dbfp, " %s. ", cp); + cp += strlen((char *) cp) + 1; + + /* signature itself */ + n = b64_ntop(cp, (cdata + n) - cp, databuf, sizeof databuf); + if (n < 0) + fprintf (dbfp, "; BAD BASE64\n"); + else + fprintf (dbfp, "%s\n", databuf); + break; + } + default: + cp1 = cp + n; + while (cp < cp1) + fprintf(dbfp, "0x%02.2X ", *cp++ & 0xFF); (void) fprintf(dbfp, "???\n"); } if (ferror(dbfp)) { diff --git a/contrib/bind/named/ns_defs.h b/contrib/bind/named/ns_defs.h index 6bd10e5..05c4a39 100644 --- a/contrib/bind/named/ns_defs.h +++ b/contrib/bind/named/ns_defs.h @@ -1,6 +1,6 @@ /* * from ns.h 4.33 (Berkeley) 8/23/90 - * $Id: ns_defs.h,v 8.6 1996/05/17 09:10:46 vixie Exp $ + * $Id: ns_defs.h,v 8.8 1996/09/22 00:13:10 vixie Exp $ */ /* @@ -167,13 +167,8 @@ struct notify { #define Z_INCLUDE 0x0080 /* set if include used in file */ #define Z_DB_BAD 0x0100 /* errors when loading file */ #define Z_TMP_FILE 0x0200 /* backup file for xfer is temporary */ -#ifdef ALLOW_UPDATES -#define Z_DYNAMIC 0x0400 /* allow dynamic updates */ -#define Z_DYNADDONLY 0x0800 /* dynamic mode: add new data only */ -#define Z_CHANGED 0x1000 /* zone has changed */ -#endif /* ALLOW_UPDATES */ -#define Z_XFER_ABORTED 0x2000 /* zone transfer has been aborted */ -#define Z_XFER_GONE 0x4000 /* zone transfer process is gone */ +#define Z_XFER_ABORTED 0x0400 /* zone transfer has been aborted */ +#define Z_XFER_GONE 0x0800 /* zone transfer process is gone */ /* named_xfer exit codes */ #define XFER_UPTODATE 0 /* zone is up-to-date */ @@ -224,9 +219,10 @@ struct qinfo { int16_t q_nqueries; /* # of queries required */ struct qstream *q_stream; /* TCP stream, null if UDP */ struct zoneinfo *q_zquery; /* Zone query is about (Q_ZSERIAL) */ -#if defined(LAME_DELEGATION) || defined(VALIDATE) - char q_domain[MAXDNAME]; /* domain for servers we are querying */ -#endif + char *q_domain; /* domain of most enclosing zone cut */ + char *q_name; /* domain of query */ + u_int16_t q_class; /* class of query */ + u_int16_t q_type; /* type of query */ #ifdef BIND_NOTIFY int q_notifyzone; /* zone which needs a sysnotify() * when the reply to this comes in. diff --git a/contrib/bind/named/ns_forw.c b/contrib/bind/named/ns_forw.c index 362bf8b..f523855 100644 --- a/contrib/bind/named/ns_forw.c +++ b/contrib/bind/named/ns_forw.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)ns_forw.c 4.32 (Berkeley) 3/3/91"; -static char rcsid[] = "$Id: ns_forw.c,v 8.14 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: ns_forw.c,v 8.19 1996/12/02 09:27:36 vixie Exp $"; #endif /* not lint */ /* @@ -83,7 +83,7 @@ static char rcsid[] = "$Id: ns_forw.c,v 8.14 1996/08/05 08:31:30 vixie Exp $"; * (no action is taken on errors and qpp is not filled in.) */ int -ns_forw(nsp, msg, msglen, fp, qsp, dfd, qpp, dname, np) +ns_forw(nsp, msg, msglen, fp, qsp, dfd, qpp, dname, class, type, np) struct databuf *nsp[]; u_char *msg; int msglen; @@ -92,9 +92,11 @@ ns_forw(nsp, msg, msglen, fp, qsp, dfd, qpp, dname, np) int dfd; struct qinfo **qpp; char *dname; + int class, type; struct namebuf *np; { register struct qinfo *qp; + char tmpdomain[MAXDNAME]; struct sockaddr_in *nsa; HEADER *hp; u_int16_t id; @@ -121,16 +123,19 @@ ns_forw(nsp, msg, msglen, fp, qsp, dfd, qpp, dname, np) } } - qp = qnew(); -#if defined(LAME_DELEGATION) || defined(VALIDATE) - getname(np, qp->q_domain, sizeof qp->q_domain); -#endif + qp = qnew(dname, class, type); + getname(np, tmpdomain, sizeof tmpdomain); + qp->q_domain = strdup(tmpdomain); + if (!qp->q_domain) + panic(ENOMEM, "ns_forw: strdup failed"); qp->q_from = *fp; /* nslookup wants to know this */ - if ((n = nslookup(nsp, qp, dname, "ns_forw")) < 0) { + n = nslookup(nsp, qp, dname, "ns_forw"); + if (n < 0) { dprintf(2, (ddt, "forw: nslookup reports danger\n")); qfree(qp); return (FW_SERVFAIL); - } else if (n == 0 && !fwdtab) { + } + if (n == 0 && !fwdtab) { dprintf(2, (ddt, "forw: no nameservers found\n")); qfree(qp); return (FW_NOSERVER); @@ -345,7 +350,7 @@ nslookupComplain(sysloginfo, queryname, complaint, dname, a_rr, nsdp) complaint, dname, print_a ? inet_ntoa(data_inaddr(a_rr->d_data)) : ""); - syslog(LOG_INFO, buf); + syslog(LOG_INFO, "%s", buf); } } @@ -376,7 +381,7 @@ nslookup(nsp, qp, syslogdname, sysloginfo) register struct databuf *dp, *nsdp; register struct qserv *qs; register int n; - register unsigned int i; + register u_int i; struct hashbuf *tmphtp; char *dname; const char *fname; @@ -423,7 +428,7 @@ nslookup(nsp, qp, syslogdname, sysloginfo) * to see if we've got missing glue */ for (; np; np = np_parent(np)) - for (dp = np->n_data; dp; dp=dp->d_next) + for (dp = np->n_data; dp; dp = dp->d_next) if (match(dp, class, T_NS)) { #ifdef NCACHE if (dp->d_rcode) @@ -447,10 +452,7 @@ nslookup(nsp, qp, syslogdname, sysloginfo) found_arr = 0; goto need_sysquery; } else { - static char *complaint = - "Authoritative A RR missing"; - nslookupComplain(sysloginfo, syslogdname, - complaint, dname, dp, nsdp); + /* Authoritative A RR missing. */ continue; } } @@ -458,11 +460,13 @@ nslookup(nsp, qp, syslogdname, sysloginfo) oldn = n; /* look for name server addresses */ - for (dp = np->n_data; dp != NULL; dp = dp->d_next) { + delete_stale(np); + for (dp = np->n_data; dp != NULL; dp = dp->d_next) { struct in_addr nsa; if (dp->d_type == T_CNAME && dp->d_class == class) { - static char *complaint = "NS points to CNAME"; + static const char *complaint = + "NS points to CNAME"; #ifdef NCACHE if (dp->d_rcode) continue; @@ -475,7 +479,7 @@ nslookup(nsp, qp, syslogdname, sysloginfo) continue; #ifdef NCACHE if (dp->d_rcode) { - static char *complaint = + static const char *complaint = "A RR negative cache entry"; nslookupComplain(sysloginfo, syslogdname, complaint, dname, dp, nsdp); @@ -483,7 +487,8 @@ nslookup(nsp, qp, syslogdname, sysloginfo) } #endif if (data_inaddr(dp->d_data).s_addr == INADDR_ANY) { - static char *complaint = "Bogus (0.0.0.0) A RR"; + static const char *complaint = + "Bogus (0.0.0.0) A RR"; nslookupComplain(sysloginfo, syslogdname, complaint, dname, dp, nsdp); continue; @@ -491,26 +496,29 @@ nslookup(nsp, qp, syslogdname, sysloginfo) #ifdef INADDR_LOOPBACK if (ntohl(data_inaddr(dp->d_data).s_addr) == INADDR_LOOPBACK) { - static char *complaint = "Bogus LOOPBACK A RR"; + static const char *complaint = + "Bogus LOOPBACK A RR"; nslookupComplain(sysloginfo, syslogdname, - complaint, dname, dp, nsdp); + complaint, dname, dp, nsdp); continue; } #endif #ifdef INADDR_BROADCAST if (ntohl(data_inaddr(dp->d_data).s_addr) == INADDR_BROADCAST) { - static char *complaint = "Bogus BROADCAST A RR"; + static const char *complaint = + "Bogus BROADCAST A RR"; nslookupComplain(sysloginfo, syslogdname, - complaint, dname, dp, nsdp); + complaint, dname, dp, nsdp); continue; } #endif #ifdef IN_MULTICAST if (IN_MULTICAST(ntohl(data_inaddr(dp->d_data).s_addr))) { - static char *complaint = "Bogus MULTICAST A RR"; + static const char *complaint = + "Bogus MULTICAST A RR"; nslookupComplain(sysloginfo, syslogdname, - complaint, dname, dp, nsdp); + complaint, dname, dp, nsdp); continue; } #endif @@ -520,26 +528,14 @@ nslookup(nsp, qp, syslogdname, sysloginfo) * Never delete our safety-belt information! */ if ((dp->d_zone == 0) && -#ifdef DATUMREFCNT (dp->d_ttl < curtime) && -#else - (dp->d_ttl < (curtime+900)) && -#endif !(dp->d_flags & DB_F_HINT) ) { - dprintf(3, (ddt, - "nslookup: stale entry '%s'\n", - NAME(*np))); - /* Cache invalidate the NS RR's */ -#ifndef DATUMREFCNT - if (dp->d_ttl < curtime) -#endif - { - delete_all(np, class, T_A); - n = oldn; - found_arr = 0; - goto need_sysquery; - } + syslog(LOG_DEBUG, "nslookup: stale '%s'\n", + NAME(*np)); + n = oldn; + found_arr = 0; + goto need_sysquery; } #ifdef VALIDATE /* anant@isi.edu validation procedure, maintains a @@ -635,7 +631,7 @@ nslookup(nsp, qp, syslogdname, sysloginfo) skipserver: NULL; } -out: + out: dprintf(3, (ddt, "nslookup: %d ns addrs total\n", n)); qp->q_naddr = n; if (n == 0 && potential_ns == 0 && !fwdtab) { @@ -648,13 +644,11 @@ out: } return(-1); } -#ifdef DATUMREFCNT - /* must be run before the sort */ - for (i = naddr ; i < n ; i++) { + /* Update the refcounts before the sort. */ + for (i = naddr; i < n; i++) { qp->q_addr[i].nsdata->d_rcnt++; qp->q_addr[i].ns->d_rcnt++; } -#endif if (n > 1) { qsort((char *)qp->q_addr, n, sizeof(struct qserv), (int (*)__P((const void *, const void *)))qcomp); @@ -840,7 +834,7 @@ retry(qp) (u_long)qp, (u_long)qp->q_expire, (int)(tt.tv_sec - qp->q_expire), (u_long)tt.tv_sec)); - if (qp->q_stream) /* return failure code on stream */ + if (qp->q_stream || (qp->q_flags & Q_PRIMING)) goto fail; qremove(qp); return; @@ -970,6 +964,7 @@ qflush() while (nsqhead) qremove(nsqhead); nsqhead = QINFO_NULL; + priming = 0; } void @@ -1005,45 +1000,67 @@ qfindid(id) } struct qinfo * -#ifdef DMALLOC -qnew_tagged(file, line) - char *file; - int line; -#else -qnew() -#endif +qnew(name, class, type) + const char *name; + int class; + int type; { register struct qinfo *qp; - qp = (struct qinfo *) -#ifdef DMALLOC - dcalloc(file, line, 1, sizeof(struct qinfo)); -#else - calloc(1, sizeof(struct qinfo)); -#endif - if (qp == NULL) { - dprintf(5, (ddt, "qnew: calloc error\n")); - syslog(LOG_ERR, "forw: %m"); - exit(12); - } - dprintf(5, (ddt, "qnew(x%lx)\n", (u_long)qp)); + qp = (struct qinfo *)calloc(1, sizeof(struct qinfo)); + if (qp == NULL) + panic(ENOMEM, "qnew: calloc failed"); + dprintf(5, (ddt, "qnew(%#x)\n", qp)); #ifdef BIND_NOTIFY qp->q_notifyzone = DB_Z_CACHE; #endif qp->q_link = nsqhead; nsqhead = qp; + qp->q_name = strdup(name); + if (!qp->q_name) + panic(ENOMEM, "qnew: strdup failed"); + qp->q_class = (u_int16_t)class; + qp->q_type = (u_int16_t)type; return (qp); } void -qfree(qp) +nsfree(qp, where) struct qinfo *qp; + char *where; { - register struct qinfo *np; - register struct databuf *dp; -#ifdef DATUMREFCNT + static const char freed[] = "freed", busy[] = "busy"; + const char *result; + struct databuf *dp; int i; -#endif + + for (i = 0 ; i < (int)qp->q_naddr ; i++) { + dp = qp->q_addr[i].ns; + if (dp) { + result = (--(dp->d_rcnt)) ? busy : freed; + dprintf(1, (ddt, "%s: ns %s rcnt %d (%s)\n", + where, dp->d_data, dp->d_rcnt, result)); + if (result == freed) + db_free(dp); + } + dp = qp->q_addr[i].nsdata; + if (dp) { + result = (--(dp->d_rcnt)) ? busy : freed; + dprintf(1, (ddt, "%s: nsdata %s rcnt %d (%s)\n", + where, inet_ntoa(data_inaddr(dp->d_data)), + dp->d_rcnt, result)); + if (result == freed) + db_free(dp); + } + } +} + +void +qfree(qp) + struct qinfo *qp; +{ + struct qinfo *np; + struct databuf *dp; dprintf(3, (ddt, "Qfree(x%lx)\n", (u_long)qp)); if (qp->q_next) @@ -1053,42 +1070,20 @@ qfree(qp) free(qp->q_msg); if (qp->q_cmsg) free(qp->q_cmsg); -#ifdef DATUMREFCNT - for (i = 0 ; i < (int)qp->q_naddr ; i++) { - dp = qp->q_addr[i].ns; - if (dp) - if (--(dp->d_rcnt)) { - dprintf(3, (ddt, "qfree: ns %s rcnt %d\n", - dp->d_data, - dp->d_rcnt)); - } else { - dprintf(3, (ddt, "qfree: ns %s rcnt %d delayed\n", - dp->d_data, - dp->d_rcnt)); - free((char*)dp); - } - dp = qp->q_addr[i].nsdata; - if (dp) - if ((--(dp->d_rcnt))) { - dprintf(3, (ddt, "qfree: nsdata %08.8X rcnt %d\n", - *(int32_t *)(dp->d_data), - dp->d_rcnt)); - } else { - dprintf(3, (ddt, "qfree: nsdata %08.8X rcnt %d delayed\n", - *(int32_t *)(dp->d_data), - dp->d_rcnt)); - free((char*)dp); - } - } -#endif - if( nsqhead == qp ) { + if (qp->q_domain) + free(qp->q_domain); + if (qp->q_name) + free(qp->q_name); + nsfree(qp, "qfree"); + if (nsqhead == qp) nsqhead = qp->q_link; - } else { - for( np=nsqhead; np->q_link != QINFO_NULL; np = np->q_link ) { - if( np->q_link != qp ) continue; + else { + for (np = nsqhead; np->q_link != QINFO_NULL; np = np->q_link) { + if (np->q_link != qp) + continue; np->q_link = qp->q_link; /* dequeue */ break; } } - free((char *)qp); + free((char*)qp); } diff --git a/contrib/bind/named/ns_func.h b/contrib/bind/named/ns_func.h index 204aee2..aa61381 100644 --- a/contrib/bind/named/ns_func.h +++ b/contrib/bind/named/ns_func.h @@ -1,12 +1,13 @@ /* ns_func.h - declarations for ns_*.c's externally visible functions * - * $Id: ns_func.h,v 8.9 1996/05/20 15:10:01 vixie Exp $ + * $Id: ns_func.h,v 8.13 1996/11/11 06:36:49 vixie Exp $ */ /* ++from ns_resp.c++ */ extern void ns_resp __P((u_char *, int)), prime_cache __P((void)), - delete_all __P((struct namebuf *, int, int)); + delete_all __P((struct namebuf *, int, int)), + delete_stale __P((struct namebuf *)); extern struct qinfo *sysquery __P((const char *, int, int, struct in_addr *, int, int)); extern struct notify *findNotifyPeer __P((const struct zoneinfo *, @@ -55,6 +56,7 @@ extern int ns_forw __P((struct databuf *nsp[], int dfd, struct qinfo **qpp, char *dname, + int class, int type, struct namebuf *np)), haveComplained __P((const char *, const char *)), nslookup __P((struct databuf *nsp[], @@ -68,14 +70,10 @@ extern void schedretry __P((struct qinfo *, time_t)), retry __P((struct qinfo *)), qflush __P((void)), qremove __P((struct qinfo *)), + nsfree __P((struct qinfo *, char *)), qfree __P((struct qinfo *)); extern struct qinfo *qfindid __P((u_int16_t)), -#ifdef DMALLOC - *qnew_tagged __P((void)); -# define qnew() qnew_tagged(__FILE__, __LINE__) -#else - *qnew(); -#endif + *qnew __P((const char *, int, int)); /* --from ns_forw.c-- */ /* ++from ns_main.c++ */ @@ -129,7 +127,9 @@ extern void ns_refreshtime __P((struct zoneinfo *, time_t)), extern enum context ns_ptrcontext __P((const char *owner)); extern enum context ns_ownercontext __P((int type, enum transport)); extern int ns_nameok __P((const char *name, int class, - enum transport, enum context)); + enum transport, enum context, + const char *owner, + struct in_addr source)); extern int ns_wildcard __P((const char *name)); /* --from ns_init.c-- */ @@ -137,6 +137,10 @@ extern int ns_wildcard __P((const char *name)); extern void cache_n_resp __P((u_char *, int)); /* --from ns_ncache.c-- */ +/* ++from ns_udp.c++ */ +extern void ns_udp __P((void)); +/* --from ns_udp.c-- */ + /* ++from ns_stats.c++ */ extern void ns_stats __P((void)); #ifdef XSTATS diff --git a/contrib/bind/named/ns_glob.h b/contrib/bind/named/ns_glob.h index 46abaf7..bf31e33 100644 --- a/contrib/bind/named/ns_glob.h +++ b/contrib/bind/named/ns_glob.h @@ -1,6 +1,6 @@ /* * from ns.h 4.33 (Berkeley) 8/23/90 - * $Id: ns_glob.h,v 8.9 1996/05/20 15:10:01 vixie Exp $ + * $Id: ns_glob.h,v 8.11 1996/11/11 06:36:49 vixie Exp $ */ /* @@ -123,15 +123,6 @@ DECL int needToChkpt INIT(0); /* need to dump statistics */ DECL int needStatsDump INIT(0); -#ifdef ALLOW_UPDATES - /* need to exit (may need to doadump - * first, if database has changed since - * it was last dumped/booted). Gets - * set by shutdown signal handler - * (onintr) - */ -DECL int needToExit INIT(0); -#endif /* ALLOW_UPDATES */ #ifdef XSTATS /* need to exit * set by shutdown signal handler @@ -289,3 +280,5 @@ DECL const char *severity_strings[] = { "ignore", "warn", "fail", NULL } #endif ; + +DECL struct in_addr inaddr_any; /* Inits to 0.0.0.0 */ diff --git a/contrib/bind/named/ns_init.c b/contrib/bind/named/ns_init.c index 3ca8180..8a6fd92 100644 --- a/contrib/bind/named/ns_init.c +++ b/contrib/bind/named/ns_init.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)ns_init.c 4.38 (Berkeley) 3/21/91"; -static char rcsid[] = "$Id: ns_init.c,v 8.17 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: ns_init.c,v 8.24 1996/12/02 09:17:21 vixie Exp $"; #endif /* not lint */ /* @@ -75,7 +75,7 @@ static char rcsid[] = "$Id: ns_init.c,v 8.17 1996/08/05 08:31:30 vixie Exp $"; #undef nsaddr -enum limit { Datasize }; +enum limit { Datasize , Files }; static void zoneinit __P((struct zoneinfo *)), get_forwarders __P((FILE *)), @@ -83,6 +83,7 @@ static void zoneinit __P((struct zoneinfo *)), #ifdef DEBUG content_zone __P((int)), #endif + do_reload __P((char *, int, int)), free_forwarders __P((void)), ns_limit __P((const char *name, int value)), ns_checknames __P((const char *names, @@ -197,6 +198,7 @@ ns_init(bootfile) #ifdef SECURE_ZONES free_netlist(&zp->secure_nets); #endif + do_reload(zp->z_origin, zp->z_type, zp->z_class); syslog(LOG_NOTICE, "Zone \"%s\" was removed", zp->z_origin); free(zp->z_origin); free(zp->z_source); @@ -240,9 +242,6 @@ boot_read(filename, includefile) #endif struct stat f_time; static int tmpnum = 0; /* unique number for tmp zone files */ -#ifdef ALLOW_UPDATES - char *flag; -#endif int slineno; /* Saved global line number. */ int i; @@ -497,29 +496,7 @@ boot_read(filename, includefile) case Z_PRIMARY: source = savestr(buf); -#ifdef ALLOW_UPDATES - if (getword(buf, sizeof(buf), fp, 0)) { - endline(fp); - flag = buf; - while (flag) { - char *cp = strchr(flag, ','); - if (cp) - *cp++ = 0; - if (strcasecmp(flag, "dynamic") == 0) - zp->z_flags |= Z_DYNAMIC; - else if (strcasecmp(flag, "addonly") == 0) - zp->z_flags |= Z_DYNADDONLY; - else { - syslog(LOG_NOTICE, - "%s: line %d: bad flag '%s'\n", - filename, lineno, flag); - } - flag = cp; - } - } -#else /*ALLOW_UPDATES*/ endline(fp); -#endif dprintf(1, (ddt, ", source = %s\n", source)); /* @@ -552,13 +529,8 @@ boot_read(filename, includefile) dprintf(1, (ddt, "reloading zone\n")); if (!db_load(zp->z_source, zp->z_origin, zp, NULL)) zp->z_flags |= Z_AUTH; -#ifdef ALLOW_UPDATES - /* Guarantee calls to ns_maint() */ - zp->z_refresh = maint_interval; -#else zp->z_refresh = 0; /* no maintenance needed */ zp->z_time = 0; -#endif break; case Z_SECONDARY: @@ -603,7 +575,7 @@ boot_read(filename, includefile) if (zp->z_source && (strcmp(source, zp->z_source) || (stat(zp->z_source, &f_time) == -1 || - (zp->z_ftime != f_time.st_mtime)))) { + (zp->z_ftime != f_time.st_mtime)))) { dprintf(1, (ddt, "backup file changed\n")); free(zp->z_source); zp->z_source = NULL; @@ -614,6 +586,11 @@ boot_read(filename, includefile) #else remove_zone(hashtab, zp - zones); #endif + /* + * reload parent so that NS records are + * present during the zone transfer. + */ + do_reload(zp->z_origin, zp->z_type, zp->z_class); } if (zp->z_source) free(source); @@ -693,71 +670,6 @@ zoneinit(zp) } } -#ifdef ALLOW_UPDATES -/* - * Look for the authoritative zone with the longest matching RHS of dname - * and return its zone # or zero if not found. - */ -int -findzone(dname, class) - char *dname; - int class; -{ - char *dZoneName, *zoneName; - int dZoneNameLen, zoneNameLen; - int maxMatchLen = 0; - int maxMatchZoneNum = 0; - int zoneNum; - - dprintf(4, (ddt, "findzone(dname=%s, class=%d)\n", dname, class)); -#ifdef DEBUG - if (debug >= 5) { - fprintf(ddt, "zone dump:\n"); - for (zoneNum = 1; zoneNum < nzones; zoneNum++) - printzoneinfo(zoneNum); - } -#endif - - dZoneName = strchr(dname, '.'); - if (dZoneName == NULL) - dZoneName = ""; /* root */ - else - dZoneName++; /* There is a '.' in dname, so use remainder of - string as the zone name */ - dZoneNameLen = strlen(dZoneName); - for (zoneNum = 1; zoneNum < nzones; zoneNum++) { - if (zones[zoneNum].z_type == Z_NIL) - continue; - zoneName = (zones[zoneNum]).z_origin; - zoneNameLen = strlen(zoneName); - /* The zone name may or may not end with a '.' */ - if (zoneName[zoneNameLen - 1] == '.') - zoneNameLen--; - if (dZoneNameLen != zoneNameLen) - continue; - dprintf(5, (ddt, "about to strncasecmp('%s', '%s', %d)\n", - dZoneName, zoneName, dZoneNameLen)); - if (strncasecmp(dZoneName, zoneName, dZoneNameLen) == 0) { - dprintf(5, (ddt, "match\n")); - /* - * See if this is as long a match as any so far. - * Check if "<=" instead of just "<" so that if - * root domain (whose name length is 0) matches, - * we use it's zone number instead of just 0 - */ - if (maxMatchLen <= zoneNameLen) { - maxMatchZoneNum = zoneNum; - maxMatchLen = zoneNameLen; - } - } else { - dprintf(5, (ddt, "no match\n")); - } - } - dprintf(4, (ddt, "findzone: returning %d\n", maxMatchZoneNum)); - return (maxMatchZoneNum); -} -#endif /* ALLOW_UPDATES */ - static void get_forwarders(fp) FILE *fp; @@ -881,6 +793,75 @@ find_zone(name, type, class) return NULL; } +static void +do_reload(domain, type, class) + char *domain; + int type; + int class; +{ + char *s; + struct zoneinfo *zp; + + dprintf(1, (ddt, "do_reload: %s %d %d\n", + *domain ? domain : ".", type, class)); + + /* the zone has changed type? */ + /* NOTE: we still exist so don't match agains ourselves */ + /* If we are a STUB or SECONDARY check that we have loaded */ + if (((type != Z_STUB) && (zp = find_zone(domain, Z_STUB, class)) && + zp->z_serial) || + ((type != Z_CACHE) && find_zone(domain, Z_CACHE, class)) || + ((type != Z_PRIMARY) && find_zone(domain, Z_PRIMARY, class)) || + ((type != Z_SECONDARY) + && (zp = find_zone(domain, Z_SECONDARY, class)) && zp->z_serial) + ) { + return; + } + + while ((s = strchr(domain, '.')) || *domain) { + if (s) + domain = s + 1; /* skip dot */ + else + domain = ""; /* root zone */ + + if ((zp = find_zone(domain, Z_STUB, class)) || + (zp = find_zone(domain, Z_CACHE, class)) || + (zp = find_zone(domain, Z_PRIMARY, class)) || + (zp = find_zone(domain, Z_SECONDARY, class))) { + + dprintf(1, (ddt, "do_reload: matched %s\n", + *domain ? domain : ".")); + +#ifdef CLEANCACHE + if (zp->z_type == Z_CACHE) + remove_zone(fcachetab, 0, 1); + else + remove_zone(hashtab, zp - zones, 1); +#else + if (zp->z_type == Z_CACHE) + remove_zone(fcachetab, 0); + else + remove_zone(hashtab, zp - zones); +#endif + zp->z_flags &= ~Z_AUTH; + + switch (zp->z_type) { + case Z_SECONDARY: + case Z_STUB: + zoneinit(zp); + break; + case Z_PRIMARY: + case Z_CACHE: + if (db_load(zp->z_source, zp->z_origin, zp, 0) + == 0) + zp->z_flags |= Z_AUTH; + break; + } + break; + } + } +} + #ifdef DEBUG /* prints out the content of zones */ static void @@ -906,6 +887,8 @@ ns_limit(name, value) max_xfers_per_ns = value; } else if (!strcasecmp(name, "datasize")) { ns_rlimit("datasize", Datasize, value); + } else if (!strcasecmp(name, "files")) { + ns_rlimit("files", Files, value); } else { syslog(LOG_ERR, "error: unrecognized limit in bootfile: \"%s\"", @@ -985,7 +968,7 @@ ns_ownercontext(type, transport) context = hostname_ctx; break; default: - abort(); + panic(-1, "impossible condition in ns_ownercontext()"); } break; case T_MB: @@ -999,14 +982,16 @@ ns_ownercontext(type, transport) } int -ns_nameok(name, class, transport, context) +ns_nameok(name, class, transport, context, owner, source) const char *name; int class; enum transport transport; enum context context; + struct in_addr source; + const char *owner; { - int ok = 1; enum severity severity = checkname_severity[transport]; + int ok; if (severity == ignore) return (1); @@ -1024,17 +1009,44 @@ ns_nameok(name, class, transport, context) ok = res_hnok(name); break; default: - abort(); + panic(-1, "impossible condition in ns_nameok()"); } if (!ok) { + char *s, *o; + + if (source.s_addr == INADDR_ANY) + s = strdup(transport_strings[transport]); + else { + s = malloc(strlen(transport_strings[transport]) + + sizeof " from [000.000.000.000]"); + if (s) + sprintf(s, "%s from [%s]", + transport_strings[transport], + inet_ntoa(source)); + } + if (strcasecmp(owner, name) == 0) + o = strdup(""); + else { + const char *t = (*owner == '\0') ? "." : owner; + + o = malloc(strlen(t) + sizeof " (owner \"\")"); + if (o) + sprintf(o, " (owner \"%s\")", t); + } +#ifndef ultrix syslog((transport == response_trans) ? LOG_INFO : LOG_NOTICE, - "%s name \"%s %s\" (%s) is invalid - %s", + "%s name \"%s\"%s %s (%s) is invalid - %s", context_strings[context], - name, p_class(class), - transport_strings[transport], + name, o != NULL ? o : "[malloc failed]", p_class(class), + s != NULL ? s : "[malloc failed]", (severity == fail) ? "rejecting" : "proceeding anyway"); +#endif if (severity == warn) ok = 1; + if (s) + free(s); + if (o) + free(o); } return (ok); } @@ -1062,14 +1074,25 @@ ns_rlimit(name, limit, value) name); #else struct rlimit limits; - int rlimit; + int rlimit = -1; switch (limit) { case Datasize: rlimit = RLIMIT_DATA; break; + case Files: +#ifdef RLIMIT_NOFILE + rlimit = RLIMIT_NOFILE; +#endif + break; default: - abort(); + panic(-1, "impossible condition in ns_rlimit()"); + } + if (rlimit == -1) { + syslog(LOG_WARNING, + "limit \"%s\" not supported on this system - ignored", + name); + return; } if (getrlimit(rlimit, &limits) < 0) { syslog(LOG_WARNING, "getrlimit(%s): %m", name); diff --git a/contrib/bind/named/ns_main.c b/contrib/bind/named/ns_main.c index bac7d5a..6fff4cc 100644 --- a/contrib/bind/named/ns_main.c +++ b/contrib/bind/named/ns_main.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)ns_main.c 4.55 (Berkeley) 7/1/91"; -static char rcsid[] = "$Id: ns_main.c,v 8.17 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: ns_main.c,v 8.24 1996/11/26 10:11:22 vixie Exp $"; #endif /* not lint */ /* @@ -173,13 +173,6 @@ main(argc, argv, envp) int rfd, size, len; time_t lasttime, maxctime; u_char buf[BUFSIZ]; -#ifdef POSIX_SIGNALS - struct sigaction sact; -#else -#ifndef SYSV - struct sigvec vec; -#endif -#endif #ifdef NeXT int old_sigmask; #endif @@ -196,6 +189,9 @@ main(argc, argv, envp) #ifdef IP_OPTIONS u_char ip_opts[50]; /* arbitrary size */ #endif +#ifdef RLIMIT_NOFILE + struct rlimit rl; +#endif local_ns_port = ns_port = htons(NAMESERVER_PORT); @@ -304,7 +300,10 @@ main(argc, argv, envp) n = 0; #if defined(DEBUG) && defined(LOG_PERROR) if (debug) - n = LOG_PERROR; + n |= LOG_PERROR; +#endif +#ifdef LOG_NOWAIT + n |= LOG_NOWAIT; #endif #ifdef LOG_DAEMON openlog("named", LOG_PID|LOG_CONS|LOG_NDELAY|n, LOGFAC); @@ -312,6 +311,14 @@ main(argc, argv, envp) openlog("named", LOG_PID); #endif +#ifdef RLIMIT_NOFILE + rl.rlim_cur = rl.rlim_max = FD_SETSIZE; + if (setrlimit(RLIMIT_NOFILE, &rl) == -1) + syslog(LOG_ERR, "setrlimit(RLIMIT_FSIZE,FD_SETSIZE): %m"); +#endif + /* check that udp checksums are on */ + ns_udp(); + #ifdef WANT_PIDFILE /* tuck my process id away */ #ifdef PID_FIX @@ -344,10 +351,21 @@ main(argc, argv, envp) ** Open stream port. */ for (n = 0; ; n++) { + int fd; if ((vs = socket(AF_INET, SOCK_STREAM, 0)) < 0) { syslog(LOG_ERR, "socket(SOCK_STREAM): %m"); exit(1); } +#ifdef F_DUPFD + /* + * leave a space for stdio to work in + */ + if ((fd = fcntl(vs, F_DUPFD, 20)) != -1) { + close(vs); + vs = fd; + } else + syslog(LOG_NOTICE, "fcntl(vs, F_DUPFD, 20): %m"); +#endif if (setsockopt(vs, SOL_SOCKET, SO_REUSEADDR, (char *)&on, sizeof(on)) != 0) { @@ -395,6 +413,7 @@ main(argc, argv, envp) setsignal(SIGIOT, -1, setstatsflg); setsignal(SIGUSR1, -1, setIncrDbgFlg); setsignal(SIGUSR2, -1, setNoDbgFlg); + setsignal(SIGHUP, -1, onhup); #if defined(SIGWINCH) && defined(QRYLOG) setsignal(SIGWINCH, -1, setQrylogFlg); @@ -427,7 +446,6 @@ main(argc, argv, envp) setsignal(SIGALRM, SIGCHLD, maint_alarm); setsignal(SIGCHLD, SIGALRM, reapchild); setsignal(SIGPIPE, -1, (SIG_FN (*)())SIG_IGN); - setsignal(SIGHUP, -1, onhup); #if defined(SIGXFSZ) /* Wierd DEC Hesiodism, harmless. */ @@ -438,12 +456,6 @@ main(argc, argv, envp) setsignal(SIGSYS, -1, sigprof); #endif /* SIGSYS */ -#ifdef ALLOW_UPDATES - /* Catch SIGTERM so we can dump the database upon shutdown if it - has changed since it was last dumped/booted */ - setsignal(SIGTERM, -1, onintr); -#endif - #ifdef XSTATS /* Catch SIGTERM so we can write stats before exiting. */ setsignal(SIGTERM, -1, onintr); @@ -562,22 +574,6 @@ main(argc, argv, envp) ddt = 0; } #endif -#ifdef ALLOW_UPDATES - if (needToExit) { - struct zoneinfo *zp; - sigblock(~0); /* - * Block all blockable signals - * to ensure a consistant - * state during final dump - */ - dprintf(1, (ddt, "Received shutdown signal\n")); - for (zp = zones; zp < &zones[nzones]; zp++) { - if (zp->z_flags & Z_CHANGED) - zonedump(zp); - } - exit(0); - } -#endif /* ALLOW_UPDATES */ #ifdef XSTATS if (needToExit) { ns_logstats(); @@ -675,6 +671,8 @@ main(argc, argv, envp) ntohs(from_addr.sin_port), dqp->dq_dfd, n, ctimel(tt.tv_sec))); + if (n < HFIXEDSZ) + break; #ifdef DEBUG if (debug >= 10) fp_nquery(buf, n, ddt); @@ -790,10 +788,12 @@ main(argc, argv, envp) sp->s_bufp = (u_char *)&sp->s_tempsize; FD_SET(rfd, &mask); FD_SET(rfd, &tmpmask); - dprintf(1, (ddt, - "\nTCP connection from [%s].%d (fd %d)\n", - inet_ntoa(sp->s_from.sin_addr), - ntohs(sp->s_from.sin_port), rfd)); +#ifdef DEBUG + if (debug) + syslog(LOG_DEBUG, + "IP/TCP connection from %s (fd %d)\n", + sin_ntoa(&sp->s_from), rfd); +#endif } if (streamq) dprintf(3, (ddt, "streamq = 0x%lx\n", @@ -871,8 +871,8 @@ main(argc, argv, envp) * if we have a query id, then we will send an * error back to the user. */ - if (sp->s_bufsize == 0 && - (sp->s_bufp - sp->s_buf > INT16SZ)) { + if (sp->s_bufsize == 0) { + if (sp->s_bufp - sp->s_buf > INT16SZ) { HEADER *hp; hp = (HEADER *)sp->s_buf; @@ -885,7 +885,30 @@ main(argc, argv, envp) hp->rcode = SERVFAIL; (void) writemsg(sp->s_rfd, sp->s_buf, HFIXEDSZ); - continue; + } + continue; + } + /* + * If the message is too short to contain a valid + * header, try to send back an error, and drop the + * message. + */ + if (sp->s_bufp - sp->s_buf < HFIXEDSZ) { + if (sp->s_bufp - sp->s_buf > INT16SZ) { + HEADER *hp; + + hp = (HEADER *)sp->s_buf; + hp->qr = 1; + hp->ra = (NoRecurse == 0); + hp->ancount = 0; + hp->qdcount = 0; + hp->nscount = 0; + hp->arcount = 0; + hp->rcode = SERVFAIL; + (void) writemsg(sp->s_rfd, sp->s_buf, + HFIXEDSZ); + } + continue; } if ((n == -1) && (errno == PORT_WOULDBLK)) continue; @@ -937,7 +960,9 @@ getnetconf() exit(1); } ntp = NULL; -#if defined(AF_LINK) && !defined(RISCOS_BSD) && !defined(M_UNIX) +#if defined(AF_LINK) && \ + !defined(RISCOS_BSD) && !defined(M_UNIX) && \ + !defined(sgi) && !defined(sun) && !defined(NO_SA_LEN) #define my_max(a, b) (a > b ? a : b) #define my_size(p) my_max((p).sa_len, sizeof(p)) #else @@ -1168,6 +1193,7 @@ opensocket(dqp) { int m, n; int on = 1; + int fd; /* * Open datagram sockets bound to interface address. @@ -1176,6 +1202,16 @@ opensocket(dqp) syslog(LOG_ERR, "socket(SOCK_DGRAM): %m - exiting"); exit(1); } +#ifdef F_DUPFD + /* + * leave a space for stdio to work in + */ + if ((fd = fcntl(dqp->dq_dfd, F_DUPFD, 20)) != -1) { + close(dqp->dq_dfd); + dqp->dq_dfd = fd; + } else + syslog(LOG_NOTICE, "fcntl(dfd, F_DUPFD, 20): %m"); +#endif dprintf(1, (ddt, "dqp->dq_addr %s d_dfd %d\n", inet_ntoa(dqp->dq_addr), dqp->dq_dfd)); if (setsockopt(dqp->dq_dfd, SOL_SOCKET, SO_REUSEADDR, @@ -1252,22 +1288,6 @@ maint_alarm() } -#ifdef ALLOW_UPDATES -/* - * Signal handler to schedule shutdown. Just set flag, to ensure a consistent - * state during dump. - */ -static SIG_FN -onintr() -{ - int save_errno = errno; - - resignal(SIGTERM, -1, onintr); - needToExit = 1; - errno = save_errno; -} -#endif /* ALLOW_UPDATES */ - #ifdef XSTATS /* * Signal handler to write log information diff --git a/contrib/bind/named/ns_maint.c b/contrib/bind/named/ns_maint.c index 631210b..944d2b2 100644 --- a/contrib/bind/named/ns_maint.c +++ b/contrib/bind/named/ns_maint.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)ns_maint.c 4.39 (Berkeley) 3/2/91"; -static char rcsid[] = "$Id: ns_maint.c,v 8.16 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: ns_maint.c,v 8.18 1996/09/22 00:13:10 vixie Exp $"; #endif /* not lint */ /* @@ -98,9 +98,7 @@ static time_t stats_time; #endif /* * Invoked at regular intervals by signal interrupt; refresh all secondary - * zones from primary name server and remove old cache entries. Also, - * ifdef'd ALLOW_UPDATES, dump database if it has changed since last - * dump/bootup. + * zones from primary name server and remove old cache entries. */ void ns_maint() @@ -147,18 +145,6 @@ ns_maint() } qserial_query(zp); break; -#ifdef ALLOW_UPDATES - case Z_PRIMARY: - /* - * Checkpoint the zone if it has changed - * since we last checkpointed - */ - if (zp->z_flags & Z_CHANGED) { - zonedump(zp); - ns_refreshtime(zp, tt.tv_sec); - } - break; -#endif /* ALLOW_UPDATES */ } gettime(&tt); } @@ -403,7 +389,7 @@ static void startxfer(zp) struct zoneinfo *zp; { - static char *argv[NSMAX + 20], argv_ns[NSMAX][MAXDNAME]; + char *argv[NSMAX + 20], argv_ns[NSMAX][MAXDNAME]; int argc = 0, argc_ns = 0, pid, i; unsigned int cnt; char debug_str[10]; @@ -937,7 +923,8 @@ endxfer() if (WIFSIGNALED(status)) { if (WTERMSIG(status) != SIGKILL) { syslog(LOG_NOTICE, - "named-xfer exited with signal %d\n", + "named-xfer \"%s\" exited with signal %d\n", + zp->z_origin[0]?zp->z_origin:".", WTERMSIG(status)); } ns_retrytime(zp, tt.tv_sec); diff --git a/contrib/bind/named/ns_ncache.c b/contrib/bind/named/ns_ncache.c index eb8faaf..9de1fc8 100644 --- a/contrib/bind/named/ns_ncache.c +++ b/contrib/bind/named/ns_ncache.c @@ -32,7 +32,9 @@ cache_n_resp(msg, msglen) char dname[MAXDNAME]; int n; int type, class; +#ifdef VALIDATE int Vcode; +#endif int flags; nameserIncr(from_addr.sin_addr, nssRcvdNXD); @@ -62,67 +64,74 @@ cache_n_resp(msg, msglen) } #endif #ifdef RETURNSOA - if (hp->rcode==NXDOMAIN) { - u_int32_t ttl; - u_int16_t atype; - u_char * tp = cp; - u_char * cp1; - u_char data[BUFSIZ+MAXDNAME]; - int len = sizeof(data); + if (hp->nscount) { + u_int32_t ttl; + u_int16_t atype; + u_char *tp = cp; + u_char *cp1; + u_char data[BUFSIZ+MAXDNAME]; + size_t len = sizeof data; - /* store ther SOA record */ - if (!hp->nscount) { - dprintf(3, (ddt, "ncache: nscount == 0\n")); - return; - } - n = dn_skipname(tp, msg + msglen); - if (n < 0) { - dprintf(3, (ddt, "ncache: form error\n")); - return; - } - tp += n; - GETSHORT(atype,tp); /* type */ - if (atype != T_SOA) { - dprintf(3, (ddt, "ncache: type (%d) != T_SOA\n",atype)); - return; - } - tp += sizeof(u_int16_t); /* class */ - GETLONG(ttl,tp); /* ttl */ - tp += sizeof(u_int16_t); /* dlen */ + /* we store NXDOMAIN as T_SOA regardless of the query type */ + if (hp->rcode == NXDOMAIN) + type = T_SOA; - if ((n = dn_expand(msg, msg + msglen, tp, data, len)) - < 0 ) { - dprintf(3, (ddt, "ncache: form error 2\n")); - return; - } /* origin */ - tp += n; - cp1 = data + (n = strlen(data) + 1); - len -= n; - if ((n = dn_expand(msg, msg + msglen, tp, cp1, len)) < 0 ) { - dprintf(3, (ddt, "ncache: form error 2\n")); - return; - } /* mail */ - tp += n; - n = strlen(cp1) + 1; - cp1 += n; - len -= n; - bcopy(tp, cp1, n = 5 * sizeof(u_int32_t)); - /* serial, refresh, retry, expire, min */ - cp1 += n; - len -= n; - /* store the zone of the soa record */ - if ((n = dn_expand(msg, msg + msglen, cp, cp1, len)) < 0 ) { - dprintf(3, (ddt, "ncache: form error 2\n")); - return; - } - n = strlen(cp1) + 1; - cp1 += n; + /* store ther SOA record */ + n = dn_skipname(tp, msg + msglen); + if (n < 0) { + dprintf(3, (ddt, "ncache: form error\n")); + return; + } + tp += n; + GETSHORT(atype, tp); /* type */ + if (atype != T_SOA) { + dprintf(3, (ddt, + "ncache: type (%d) != T_SOA\n",atype)); + goto no_soa; + } + tp += INT16SZ; /* class */ + GETLONG(ttl, tp); /* ttl */ + tp += INT16SZ; /* dlen */ + + /* origin */ + n = dn_expand(msg, msg + msglen, tp, (char*)data, len); + if (n < 0) { + dprintf(3, (ddt, "ncache: form error 2\n")); + return; + } + tp += n; + n = strlen((char*)data) + 1; + cp1 = data + n; + len -= n; + /* mail */ + n = dn_expand(msg, msg + msglen, tp, (char*)cp1, len); + if (n < 0) { + dprintf(3, (ddt, "ncache: form error 2\n")); + return; + } + tp += n; + n = strlen((char*)cp1) + 1; + cp1 += n; + len -= n; + bcopy(tp, cp1, n = 5 * INT32SZ); + /* serial, refresh, retry, expire, min */ + cp1 += n; + len -= n; + /* store the zone of the soa record */ + n = dn_expand(msg, msg + msglen, cp, (char*)cp1, len); + if (n < 0) { + dprintf(3, (ddt, "ncache: form error 2\n")); + return; + } + n = strlen((char*)cp1) + 1; + cp1 += n; - dp = savedata(class, T_SOA, MIN(ttl,NTTL)+tt.tv_sec, data, - cp1 - data); + dp = savedata(class, type, MIN(ttl, NTTL) + tt.tv_sec, data, + cp1 - data); } else { + no_soa: #endif - dp = savedata(class, type, NTTL+tt.tv_sec, NULL, 0); + dp = savedata(class, type, NTTL + tt.tv_sec, NULL, 0); #ifdef RETURNSOA } #endif @@ -137,11 +146,11 @@ cache_n_resp(msg, msglen) flags = DB_NOTAUTH|DB_NOHINTS; } - if ((n = db_update(dname,dp,dp,flags,hashtab)) != OK) { + if ((n = db_update(dname, dp, dp, flags, hashtab)) != OK) { dprintf(1, (ddt, "db_update failed return value:%d, cache_n_resp()\n", n)); - free((char *)dp); + db_free(dp); return; } dprintf(4, (ddt, diff --git a/contrib/bind/named/ns_req.c b/contrib/bind/named/ns_req.c index c485f59..1d7e39e 100644 --- a/contrib/bind/named/ns_req.c +++ b/contrib/bind/named/ns_req.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)ns_req.c 4.47 (Berkeley) 7/1/91"; -static char rcsid[] = "$Id: ns_req.c,v 8.20 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: ns_req.c,v 8.27 1996/10/08 04:51:03 vixie Exp $"; #endif /* not lint */ /* @@ -55,6 +55,28 @@ static char rcsid[] = "$Id: ns_req.c,v 8.20 1996/08/05 08:31:30 vixie Exp $"; * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * --Copyright-- */ @@ -99,27 +121,15 @@ static enum req_action req_notify __P((HEADER *hp, u_char **cpp, u_char *eom, #endif static void fwritemsg __P((FILE *, u_char *, int)), -#ifdef DEBUG - printSOAdata __P((struct databuf)), -#endif doaxfr __P((struct namebuf *, FILE *, struct namebuf *, int)), startxfr __P((struct qstream *, struct namebuf *, u_char *, int, int, const char *)); -#ifdef ALLOW_UPDATES -static int InitDynUpdate __P((register HEADER *hp, - char *msg, - int msglen, - u_char *startcp, - struct sockaddr_in *from, - struct qstream *qsp, - int dfd)); -#endif - static struct addinfo addinfo[NADDRECS]; static void addname __P((const char *, const char *, u_int16_t, u_int16_t)); +static void copyCharString __P((u_char **, const char *)); /* * Process request using database; assemble and send response. @@ -192,41 +202,6 @@ ns_req(msg, msglen, buflen, qsp, from, dfd) break; #endif -#ifdef ALLOW_UPDATES -#define FORWARDED 1000 -/* - * In a sense the following constant should be defined in <arpa/nameser.h>, - * since it is returned here in place of a response code if the update was - * forwarded, and the response codes are defined in nameser.h. On the other - * hand, though, this constant is only seen in this file. The assumption - * here is that none of the other return codes equals this one (a good - * assumption, since they only occupy 4 bits over-the-wire) - */ - /* Call InitDynUpdate for all dynamic update requests */ - case UPDATEM: - case UPDATEMA: - case UPDATED: - case UPDATEDA: - case UPDATEA: - n = InitDynUpdate(hp, msg, msglen, cp, from, qsp, dfd); - if (n == FORWARDED) { - /* Return directly because InitDynUpdate - * forwarded the query to the primary, so we - * will send response later - */ - action = Return; - } else { - /* Either sucessful primary update or failure; - * return response code to client - */ - action = Finish; - } - - case ZONEREF: - dprintf(1, (ddt, "Refresh Zone\n")); - /*FALLTHROUGH*/ -#endif /* ALLOW_UPDATES */ - default: dprintf(1, (ddt, "ns_req: Opcode %d not implemented\n", hp->opcode)); @@ -453,10 +428,7 @@ req_query(hp, cpp, eom, qsp, buflenp, msglenp, msg, dfd, from) nameserIncr(from->sin_addr, nssRcvdQ); #endif -#ifdef DATUMREFCNT nsp[0] = NULL; -#endif - dpp = dnptrs; *dpp++ = msg; *dpp = NULL; @@ -504,6 +476,33 @@ req_query(hp, cpp, eom, qsp, buflenp, msglenp, msg, dfd, from) qtypeIncr(type); /* + * Yow! + */ + if (!strcasecmp(dnbuf, "VERSION.BIND") && + class == C_CHAOS && type == T_TXT) { + u_char *tp; + + hp->ancount = htons(1); + hp->nscount = htons(0); + hp->arcount = htons(0); + hp->rcode = NOERROR; + hp->aa = 1; + hp->ra = 0; + copyCharString(cpp, "VERSION"); /* Name */ + copyCharString(cpp, "BIND"); + *(*cpp)++ = 0x00; + PUTSHORT(T_TXT, *cpp); /* Type */ + PUTSHORT(C_CHAOS, *cpp); /* Class */ + PUTLONG(0, *cpp); /* TTL */ + tp = *cpp; /* Temp RdLength */ + PUTSHORT(0, *cpp); + copyCharString(cpp, Version); + PUTSHORT((*cpp) - (tp + INT16SZ), tp); /* Real RdLength */ + *msglenp = *cpp - msg; /* Total message length */ + return (Finish); + } + + /* * Process query. */ if (type == T_AXFR) { @@ -551,7 +550,7 @@ req_query(hp, cpp, eom, qsp, buflenp, msglenp, msg, dfd, from) } #endif /*QRYLOG*/ -try_again: + try_again: dprintf(1, (ddt, "req: nlookup(%s) id %d type=%d class=%d\n", dname, ntohs(hp->id), type, class)); htp = hashtab; /* lookup relative to root */ @@ -645,15 +644,17 @@ try_again: n = finddata(np, class, T_SOA, hp, &dname, buflenp, &count); if (n != 0 ) { + if (count) { + *cpp += n; + *buflenp -= n; + *msglenp += n; + hp->nscount = htons((u_int16_t)count); + } if (hp->rcode == NOERROR_NODATA) { /* this should not occur */ hp->rcode = NOERROR; return (Finish); } - *cpp += n; - *buflenp -= n; - *msglenp += n; - hp->nscount = htons((u_int16_t)count); } #endif hp->rcode = NXDOMAIN; @@ -683,6 +684,14 @@ try_again: #ifdef NCACHE if (hp->rcode == NOERROR_NODATA) { hp->rcode = NOERROR; +#ifdef RETURNSOA + if (count) { + *cpp += n; + *buflenp -= n; + *msglenp += n; + hp->nscount = htons(count); + } +#endif founddata = 1; return (Finish); } @@ -746,7 +755,7 @@ try_again: return (Finish); #endif -fetchns: + fetchns: /* * If we're already out of room in the response, we're done. */ @@ -758,9 +767,7 @@ fetchns: * section or record the address for forwarding the query * (recursion desired). */ -#ifdef DATUMREFCNT free_nsp(nsp); -#endif nsp[0] = NULL; count = 0; switch (findns(&np, class, nsp, &count, 0)) { @@ -772,11 +779,7 @@ fetchns: dname, hp->rcode)); if (class != C_ANY) { hp->aa = 1; - /* XXX: should return SOA if founddata == 0, - * but old named's are confused by an SOA - * in the auth. section if there's no error. - */ - if (foundname == 0 && np) { + if (np && (!foundname || !founddata)) { n = doaddauth(hp, *cpp, *buflenp, np, nsp[0]); *cpp += n; *buflenp -= n; @@ -784,9 +787,7 @@ fetchns: } else if (ntohs(hp->ancount) != 0) { /* don't add NS records for NOERROR NODATA as some servers can get confused */ -#ifdef DATUMREFCNT free_nsp(nsp); -#endif switch (findns(&np, class, nsp, &count, 1)) { case NXDOMAIN: case SERVFAIL: @@ -811,18 +812,14 @@ fetchns: #endif /*ADDAUTH*/ } } -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (Finish); case SERVFAIL: /* We're authoritative but the zone isn't loaded. */ if (!founddata && !(forward_only && fwdtab)) { hp->rcode = SERVFAIL; -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (Finish); } } @@ -850,9 +847,7 @@ fetchns: *buflenp -= n; hp->nscount = htons((u_int16_t)count); } -#ifdef DATUMREFCNT free_nsp(nsp); -#endif /* Our caller will handle the Additional section. */ return (Finish); } @@ -869,9 +864,7 @@ fetchns: if (omsg == (u_char *)NULL) { syslog(LOG_INFO, "ns_req: Out Of Memory"); hp->rcode = SERVFAIL; -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (Finish); } id = hp->id; @@ -883,14 +876,13 @@ fetchns: if (n < 0) { syslog(LOG_INFO, "res_mkquery(%s) failed", dname); hp->rcode = SERVFAIL; -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (Finish); } *msglenp = n; } - n = ns_forw(nsp, msg, *msglenp, from, qsp, dfd, &qp, dname, np); + n = ns_forw(nsp, msg, *msglenp, from, qsp, dfd, &qp, + dname, class, type, np); if (n != FW_OK && cname) free(omsg); switch (n) { @@ -906,22 +898,20 @@ fetchns: break; /* Duplicate request dropped */ case FW_NOSERVER: /* - ** Don't go into an infinite loop if - ** the admin gave root NS records in the cache - ** file without giving address records - ** for the root servers. - */ + * Don't go into an infinite loop if + * the admin gave root NS records in the cache + * file without giving address records + * for the root servers. + */ if (np) { if (NAME(*np)[0] == '\0') { syslog(LOG_NOTICE, "ns_req: no address for root server"); hp->rcode = SERVFAIL; -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (Finish); } -#ifdef VALIDATE +#ifdef VALIDATE /* * we need to kill all the NS records here as * validate will fail as we are talking to the parent @@ -956,14 +946,10 @@ fetchns: case FW_SERVFAIL: do_servfail: hp->rcode = SERVFAIL; -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (Finish); } -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (Return); } @@ -1179,6 +1165,7 @@ stale(dp) zp->z_origin); } zp->z_flags &= ~Z_AUTH; + needmaint = 1; return (1); } if (zp->z_lastupdate > tt.tv_sec) { @@ -1188,6 +1175,7 @@ stale(dp) zp->z_origin); } zp->z_flags &= ~Z_AUTH; + needmaint = 1; return (1); } return (0); @@ -1223,6 +1211,7 @@ make_rr(name, dp, buf, buflen, doadd) u_char *cp1, *sp; struct zoneinfo *zp; register int32_t n; + register int16_t type = dp->d_type; register u_int32_t ttl; u_char **edp = dnptrs + sizeof dnptrs / sizeof dnptrs[0]; @@ -1233,7 +1222,7 @@ make_rr(name, dp, buf, buflen, doadd) #ifdef NCACHE if (dp->d_rcode #ifdef RETURNSOA - && dp->d_rcode != NXDOMAIN + && dp->d_size == 0 #endif ) { panic(-1, "make_rr: impossible d_rcode value"); @@ -1268,23 +1257,24 @@ make_rr(name, dp, buf, buflen, doadd) buflen -= RRFIXEDSZ; #if defined(RETURNSOA) && defined(NCACHE) - if (dp->d_rcode == NXDOMAIN) { + if (dp->d_rcode) { name = (char *)dp->d_data; name += strlen(name) +1; name += strlen(name) +1; name += 5 * INT32SZ; + type = T_SOA; } #endif if ((n = dn_comp(name, buf, buflen, dnptrs, edp)) < 0) return (-1); cp = buf + n; buflen -= n; - PUTSHORT((u_int16_t)dp->d_type, cp); + PUTSHORT((u_int16_t)type, cp); PUTSHORT((u_int16_t)dp->d_class, cp); PUTLONG(ttl, cp); sp = cp; cp += INT16SZ; - switch (dp->d_type) { + switch (type) { case T_CNAME: case T_MG: case T_MR: @@ -1306,7 +1296,7 @@ make_rr(name, dp, buf, buflen, doadd) cp += n; if (doadd) addname((char*)dp->d_data, name, - dp->d_type, dp->d_class); + type, dp->d_class); break; case T_SOA: @@ -1317,13 +1307,13 @@ make_rr(name, dp, buf, buflen, doadd) if (n < 0) return (-1); cp += n; - buflen -= dp->d_type == T_SOA ? n + 5 * INT32SZ : n; + buflen -= type == T_SOA ? n + 5 * INT32SZ : n; cp1 += strlen((char *)cp1) + 1; n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); if (n < 0) return (-1); cp += n; - if (dp->d_type == T_SOA) { + if (type == T_SOA) { cp1 += strlen((char *)cp1) + 1; bcopy(cp1, cp, (n = 5 * INT32SZ)); cp += n; @@ -1332,9 +1322,74 @@ make_rr(name, dp, buf, buflen, doadd) PUTSHORT((u_int16_t)n, sp); break; + case T_NAPTR: + /* cp1 == our data/ cp == data of RR */ + cp1 = dp->d_data; + + if ((buflen -= INT16SZ) < 0) + return (-1); + + /* copy order */ + bcopy(cp1, cp, INT16SZ); + cp += INT16SZ; + cp1 += INT16SZ; + n = (u_int16_t)((cp - sp) - INT16SZ); + dprintf(1, (ddt, "current size n = %u\n", n)); + + /* copy preference */ + bcopy(cp1, cp, INT16SZ); + cp += INT16SZ; + cp1 += INT16SZ; + n = (u_int16_t)((cp - sp) - INT16SZ); + dprintf(1, (ddt, "current size n = %u\n", n)); + + /* Flags */ + n = *cp1++; + dprintf(1, (ddt, "size of n at flags = %d\n", n)); + *cp++ = n; + bcopy(cp1,cp,n); + cp += n; + cp1 += n; + n = (u_int16_t)((cp - sp) - INT16SZ); + dprintf(1, (ddt, "current size n = %u\n", n)); + + /* Service */ + n = *cp1++; + *cp++ = n; + bcopy(cp1,cp,n); + cp += n; + cp1 += n; + n = (u_int16_t)((cp - sp) - INT16SZ); + dprintf(1, (ddt, "current size n = %u\n", n)); + + /* Regexp */ + n = *cp1++; + *cp++ = n; + bcopy(cp1,cp,n); + cp += n; + cp1 += n; + n = (u_int16_t)((cp - sp) - INT16SZ); + dprintf(1, (ddt, "current size n = %u\n", n)); + + /* Replacement */ + dprintf(1, (ddt, "Replacement = %s\n", cp1)); + n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); + dprintf(1, (ddt, "dn_comp's n = %u\n", n)); + if (n < 0) + return (-1); + cp += n; + + /* save data length */ + n = (u_int16_t)((cp - sp) - INT16SZ); + dprintf(1, (ddt, "saved size n = %u\n", n)); + PUTSHORT((u_int16_t)n, sp); + + break; + case T_MX: case T_AFSDB: case T_RT: + case T_SRV: /* cp1 == our data/ cp == data of RR */ cp1 = dp->d_data; @@ -1346,6 +1401,12 @@ make_rr(name, dp, buf, buflen, doadd) cp += INT16SZ; cp1 += INT16SZ; + if (type == T_SRV) { + bcopy(cp1, cp, INT16SZ*2); + cp += INT16SZ*2; + cp1 += INT16SZ*2; + } + n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); if (n < 0) return (-1); @@ -1355,7 +1416,7 @@ make_rr(name, dp, buf, buflen, doadd) n = (u_int16_t)((cp - sp) - INT16SZ); PUTSHORT((u_int16_t)n, sp); if (doadd) - addname((char*)cp1, name, dp->d_type, dp->d_class); + addname((char*)cp1, name, type, dp->d_class); break; case T_PX: @@ -1385,6 +1446,39 @@ make_rr(name, dp, buf, buflen, doadd) PUTSHORT((u_int16_t)n, sp); break; + case T_SIG: + /* cp1 == our data; cp == data of target RR */ + cp1 = dp->d_data; + + /* first just copy over the type_covered, algorithm, */ + /* labels, orig ttl, two timestamps, and the footprint */ + if ((dp->d_size - 18) > buflen) + return (-1); /* out of room! */ + bcopy( cp1, cp, 18 ); + cp += 18; + cp1 += 18; + buflen -= 18; + + /* then the signer's name */ + n = dn_comp((char *)cp1, cp, buflen, NULL, NULL); + if (n < 0) + return (-1); + cp += n; + buflen -= n; + cp1 += strlen((char*)cp1)+1; + + /* finally, we copy over the variable-length signature */ + n = dp->d_size - (u_int16_t)((cp1 - dp->d_data)); + if (n > buflen) + return (-1); /* out of room! */ + bcopy(cp1, cp, n); + cp += n; + + /* save data length & return */ + n = (u_int16_t)((cp - sp) - INT16SZ); + PUTSHORT((u_int16_t)n, sp); + break; + default: if (dp->d_size > buflen) return (-1); @@ -1458,8 +1552,7 @@ doaddinfo(hp, msg, msglen) count = 0; cp = msg; for (ap = addinfo; --addcount >= 0; ap++) { - int foundstale = 0, - foundany = 0, + int foundany = 0, foundcname = 0, save_count = count, save_msglen = msglen; @@ -1473,6 +1566,7 @@ doaddinfo(hp, msg, msglen) goto next_rr; dprintf(3, (ddt, "found it\n")); /* look for the data */ + delete_stale(np); for (dp = np->n_data; dp != NULL; dp = dp->d_next) { #ifdef NCACHE if (dp->d_rcode) @@ -1490,17 +1584,6 @@ doaddinfo(hp, msg, msglen) continue; } foundany++; - if (stale(dp)) { - foundstale++; - dprintf(1, (ddt, - "doaddinfo: stale entry '%s'%s\n", - NAME(*np), - (dp->d_flags&DB_F_HINT) - ? " hint" - : "" - )); - continue; - } /* * Should be smart and eliminate duplicate * data here. XXX @@ -1532,11 +1615,7 @@ doaddinfo(hp, msg, msglen) count++; } next_rr: - if (foundstale) { - /* Cache invalidate the address RR's */ - delete_all(np, (int)ap->a_class, T_A); - } - if (!NoFetchGlue && !foundcname && (foundstale || !foundany)) { + if (!NoFetchGlue && !foundcname && !foundany) { /* ask a real server for this info */ (void) sysquery(ap->a_dname, (int)ap->a_class, T_A, NULL, 0, QUERY); @@ -1730,6 +1809,16 @@ doaxfr(np, rfp, top, class) */ if (dp->d_type == T_SOA || dp->d_type == T_NS) continue; + +#if 0 /* Not yet implemented. Only a SHOULD in the I-D. -gnu@toad.com */ + /* skip the SIG AXFR record because we did it first too. */ + if (dp->d_type == T_SIG) { + int sig_rrtype = GETSHORT (dp->d_data); + if (sig_rrtype == T_AXFR) + continue; + } +#endif /* 0 */ + if (dp->d_zone == 0 || stale(dp)) continue; #ifdef NCACHE @@ -1791,228 +1880,6 @@ doaxfr(np, rfp, top, class) dprintf(1, (ddt, "exit doaxfr()\n")); } -#ifdef ALLOW_UPDATES -/* - * Called by UPDATE{A,D,DA,M,MA} to initiate a dynamic update. If this is the - * primary server for the zone being updated, we update the zone's serial - * number and then call doupdate directly. If this is a secondary, we just - * forward the update; this way, if the primary update fails (e.g., if the - * primary is unavailable), we don't update the secondary; if the primary - * update suceeds, ns_resp will get called with the response (when it comes - * in), and then update the secondary's copy. - */ -static int -InitDynUpdate(hp, msg, msglen, startcp, from, qsp, dfd) - register HEADER *hp; - char *msg; - int msglen; - u_char *startcp; - struct sockaddr_in *from; - struct qstream *qsp; - int dfd; -{ - struct databuf *nsp[NSMAX]; - struct zoneinfo *zp; - char dnbuf[MAXDNAME]; - struct hashbuf *htp = hashtab; /* lookup relative to root */ - struct namebuf *np; - struct databuf *olddp, *newdp, *dp; - struct databuf **nspp; - char *fname; - register u_char *cp = startcp; - u_int16_t class, type; - int n, size, zonenum; - char ZoneName[MAXDNAME], *znp; - -#ifdef DATUMREFCNT - nsp[0] = NULL; -#endif - if ((n = dn_expand(msg, msg + msglen, cp, dnbuf, sizeof(dnbuf))) < 0) { - dprintf(1, (ddt,"FORMERR InitDynUpdate expand name failed\n")); - hp->rcode = FORMERR; - return (FORMERR); - } - cp += n; - GETSHORT(type, cp); - if (type == T_SOA) { /* T_SOA updates not allowed */ - hp->rcode = REFUSED; - dprintf(1, (ddt, "InitDynUpdate: REFUSED - SOA update\n")); - return (REFUSED); - } - GETSHORT(class, cp); - cp += INT32SZ; - GETSHORT(size, cp); -/****XXX - need bounds checking here ****/ - cp += size; - - if ((zonenum = findzone(dnbuf, class)) == 0) { /* zone not found */ - hp->rcode = NXDOMAIN; - return (NXDOMAIN); - } - zp = &zones[zonenum]; - - /* Disallow updates for which we aren't authoratative. Note: the - following test doesn't work right: If it's for a non-local zone, - we will think it's a primary but be unable to lookup the namebuf, - thus returning 'NXDOMAIN' */ - if (zp->z_type != Z_PRIMARY && zp->z_type != Z_SECONDARY) { - hp->rcode = REFUSED; - dprintf(1, (ddt, - "InitDynUpdate: REFUSED - non-{primary,secondary} update\n")); - return (REFUSED); - } - if (!(zp->z_flags & Z_DYNAMIC)) { - hp->rcode = REFUSED; - dprintf(1, (ddt, - "InitDynUpdate: REFUSED - dynamic flag not set for zone\n")); - return (REFUSED); - } - - /* - * Lookup the zone namebuf. Lookup "xyz" not "xyz.", since - * otherwise the lookup fails, because '.' may have a nil n_hash - * associated with it. - */ - strcpy(ZoneName, zp->z_origin); - znp = &ZoneName[strlen(ZoneName) - 1]; - if (*znp == '.') - *znp = NULL; - np = nlookup(ZoneName, &htp, &fname, 0); - if ((np == NULL) || (fname != ZoneName)) { - syslog(LOG_ERR, "InitDynUpdate: lookup failed on zone (%s)\n", - ZoneName); - hp->rcode = NXDOMAIN; - return (NXDOMAIN); - } - - /* - * If this is the primary copy increment the serial number. Don't - * increment the serial number if this is a secondary; this way, if 2 - * different secondaries both update the primary, they will both have - * lower serial numbers than the primary has, and hence eventually - * refresh and get all updates and become consistent. - * - * Note that the serial number must be incremented in both the zone - * data structure and the zone's namebuf. - */ - switch (zp->z_type) { - case Z_SECONDARY: /* forward update to primary */ - nspp = nsp; - dp = np->n_data; - while (dp != NULL) { - if (match(dp, class, T_NS)) { - if (nspp < &nsp[NSMAX-1]) { - *nspp++ = dp; -#ifdef DATUMREFCNT - dp->d_rcnt++; -#endif - } else - break; - } - dp = dp->d_next; - } - *nspp = NULL; /* Delimiter */ - if (ns_forw(nsp, msg, msglen, from, qsp, dfd, NULL, dnbuf, np) - < - 0) { - hp->rcode = SERVFAIL; -#ifdef DATUMREFCNT - free_nsp(nsp); -#endif - return (SERVFAIL); - } -#ifdef DATUMREFCNT - free_nsp(nsp); -#endif - return (FORWARDED); - - case Z_PRIMARY: - zp->z_serial++; - /* Find the SOA record */ - for (olddp = np->n_data; olddp != NULL; olddp = olddp->d_next) - if (match(olddp, class, T_SOA)) - break; - if (olddp == NULL) { - syslog(LOG_NOTICE, - "InitDynUpdate: Couldn't find SOA RR for '%s'\n", - ZoneName); - hp->rcode = NXDOMAIN; -#ifdef DATUMREFCNT - free_nsp(nsp); -#endif - return (NXDOMAIN); - } - newdp = savedata(olddp->d_class, olddp->d_type, olddp->d_ttl, - olddp->d_data, olddp->d_size); - newdp->d_zone = olddp->d_zone; - newdp->d_cred = DB_C_AUTH; /* XXX - it may not be so */ - newdp->d_clev = db_getclev(zp->z_origin); - cp = (u_char *)newdp->d_data; - cp += strlen(cp) + 1; /* skip origin string */ - cp += strlen(cp) + 1; /* skip in-charge string */ - putlong((u_int32_t)(zp->z_serial), cp); - dprintf(4, (ddt, "after stuffing data into newdp:\n")); -#ifdef DEBUG - if (debug >= 4) - printSOAdata(newdp); -#endif - - if ((n = db_update(ZoneName, olddp, newdp, DB_DELETE, - hashtab)) != NOERROR) { /* XXX */ - dprintf(1, (ddt, - "InitDynUpdate: SOA update failed\n")); - hp->rcode = NOCHANGE; - free((char*) dp); -#ifdef DATUMREFCNT - free_nsp(nsp); -#endif - return (NOCHANGE); - } - - /* Now update the RR itself */ - /* XXX - DB_C_AUTH may be wrong */ - if (doupdate(msg, msglen, msg + HFIXEDSZ, zonenum, - (struct databuf *)0, DB_NODATA, DB_C_AUTH) < 0) { - dprintf(1, (ddt, "InitDynUpdate: doupdate failed\n")); - /* doupdate fills in rcode */ -#ifdef DATUMREFCNT - free_nsp(nsp); -#endif - return (hp->rcode); - } - zp->z_flags |= Z_CHANGED; -#ifdef DATUMREFCNT - free_nsp(nsp); -#endif - return (NOERROR); - } -} - -#ifdef DEBUG -/* - * Print the contents of the data in databuf pointed to by dp for an SOA record - */ -static void -printSOAdata(dp) - struct databuf *dp; -{ - register u_char *cp; - - if (!debug) - return; /* Otherwise fprintf to ddt will bomb */ - cp = (u_char *)dp->d_data; - fprintf(ddt, "printSOAdata(%#lx): origin(%#lx)='%s'\n", - (u_long)dp, (u_long)cp, cp); - cp += strlen(cp) + 1; /* skip origin string */ - fprintf(ddt, "printSOAdata: in-charge(%#lx)='%s'\n", - (u_long)cp, cp); - cp += strlen(cp) + 1; /* skip in-charge string */ - fprintf(ddt, "printSOAdata: serial(%lx)=%lu\n", - (u_long)cp, (u_long)_getlong(cp)); -} -#endif -#endif - static void startxfr(qsp, np, soa, soalen, class, dname) struct qstream *qsp; @@ -2159,7 +2026,6 @@ free_addinfo() { addcount = 0; } -#ifdef DATUMREFCNT void free_nsp(nsp) struct databuf **nsp; @@ -2171,9 +2037,20 @@ free_nsp(nsp) } else { dprintf(3, (ddt, "free_nsp: %s rcnt %d delayed\n", (*nsp)->d_data, (*nsp)->d_rcnt)); - free(*nsp); /* delayed free */ + db_free(*nsp); /* delayed free */ } *nsp++ = NULL; } } -#endif + +static void +copyCharString(dst, src) + u_char **dst; + const char *src; +{ + size_t len = strlen(src) & 0xff; + + *(*dst)++ = (u_char) len; + memcpy(*dst, src, len); + *dst += len; +} diff --git a/contrib/bind/named/ns_resp.c b/contrib/bind/named/ns_resp.c index f64306e..71b60f9 100644 --- a/contrib/bind/named/ns_resp.c +++ b/contrib/bind/named/ns_resp.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)ns_resp.c 4.65 (Berkeley) 3/3/91"; -static char rcsid[] = "$Id: ns_resp.c,v 8.27 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: ns_resp.c,v 8.37 1996/12/02 09:17:21 vixie Exp $"; #endif /* not lint */ /* @@ -55,6 +55,28 @@ static char rcsid[] = "$Id: ns_resp.c,v 8.27 1996/08/05 08:31:30 vixie Exp $"; * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * --Copyright-- */ @@ -72,9 +94,6 @@ static char rcsid[] = "$Id: ns_resp.c,v 8.27 1996/08/05 08:31:30 vixie Exp $"; #include "named.h" -static void check_root __P((void)), - check_ns __P((void)); - static u_int8_t norootlogged[MAXCLASS]; /* XXX- should be a bitmap */ static const char skipnameFailedAnswer[] = "skipname failed in answer", @@ -92,8 +111,34 @@ static const char skipnameFailedAnswer[] = "skipname failed in answer", dlenUnderrunAnswer[] = "dlen underrun in answer", outofDataFinal[] = "out of data in final pass", outofDataAFinal[] = "out of data after final pass", - badNameFound[] = "found an invalid domain name"; + badNameFound[] = "found an invalid domain name", + wrongQuestion[] = "answer to wrong question", + danglingCname[] = "dangling CNAME pointer"; + +struct db_list { + struct db_list *db_next; + struct databuf *db_dp; +}; + +struct flush_set { + char * fs_name; + int fs_type; + int fs_class; + u_int fs_cred; + struct db_list *fs_list; +}; + +static void rrsetadd __P((struct flush_set *, char *, + struct databuf *)), + rrsetupdate __P((struct flush_set *, int flags)), + flushrrset __P((struct flush_set *)); +static int rrsetcmp __P((char *, struct db_list *)), + check_root __P((void)), + check_ns __P((void)), + rrextract __P((u_char *, int, u_char *, + struct databuf **, char *, int)); +#ifdef LAME_LOGGING static char * learntFrom(qp, server) struct qinfo *qp; @@ -102,8 +147,10 @@ learntFrom(qp, server) static char *buf = NULL; char *a, *ns, *na; struct databuf *db; +#ifdef STATS char nsbuf[20]; char abuf[20]; +#endif int i; if (buf) { @@ -167,6 +214,7 @@ learntFrom(qp, server) sprintf(buf, LEARNTFROM, na, a, ns); return (buf); } +#endif /*LAME_LOGGING*/ void ns_resp(msg, msglen) @@ -179,24 +227,20 @@ ns_resp(msg, msglen) register struct databuf *ns, *ns2; register u_char *cp; u_char *eom = msg + msglen; - register u_char *tempcp; -#ifdef VALIDATE - struct sockaddr_in *server = &from_addr; - struct { char *name; int type, class; u_int cred; } defer_rm[99]; - int defer_rm_count; -#endif + struct flush_set *flushset; struct sockaddr_in *nsa; struct databuf *nsp[NSMAX]; int i, c, n, qdcount, ancount, aucount, nscount, arcount; int qtype, qclass, dbflags; int restart; /* flag for processing cname response */ int validanswer; - int cname; + int cname, lastwascname; int count, founddata, foundname; int buflen; int newmsglen; - char name[MAXDNAME], qname[MAXDNAME], msgbuf[MAXDNAME*2]; - char *dname; + char name[MAXDNAME], qname[MAXDNAME], aname[MAXDNAME]; + char msgbuf[MAXDNAME]; + char *dname, tmpdomain[MAXDNAME]; const char *fname; const char *formerrmsg = "brain damage"; u_char newmsg[PACKETSZ]; @@ -208,9 +252,7 @@ ns_resp(msg, msglen) struct fwdinfo *fwd; nameserIncr(from_addr.sin_addr, nssRcvdR); -#ifdef DATUMREFCNT nsp[0] = NULL; -#endif hp = (HEADER *) msg; if ((qp = qfindid(hp->id)) == NULL ) { dprintf(1, (ddt, "DUP? dropped (id %d)\n", ntohs(hp->id))); @@ -248,7 +290,8 @@ ns_resp(msg, msglen) GETSHORT(qtype, cp); GETSHORT(qclass, cp); if (!ns_nameok(qname, qclass, response_trans, - ns_ownercontext(qtype, response_trans))) { + ns_ownercontext(qtype, response_trans), + qname, from_addr.sin_addr)) { formerrmsg = badNameFound; goto formerr; } @@ -265,11 +308,16 @@ ns_resp(msg, msglen) formerrmsg = msgbuf; goto formerr; } + if (strcasecmp(qp->q_name, qname) != 0 || + qp->q_class != qclass || + qp->q_type != qtype) { + formerrmsg = wrongQuestion; + goto formerr; + } } else { - /* Pedantic. */ - qname[0] = '\0'; - qtype = 0; - qclass = 0; + strcpy(qname, qp->q_name); + qclass = qp->q_class; + qtype = qp->q_type; } /* cp now points after the query section. */ @@ -325,25 +373,6 @@ ns_resp(msg, msglen) goto formerr; } -#ifdef ALLOW_UPDATES - if ( (hp->rcode == NOERROR) && - (hp->opcode == UPDATEA || hp->opcode == UPDATED || - hp->opcode == UPDATEDA || hp->opcode == UPDATEM || - hp->opcode == UPDATEMA) ) { - /* - * Update the secondary's copy, now that the primary - * successfully completed the update. Zone doesn't matter - * for dyn. update -- doupdate calls findzone to find it - */ - /* XXX - DB_C_AUTH may be wrong */ - (void) doupdate(qp->q_msg, qp->q_msglen, qp->q_msg + HFIXEDSZ, - 0, (struct databuf *)0, 0, DB_C_AUTH); - dprintf(3, (ddt, "resp: leaving, UPDATE*\n")); - /* return code filled in by doupdate */ - goto return_msg; - } -#endif /* ALLOW_UPDATES */ - /* * Determine if the response came from a forwarder. Packets from * anyplace not listed as a forwarder or as a server to whom we @@ -434,19 +463,20 @@ ns_resp(msg, msglen) * Don't update nstime if this doesn't look * like an address databuf now. XXX */ - if (ns && (ns->d_type==T_A) && (ns->d_class==qs->ns->d_class)){ + if (ns && + ns->d_type == T_A && + ns->d_class == qs->ns->d_class) { + u_long t; + if (ns->d_nstime == 0) - ns->d_nstime = (u_int32_t)rtrip; + t = rtrip; else - ns->d_nstime = (u_int32_t) - (ns->d_nstime * ALPHA - + - (1-ALPHA) * (u_int32_t)rtrip); - /* prevent floating point overflow, - * limit to 1000 sec - */ - if (ns->d_nstime > 1000000) - ns->d_nstime = 1000000; + t = ns->d_nstime * ALPHA + + + (1 - ALPHA) * rtrip; + if (t > 65535) + t = 65535; + ns->d_nstime = (u_int16_t)t; } /* @@ -473,6 +503,8 @@ ns_resp(msg, msglen) for (n = 0, qs = qp->q_addr; (u_int)n < qp->q_naddr; n++, qs++) { + u_long t; + ns2 = qs->nsdata; if ((!ns2) || (ns2 == ns)) continue; @@ -481,15 +513,16 @@ ns_resp(msg, msglen) continue; if (qs->stime.tv_sec) { if (ns2->d_nstime == 0) - ns2->d_nstime = (u_int32_t)(rtrip * BETA); + t = (rtrip * BETA); else - ns2->d_nstime = (u_int32_t)( - ns2->d_nstime * BETA + (1-ALPHA) * rtrip - ); - if (ns2->d_nstime > 1000000) - ns2->d_nstime = 1000000; + t = ns2->d_nstime * BETA + + + (1 - ALPHA) * rtrip; } else - ns2->d_nstime = (u_int32_t)(ns2->d_nstime * GAMMA); + t = ns2->d_nstime * GAMMA; + if (t > 65535) + t = 65535; + ns2->d_nstime = (u_int16_t)t; dprintf(2, (ddt, "NS #%d %s rtt now %d\n", n, sin_ntoa(&qs->ns_addr), ns2->d_nstime)); @@ -509,10 +542,9 @@ ns_resp(msg, msglen) #ifdef LAME_DELEGATION /* - * Non-authoritative, no answer, no error + * Non-authoritative, no answer, no error, with referral. */ - if (qdcount == 1 && hp->rcode == NOERROR && !hp->aa && ancount == 0 - && aucount > 0 + if (hp->rcode == NOERROR && !hp->aa && ancount == 0 && aucount > 0 #ifdef BIND_NOTIFY && hp->opcode != NS_NOTIFY_OP #endif @@ -545,7 +577,8 @@ ns_resp(msg, msglen) goto formerr; } if (!ns_nameok(name, class, response_trans, - ns_ownercontext(type, response_trans))) { + ns_ownercontext(type, response_trans), + name, from_addr.sin_addr)) { formerrmsg = badNameFound; goto formerr; } @@ -613,7 +646,8 @@ ns_resp(msg, msglen) goto formerr; } if (!ns_nameok(name, class, response_trans, - ns_ownercontext(type, response_trans))){ + ns_ownercontext(type, response_trans), + name, from_addr.sin_addr)) { formerrmsg = badNameFound; goto formerr; } @@ -717,168 +751,90 @@ ns_resp(msg, msglen) validanswer = 0; nscount = 0; cname = 0; -#ifdef VALIDATE - defer_rm_count = 0; -#endif + lastwascname = 0; + strcpy(aname, qname); + + if (count) { + /* allocate 1 extra record for end of set detection */ + flushset = (struct flush_set *) + calloc(count+1, sizeof(struct flush_set)); + if (!flushset) + panic(-1, "flushset: out of memory"); + } else + flushset = NULL; for (i = 0; i < count; i++) { - struct databuf *ns3 = NULL; - u_char cred; - int VCode; - u_int16_t type, class; + struct databuf *dp; + int type; if (cp >= eom) { formerrmsg = outofDataFinal; goto formerr; } - - /* Get the DNAME. */ - tempcp = cp; - n = dn_expand(msg, eom, tempcp, name, sizeof name); - if (n <= 0) { + n = rrextract(msg, msglen, cp, &dp, name, sizeof name); + if (n < 0) { formerrmsg = outofDataFinal; goto formerr; } - tempcp += n; - GETSHORT(type, tempcp); - GETSHORT(class, tempcp); - if (!ns_nameok(name, class, response_trans, - ns_ownercontext(type, response_trans))) { - formerrmsg = badNameFound; - goto formerr; - } - - /* - * See if there are any NS RRs in the authority section - * for the negative caching logic below. We'll count - * these before validation. - */ - if (type == T_NS && i >= ancount && i < ancount + aucount) - nscount++; + cp += n; + if (!dp) + continue; + type = dp->d_type; + if (i < ancount) { + /* Answer section. */ + if (strcasecmp(name, aname) != 0) { + syslog(LOG_DEBUG, "wrong ans. name (%s != %s)", + name, aname); + db_free(dp); + continue; + } + if (type == T_CNAME && + qtype != T_CNAME && qtype != T_ANY) { + strcpy(aname, (char *)dp->d_data); + cname = 1; + lastwascname = 1; + } else { + validanswer = 1; + lastwascname = 0; + } - /* Decide what credibility this ought to have in the cache. */ - if (i < ancount) - cred = (hp->aa && !strcasecmp(name, qname)) + dp->d_cred = (hp->aa && !strcasecmp(name, qname)) ? DB_C_AUTH : DB_C_ANSWER; - else - cred = (qp->q_flags & Q_PRIMING) - ? DB_C_ANSWER - : DB_C_ADDITIONAL; -#ifdef VALIDATE - if ((n = dovalidate(msg, msglen, cp, 0, - dbflags, qp->q_domain, server, - &VCode)) < 0) { - formerrmsg = outofDataFinal; - goto formerr; - } - if (VCode == INVALID && !(qp->q_flags & Q_SYSTEM)) { - /* - * If anything in the answer section fails - * validation this means that it definitely did - * not reside below the domain owning the NS RRs - * that we sent the query to. This means either - * that it was the target of a CNAME early in the - * response, in which case we will treat this the - * same as if the answer was incomplete and restart - * the query on the CNAME target, or that someone - * was trying to spoof us. - */ - if (i < ancount) - restart = 1; - /* - * Restart or no, if we're here it means we are not - * going to cache this RR. That being the case, we - * must burn down whatever partial RRset we've got - * in the cache now, lest we inadvertently answer - * with a truncated RRset in some future section. - */ - for (c = 0; c < defer_rm_count; c++) - if (!strcasecmp(defer_rm[c].name, name) && - defer_rm[c].class == class && - defer_rm[c].type == type) - break; - if (c < defer_rm_count) { - if (defer_rm[c].cred < cred) - defer_rm[c].cred = cred; - } else { - if (defer_rm_count+1 >= - (sizeof defer_rm / sizeof defer_rm[0])) { - formerrmsg = "too many RRs in ns_resp"; - goto formerr; - } - defer_rm[defer_rm_count].name = savestr(name); - defer_rm[defer_rm_count].type = type; - defer_rm[defer_rm_count].class = class; - defer_rm[defer_rm_count].cred = cred; - defer_rm_count++; - } } else { -#endif - if (i < ancount) { - /* - * If there are any non-CNAME RRs (or - * CNAME RRs if they are an acceptable) - * then the query is complete unless an - * intermediate CNAME didn't pass validation, - * but that's OK. - */ - if (type != T_CNAME || qtype == T_CNAME || - qtype == T_ANY) - validanswer = 1; - else - cname = 1; - } - n = doupdate(msg, msglen, cp, 0, &ns3, dbflags, cred); -#ifdef VALIDATE - } -#endif - if (n < 0) { - dprintf(1, (ddt, "resp: leaving, doupdate failed\n")); - formerrmsg = outofDataFinal; - goto formerr; - } - cp += n; - } -#ifdef VALIDATE - if (defer_rm_count > 0) { - for (i = 0; i < defer_rm_count; i++) { - register struct databuf *db = NULL; - - fname = ""; - htp = hashtab; /* lookup relative to root */ - np = nlookup(defer_rm[i].name, &htp, &fname, 0); - if (np && fname == defer_rm[i].name && - defer_rm[i].class != C_ANY && - defer_rm[i].type != T_ANY) { - /* - * If doupdate() wouldn't have cached this - * RR anyway, there's no need to delete it. - */ - for (db = np->n_data; - db != NULL; - db = db->d_next) { - if (!db->d_zone && - match(db, defer_rm[i].class, - defer_rm[i].type) && - db->d_cred >= defer_rm[i].cred) { - break; - } + /* After answer section. */ + if (lastwascname) { + db_free(dp); + break; + } + if (i < ancount + aucount && type == T_NS) { + /* Authority section. */ + if (!samedomain(aname, name) || + (!cname && !samedomain(name, qp->q_domain)) + ) { + syslog(LOG_DEBUG, + "bad referral (%s !< %s)", + name, qp->q_domain); + db_free(dp); + continue; } - if (db == NULL) - delete_all(np, defer_rm[i].class, - defer_rm[i].type); - /* XXX: should delete name node if empty? */ + nscount++; } - syslog(LOG_DEBUG, "defer_rm [%s %s %s] (np%#x, db%#x)", - defer_rm[i].name, - p_class(defer_rm[i].class), - p_type(defer_rm[i].type), - np, db); - free(defer_rm[i].name); + dp->d_cred = (qp->q_flags & Q_PRIMING) + ? DB_C_ANSWER + : DB_C_ADDITIONAL; } + rrsetadd(flushset, name, dp); } -#endif + if (flushset) { + rrsetupdate(flushset, dbflags); + for (i = 0; i < count; i++) + if (flushset[i].fs_name) + free(flushset[i].fs_name); + free((char*)flushset); + } + if (lastwascname) + syslog(LOG_DEBUG, "%s (%s)", danglingCname, aname); if (cp > eom) { formerrmsg = outofDataAFinal; @@ -886,8 +842,22 @@ ns_resp(msg, msglen) } if ((qp->q_flags & Q_SYSTEM) && ancount) { - if (qp->q_flags & Q_PRIMING) - check_root(); + if ((qp->q_flags & Q_PRIMING) && !check_root()) { + /* mark server as bad */ + if (!qp->q_fwd) + for (i = 0; i < (int)qp->q_naddr; i++) + if (qp->q_addr[i].ns_addr.sin_addr.s_addr + == from_addr.sin_addr.s_addr) + qp->q_addr[i].nretry = MAXRETRY; + /* XXX - doesn't handle responses sent from + * the wronginterface on a multihomed server + */ + if (qp->q_fwd || + qp->q_addr[qp->q_curaddr].ns_addr.sin_addr.s_addr + == from_addr.sin_addr.s_addr) + retry(qp); + return; + } dprintf(3, (ddt, "resp: leaving, SYSQUERY ancount %d\n", ancount)); #ifdef BIND_NOTIFY @@ -949,12 +919,6 @@ ns_resp(msg, msglen) (hp->aa || fwd || qclass == C_ANY)) { /* we have an authoritative NO */ dprintf(3, (ddt, "resp: leaving auth NO\n")); - if (qp->q_cmsglen) { - /* XXX - what about additional CNAMEs in the chain? */ - msg = qp->q_cmsg; - msglen = qp->q_cmsglen; - hp = (HEADER *)msg; - } #ifdef NCACHE /* answer was NO */ if (hp->aa && @@ -962,6 +926,12 @@ ns_resp(msg, msglen) cache_n_resp(msg, msglen); } #endif /*NCACHE*/ + if (qp->q_cmsglen) { + /* XXX - what about additional CNAMEs in the chain? */ + msg = qp->q_cmsg; + msglen = qp->q_cmsglen; + hp = (HEADER *)msg; + } goto return_msg; } @@ -995,6 +965,7 @@ ns_resp(msg, msglen) hp->ancount = htons(0); hp->nscount = htons(0); hp->arcount = htons(0); + hp->rcode = NOERROR; dnptrs[0] = newmsg; dnptrs[1] = NULL; cp = newmsg + HFIXEDSZ; @@ -1037,6 +1008,20 @@ ns_resp(msg, msglen) n = finddata(np, qclass, qtype, hp, &dname, &buflen, &count); if (n == 0) goto fetch_ns; /* NO data available */ +#ifdef NCACHE + if (hp->rcode) { + if (hp->rcode == NOERROR_NODATA) + hp->rcode = NOERROR; +#ifdef RETURNSOA + if (count) { + cp += n; + buflen -= n; + hp->nscount = htons((u_int16_t)count); + } +#endif + goto return_newmsg; + } +#endif cp += n; buflen -= n; hp->ancount = htons(ntohs(hp->ancount) + (u_int16_t)count); @@ -1060,9 +1045,7 @@ ns_resp(msg, msglen) * section or record the address for forwarding the query * (recursion desired). */ -#ifdef DATUMREFCNT free_nsp(nsp); -#endif switch (findns(&np, qclass, nsp, &count, 0)) { case NXDOMAIN: /* shouldn't happen */ dprintf(3, (ddt, "req: leaving (%s, rcode %d)\n", @@ -1071,11 +1054,7 @@ ns_resp(msg, msglen) hp->rcode = NXDOMAIN; if (qclass != C_ANY) { hp->aa = 1; - /* XXX: should return SOA if founddata == 0, - * but old named's are confused by an SOA - * in the auth. section if there's no error. - */ - if (foundname == 0 && np) { + if (np && (!foundname || !founddata)) { n = doaddauth(hp, cp, buflen, np, nsp[0]); cp += n; buflen -= n; @@ -1114,45 +1093,15 @@ ns_resp(msg, msglen) } /* Reset the query control structure */ -#ifdef DATUMREFCNT - /* XXX - this code should be shared with qfree()'s similar logic. */ - for (i = 0; (u_int)i < qp->q_naddr; i++) { - static const char freed[] = "freed", busy[] = "busy"; - const char *result; - - if (qp->q_addr[i].ns != NULL) { - if ((--(qp->q_addr[i].ns->d_rcnt))) - result = busy; - else - result = freed; - dprintf(1, (ddt, "ns_resp: ns %s rcnt %d (%s)\n", - qp->q_addr[i].ns->d_data, - qp->q_addr[i].ns->d_rcnt, - result)); - if (result == freed) - free((char*)qp->q_addr[i].ns); - } - if (qp->q_addr[i].nsdata != NULL) { - if ((--(qp->q_addr[i].nsdata->d_rcnt))) - result = busy; - else - result = freed; - dprintf(1, (ddt, - "ns_resp: nsdata %08.8X rcnt %d (%s)\n", - *(int32_t *)(qp->q_addr[i].nsdata->d_data), - qp->q_addr[i].nsdata->d_rcnt, - result)); - if (result == freed) - free((char*)qp->q_addr[i].nsdata); - } - } -#endif + + nsfree(qp, "ns_resp"); qp->q_naddr = 0; qp->q_curaddr = 0; qp->q_fwd = fwdtab; -#if defined(LAME_DELEGATION) || defined(VALIDATE) - getname(np, qp->q_domain, sizeof(qp->q_domain)); -#endif /* LAME_DELEGATION */ + + getname(np, tmpdomain, sizeof tmpdomain); + qp->q_domain = strdup(tmpdomain); + if ((n = nslookup(nsp, qp, dname, "ns_resp")) <= 0) { if (n < 0) { dprintf(3, (ddt, "resp: nslookup reports danger\n")); @@ -1243,9 +1192,7 @@ ns_resp(msg, msglen) #endif nameserIncr(qp->q_from.sin_addr, nssRcvdFwdR); dprintf(3, (ddt, "resp: Query sent.\n")); -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return; formerr: @@ -1256,9 +1203,7 @@ ns_resp(msg, msglen) #ifdef XSTATS nameserIncr(from_addr.sin_addr, nssSentFErr); #endif -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return; return_msg: @@ -1273,9 +1218,7 @@ ns_resp(msg, msglen) hp->ra = (NoRecurse == 0); (void) send_msg(msg, msglen, qp); qremove(qp); -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return; return_newmsg: @@ -1296,9 +1239,7 @@ ns_resp(msg, msglen) hp->ra = (NoRecurse == 0); (void) send_msg(newmsg, cp - newmsg, qp); qremove(qp); -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return; servfail: @@ -1315,42 +1256,31 @@ ns_resp(msg, msglen) qp); timeout: qremove(qp); -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return; } -/* - * Decode the resource record 'rrp' and update the database. - * If savens is non-nil, record pointer for forwarding queries a second time. - */ -int -doupdate(msg, msglen, rrp, zone, savens, flags, cred) - u_char *msg, *rrp; - struct databuf **savens; - int msglen, zone, flags; - u_int cred; +static int +rrextract(msg, msglen, rrp, dpp, dname, namelen) + u_char *msg; + int msglen; + u_char *rrp; + struct databuf **dpp; + char *dname; + int namelen; { register u_char *cp; register int n; int class, type, dlen, n1; u_int32_t ttl; - struct databuf *dp; - char dname[MAXDNAME]; u_char *cp1; u_char data[BUFSIZ]; register HEADER *hp = (HEADER *)msg; enum context context; -#ifdef ALLOW_UPDATES - int zonenum; -#endif - - dprintf(3, (ddt, "doupdate(zone %d, savens %#lx, flags %#lx)\n", - zone, (u_long)savens, (u_long)flags)); + *dpp = NULL; cp = rrp; - if ((n = dn_expand(msg, msg + msglen, cp, dname, sizeof dname)) < 0) { + if ((n = dn_expand(msg, msg + msglen, cp, dname, namelen)) < 0) { hp->rcode = FORMERR; return (-1); } @@ -1360,15 +1290,29 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) GETLONG(ttl, cp); GETSHORT(dlen, cp); if (!ns_nameok(dname, class, response_trans, - ns_ownercontext(type, response_trans))) { + ns_ownercontext(type, response_trans), + dname, from_addr.sin_addr)) { hp->rcode = FORMERR; return (-1); } - dprintf(3, (ddt, "doupdate: dname %s type %d class %d ttl %d\n", + dprintf(3, (ddt, "rrextract: dname %s type %d class %d ttl %d\n", dname, type, class, ttl)); /* * Convert the resource record data into the internal * database format. + * + * On entry to the switch: + * CP points to the RDATA section of the wire-format RR. + * DLEN is its length. + * The memory area at DATA is available for processing. + * + * On exit from the switch: + * CP has been incremented past the RR. + * CP1 points to the RDATA section of the database-format RR. + * N contains the length of the RDATA section of the dbase-format RR. + * + * The new data at CP1 for length N will be copied into the database, + * so it need not be in any particular storage location. */ switch (type) { case T_A: @@ -1388,6 +1332,7 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) case T_NSAP: case T_AAAA: case T_LOC: + case T_KEY: #ifdef ALLOW_T_UNSPEC case T_UNSPEC: #endif @@ -1409,9 +1354,8 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) return (-1); } if (!ns_nameok((char *)data, class, response_trans, - (type == T_PTR) - ? ns_ptrcontext(dname) - : domain_ctx)) { + type == T_PTR ?ns_ptrcontext(dname) :domain_ctx, + dname, from_addr.sin_addr)) { hp->rcode = FORMERR; return (-1); } @@ -1434,7 +1378,8 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) hp->rcode = FORMERR; return (-1); } - if (!ns_nameok((char *)data, class, response_trans, context)) { + if (!ns_nameok((char *)data, class, response_trans, context, + dname, from_addr.sin_addr)) { hp->rcode = FORMERR; return (-1); } @@ -1452,7 +1397,8 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) context = domain_ctx; else context = mailname_ctx; - if (!ns_nameok((char *)cp1, class, response_trans, context)) { + if (!ns_nameok((char *)cp1, class, response_trans, context, + dname, from_addr.sin_addr)) { hp->rcode = FORMERR; return (-1); } @@ -1467,23 +1413,76 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) cp1 = data; break; + case T_NAPTR: + /* Grab weight and port. */ + bcopy(cp, data, INT16SZ*2); + cp1 = data + INT16SZ*2; + cp += INT16SZ*2; + + /* Flags */ + n = *cp++; + *cp1++ = n; + bcopy(cp, cp1, n); + cp += n; cp1 += n; + + /* Service */ + n = *cp++; + *cp1++ = n; + bcopy(cp, cp1, n); + cp += n; cp1 += n; + + /* Regexp */ + n = *cp++; + *cp1++ = n; + bcopy(cp, cp1, n); + cp += n; cp1 += n; + + /* Replacement */ + n = dn_expand(msg, msg + msglen, cp, (char *)cp1, + sizeof data - (cp1 - data)); + if (n < 0) { + hp->rcode = FORMERR; + return (-1); + } + if (!ns_nameok((char *)cp1, class, response_trans, + hostname_ctx, dname, from_addr.sin_addr)) { + hp->rcode = FORMERR; + return (-1); + } + cp += n; + + /* compute end of data */ + cp1 += strlen((char *)cp1) + 1; + /* compute size of data */ + n = cp1 - data; + cp1 = data; + break; + case T_MX: case T_AFSDB: case T_RT: + case T_SRV: /* grab preference */ bcopy(cp, data, INT16SZ); cp1 = data + INT16SZ; cp += INT16SZ; + if (type == T_SRV) { + /* Grab weight and port. */ + bcopy(cp, data, INT16SZ*2); + cp1 += INT16SZ*2; + cp += INT16SZ*2; + } + /* get name */ n = dn_expand(msg, msg + msglen, cp, (char *)cp1, - sizeof data - INT16SZ); + sizeof data - (cp1 - data)); if (n < 0) { hp->rcode = FORMERR; return (-1); } if (!ns_nameok((char *)cp1, class, response_trans, - hostname_ctx)) { + hostname_ctx, dname, from_addr.sin_addr)) { hp->rcode = FORMERR; return (-1); } @@ -1510,7 +1509,7 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) return (-1); } if (!ns_nameok((char *)cp1, class, response_trans, - domain_ctx)) { + domain_ctx, dname, from_addr.sin_addr)) { hp->rcode = FORMERR; return (-1); } @@ -1523,7 +1522,7 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) return (-1); } if (!ns_nameok((char *)cp1, class, response_trans, - domain_ctx)) { + domain_ctx, dname, from_addr.sin_addr)) { hp->rcode = FORMERR; return (-1); } @@ -1533,6 +1532,84 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) cp1 = data; break; + case T_SIG: { + u_long origTTL, exptime, signtime, timetilexp, now; + + /* Check signature time, expiration, and adjust TTL. */ + /* This code is similar to that in db_load.c. */ + + /* Skip coveredType, alg, labels */ + cp1 = cp + INT16SZ + 1 + 1; + GETLONG(origTTL, cp1); + GETLONG(exptime, cp1); + GETLONG(signtime, cp1); + now = time(NULL); /* Get current time in GMT/UTC */ + + /* Don't let bogus name servers increase the signed TTL */ + if (ttl > origTTL) { + dprintf(3, (ddt, + "shrinking SIG TTL from %d to origTTL %d\n", + ttl, origTTL)); + ttl = origTTL; + } + + /* Don't let bogus signers "sign" in the future. */ + if (signtime > now) { + dprintf(3, (ddt, + "ignoring SIG: signature date %s is in the future\n", + p_secstodate (signtime))); + return ((cp - rrp) + dlen); + } + + /* Ignore received SIG RR's that are already expired. */ + if (exptime <= now) { + dprintf(3, (ddt, + "ignoring SIG: expiration %s is in the past\n", + p_secstodate (exptime))); + return ((cp - rrp) + dlen); + } + + /* Lop off the TTL at the expiration time. */ + timetilexp = exptime - now; + if (timetilexp < ttl) { + dprintf(3, (ddt, + "shrinking expiring %s SIG TTL from %d to %d\n", + p_secstodate (exptime), ttl, timetilexp)); + ttl = timetilexp; + } + + /* The following code is copied from named-xfer.c. */ + cp1 = (u_char *)data; + + /* first just copy over the type_covered, algorithm, */ + /* labels, orig ttl, two timestamps, and the footprint */ + bcopy(cp, cp1, 18); + cp += 18; + cp1 += 18; + + /* then the signer's name */ + n = dn_expand(msg, msg + msglen, cp, + (char *)cp1, (sizeof data) - 18); + if (n < 0) + return (-1); + cp += n; + cp1 += strlen((char*)cp1)+1; + + /* finally, we copy over the variable-length signature. + Its size is the total data length, minus what we copied. */ + n = dlen - (18 + n); + if (n > (sizeof data) - (cp1 - (u_char *)data)) + return (-1); /* out of room! */ + bcopy(cp, cp1, n); + cp += n; + cp1 += n; + + /* compute size of data */ + n = cp1 - (u_char *)data; + cp1 = (u_char *)data; + break; + } + default: dprintf(3, (ddt, "unknown type %d\n", type)); return ((cp - rrp) + dlen); @@ -1545,157 +1622,45 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) return (-1); } -#ifdef ALLOW_UPDATES - /* - * If this is a dynamic update request, process it specially; else, - * execute normal update code. - */ - switch(hp->opcode) { + ttl += tt.tv_sec; - /* For UPDATEM and UPDATEMA, do UPDATED/UPDATEDA followed by UPDATEA */ - case UPDATEM: - case UPDATEMA: + *dpp = savedata(class, type, ttl, cp1, n); + return (cp - rrp); +} - /* - * The named code for UPDATED and UPDATEDA is the same except that for - * UPDATEDA we we ignore any data that was passed: we just delete all - * RRs whose name, type, and class matches - */ - case UPDATED: - case UPDATEDA: - if (type == T_SOA) { /* Not allowed */ - dprintf(1, (ddt, "UDPATE: REFUSED - SOA delete\n")); - hp->rcode = REFUSED; - return (-1); - } - /* - * Don't check message length if doing UPDATEM/UPDATEMA, - * since the whole message wont have been demarshalled until - * we reach the code for UPDATEA - */ - if ( (hp->opcode == UPDATED) || (hp->opcode == UPDATEDA) ) { - if (cp != (u_char *)(msg + msglen)) { - dprintf(1, (ddt, - "FORMERR UPDATE message length off\n" - )); - hp->rcode = FORMERR; - return (-1); - } - } - if ((zonenum = findzone(dname, class)) == 0) { - hp->rcode = NXDOMAIN; - return (-1); - } - if (zones[zonenum].z_flags & Z_DYNADDONLY) { - hp->rcode = NXDOMAIN; - return (-1); - } - if ( (hp->opcode == UPDATED) || (hp->opcode == UPDATEM) ) { - /* Make a dp for use in db_update, as old dp */ - dp = savedata(class, type, 0, cp1, n); - dp->d_zone = zonenum; - dp->d_cred = cred; - dp->d_clev = db_getclev(zones[zonenum].z_origin); - n = db_update(dname, dp, NULL, DB_MEXIST | DB_DELETE, - hashtab); - if (n != OK) { - dprintf(1, (ddt, - "UPDATE: db_update failed\n")); - free((char*) dp); - hp->rcode = NOCHANGE; - return (-1); - } - } else { /* UPDATEDA or UPDATEMA */ - int DeletedOne = 0; - /* Make a dp for use in db_update, as old dp */ - dp = savedata(class, type, 0, NULL, 0); - dp->d_zone = zonenum; - dp->d_cred = cred; - dp->d_clev = db_getclev(zones[zonenum].z_origin); - do { /* Loop and delete all matching RR(s) */ - n = db_update(dname, dp, NULL, DB_DELETE, - hashtab); - if (n != OK) - break; - DeletedOne++; - } while (1); - free((char*) dp); - /* Ok for UPDATEMA not to have deleted any RRs */ - if (!DeletedOne && hp->opcode == UPDATEDA) { - dprintf(1, (ddt, - "UPDATE: db_update failed\n")); - hp->rcode = NOCHANGE; - return (-1); - } - } - if ( (hp->opcode == UPDATED) || (hp->opcode == UPDATEDA) ) - return (cp - rrp);; - /* - * Else unmarshal the RR to be added and continue on to - * UPDATEA code for UPDATEM/UPDATEMA - */ - if ((n = - dn_expand(msg, msg+msglen, cp, dname, sizeof(dname))) < 0) { - dprintf(1, (ddt, - "FORMERR UPDATE expand name failed\n")); - hp->rcode = FORMERR; - return (-1); - } - cp += n; - GETSHORT(type, cp); - GETSHORT(class, cp); - GETLONG(ttl, cp); - GETSHORT(n, cp); - cp1 = cp; -/**** XXX - need bounds checking here ****/ - cp += n; +/* + * Decode the resource record 'rrp' and update the database. + * If savens is non-nil, record pointer for forwarding queries a second time. + */ +int +doupdate(msg, msglen, rrp, zone, savens, flags, cred) + u_char *msg; + int msglen; + u_char *rrp; + int zone; + struct databuf **savens; + int flags; + u_int cred; +{ + register u_char *cp; + register int n; + int class, type; + struct databuf *dp; + char dname[MAXDNAME]; + u_char data[BUFSIZ+MAX_MD5RSA_KEY_BYTES]; - case UPDATEA: - if (n > MAXDATA) { - dprintf(1, (ddt, "UPDATE: too much data\n")); - hp->rcode = NOCHANGE; - return (-1); - } - if (cp != (u_char *)(msg + msglen)) { - dprintf(1, (ddt, - "FORMERR UPDATE message length off\n")); - hp->rcode = FORMERR; - return (-1); - } - if ((zonenum = findzone(dname, class)) == 0) { - hp->rcode = NXDOMAIN; - return (-1); - } - if (zones[zonenum].z_flags & Z_DYNADDONLY) { - struct hashbuf *htp = hashtab; - char *fname; - if (nlookup(dname, &htp, &fname, 0) && - !strcasecmp(dname, fname)) { - dprintf(1, (ddt, - "refusing add of existing name\n" - )); - hp->rcode = REFUSED; - return (-1); - } - } - dp = savedata(class, type, ttl, cp1, n); - dp->d_zone = zonenum; - dp->d_cred = cred; - dp->d_clev = db_getclev(zones[zonenum].z_origin); - if ((n = db_update(dname, NULL, dp, DB_NODATA, - hashtab)) != OK) { - dprintf(1, (ddt, "UPDATE: db_update failed\n")); - hp->rcode = NOCHANGE; - free((char*) dp); - return (-1); - } - else - return (cp - rrp); - } -#endif /* ALLOW_UPDATES */ + dprintf(3, (ddt, "doupdate(zone %d, savens %#lx, flags %#lx)\n", + zone, (u_long)savens, (u_long)flags)); + + if ((n = rrextract(msg, msglen, rrp, &dp, dname, sizeof(dname))) == -1) + return (-1); + if (!dp) + return (-1); + + type = dp->d_type; + class = dp->d_class; + cp = rrp + n; - if (zone == 0) - ttl += tt.tv_sec; #if defined(TRACEROOT) || defined(BOGUSNS) if ((type == T_NS) && (savens != NULL)) { char *temp, qname[MAXDNAME]; @@ -1724,6 +1689,7 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) syslog(LOG_NOTICE, "bogus root NS %s rcvd from %s on query for \"%s\"", data, sin_ntoa(&from_addr), qname); + db_free(dp); return (cp - rrp); } #ifdef BOGUSNS @@ -1733,13 +1699,13 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) syslog(LOG_INFO, "bogus nonroot NS %s rcvd from %s on query for \"%s\"", data, sin_ntoa(&from_addr), qname); + db_free(dp); return (cp - rrp); } #endif } #endif /*TRACEROOT || BOGUSNS*/ - dp = savedata(class, type, ttl, cp1, n); dp->d_zone = zone; dp->d_cred = cred; dp->d_clev = 0; /* We trust what is on disk more, except root srvrs */ @@ -1750,7 +1716,7 @@ doupdate(msg, msglen, rrp, zone, savens, flags, cred) else if (debug >= 3) fprintf(ddt, "update failed (DATAEXISTS)\n"); #endif - free((char *)dp); + db_free(dp); } else if (type == T_NS && savens != NULL) *savens = dp; return (cp - rrp); @@ -1984,7 +1950,7 @@ sysnotify(dname, class, type) } /*next NS*/ done: if (nns || na) { - char tmp[MAXDNAME*2]; + char tmp[MAXDNAME]; /* Many syslog()'s only take 5 args. */ sprintf(tmp, "%s %s %s", dname, p_class(class), p_type(type)); @@ -2003,6 +1969,7 @@ sysquery(dname, class, type, nss, nsc, opcode) { register struct qinfo *qp, *oqp; register HEADER *hp; + char tmpdomain[MAXDNAME]; struct namebuf *np; struct databuf *nsp[NSMAX]; struct hashbuf *htp; @@ -2010,12 +1977,10 @@ sysquery(dname, class, type, nss, nsc, opcode) const char *fname; int n, count; -#ifdef DATUMREFCNT nsp[0] = NULL; -#endif dprintf(3, (ddt, "sysquery(%s, %d, %d, %#lx, %d)\n", dname, class, type, (u_long)nss, nsc)); - qp = qnew(); + qp = qnew(dname, class, type); if (nss && nsc) { np = NULL; @@ -2035,12 +2000,10 @@ sysquery(dname, class, type, nss, nsc, opcode) switch (n) { case NXDOMAIN: case SERVFAIL: - syslog(LOG_DEBUG, "sysquery: findns error (%d) on %s?", - n, dname); + syslog(LOG_DEBUG, "sysquery: findns error (%s) on %s?", + n == NXDOMAIN ? "NXDOMAIN" : "SERVFAIL", dname); err2: -#ifdef DATUMREFCNT free_nsp(nsp); -#endif goto err1; } } @@ -2054,9 +2017,11 @@ sysquery(dname, class, type, nss, nsc, opcode) qp->q_fwd = fwdtab; qp->q_expire = tt.tv_sec + RETRY_TIMEOUT*2; qp->q_flags |= Q_SYSTEM; -#if defined(LAME_DELEGATION) || defined(VALIDATE) - getname(np, qp->q_domain, sizeof(qp->q_domain)); -#endif /* LAME_DELEGATION */ + + getname(np, tmpdomain, sizeof tmpdomain); + qp->q_domain = strdup(tmpdomain); + if (!qp->q_domain) + panic(ENOMEM, "ns_resp: strdup failed"); if ((qp->q_msg = (u_char *)malloc(BUFSIZ)) == NULL) { syslog(LOG_NOTICE, "sysquery: malloc failed"); @@ -2129,10 +2094,8 @@ sysquery(dname, class, type, nss, nsc, opcode) goto err2; } if (np) { -#ifdef DATUMREFCNT free_nsp(nsp); nsp[0] = NULL; -#endif np = np_parent(np); n = findns(&np, class, nsp, &count, 0); switch (n) { @@ -2172,9 +2135,7 @@ sysquery(dname, class, type, nss, nsc, opcode) nameserIncr(nsa->sin_addr, nssSendtoErr); } nameserIncr(nsa->sin_addr, nssSentSysQ); -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (qp); } @@ -2182,7 +2143,7 @@ sysquery(dname, class, type, nss, nsc, opcode) * Check the list of root servers after receiving a response * to a query for the root servers. */ -static void +static int check_root() { register struct databuf *dp, *pdp; @@ -2195,7 +2156,7 @@ check_root() break; if (np == NULL) { syslog(LOG_NOTICE, "check_root: Can't find root!\n"); - return; + return (0); } for (dp = np->n_data; dp != NULL; dp = dp->d_next) if (dp->d_type == T_NS) @@ -2205,7 +2166,7 @@ check_root() syslog(LOG_NOTICE, "check_root: %d root servers after query to root server < min", count); - return; + return (0); } pdp = NULL; dp = np->n_data; @@ -2221,13 +2182,18 @@ check_root() pdp = dp; dp = dp->d_next; } - check_ns(); + if (check_ns()) + return (1); + else { + priming = 1; + return (0); + } } /* * Check the root to make sure that for each NS record we have a A RR */ -static void +static int check_ns() { register struct databuf *dp, *tdp; @@ -2237,6 +2203,7 @@ check_ns() int found_arr; const char *fname; time_t curtime; + int servers = 0, rrsets = 0; dprintf(2, (ddt, "check_ns()\n")); @@ -2245,9 +2212,17 @@ check_ns() if (NAME(*np)[0] != '\0') continue; for (dp = np->n_data; dp != NULL; dp = dp->d_next) { + int cnames = 0; + +#ifdef NCACHE + if (dp->d_rcode) + continue; +#endif if (dp->d_type != T_NS) continue; + servers++; + /* look for A records */ dname = (caddr_t) dp->d_data; htp = hashtab; @@ -2262,7 +2237,16 @@ check_ns() } /* look for name server addresses */ found_arr = 0; - for (tdp=tnp->n_data; tdp != NULL; tdp=tdp->d_next) { + delete_stale(tnp); + for (tdp = tnp->n_data; + tdp != NULL; + tdp = tdp->d_next) { +#ifdef NCACHE + if (tdp->d_rcode) + continue; +#endif + if (tdp->d_type == T_CNAME) + cnames++; if (tdp->d_type != T_A || tdp->d_class != dp->d_class) continue; @@ -2271,22 +2255,28 @@ check_ns() dprintf(3, (ddt, "check_ns: stale entry '%s'\n", NAME(*tnp))); - /* Cache invalidate the address RR's */ - delete_all(tnp, dp->d_class, T_A); found_arr = 0; break; } found_arr++; } - if (!found_arr) + if (found_arr) + rrsets++; + else if (cnames > 0) + syslog(LOG_INFO, "Root NS %s -> CNAME %s", + NAME(*np), NAME(*tnp)); + else sysquery(dname, dp->d_class, T_A, NULL, 0, QUERY); } } + + dprintf(2, (ddt, "check_ns: %d %d\n", servers, rrsets)); + return ((servers<=2)?(rrsets==servers):((rrsets*2)>=servers)); } /* int findns(npp, class, nsp, countp, flag) - * Find NS' or an SOA + * Find NS's or an SOA * npp, class: * dname whose most enclosing NS is wanted * nsp, countp: @@ -2295,8 +2285,11 @@ check_ns() * boolean: we're being called from ADDAUTH, bypass authority checks * return value: * NXDOMAIN: we are authoritative for this {dname,class} + * *countp is bogus, but nsp[] has a single SOA returned in it. * SERVFAIL: we are auth but zone isn't loaded; or, no root servers found - * OK: success (this is the only case where *countp and nsp[] are valid) + * *countp and nsp[] are bogus. + * OK: we are not authoritative, and here are the NS records we found. + * *countp and nsp[] return NS records of interest. */ int findns(npp, class, nsp, countp, flag) @@ -2311,9 +2304,7 @@ findns(npp, class, nsp, countp, flag) register struct databuf **nspp; struct hashbuf *htp; -#ifdef DATUMREFCNT nsp[0] = NULL; -#endif if (priming && (np == NULL || NAME(*np)[0] == '\0')) htp = fcachetab; @@ -2347,10 +2338,8 @@ findns(npp, class, nsp, countp, flag) if (zones[dp->d_zone].z_flags & Z_AUTH) { *npp = np; nsp[0] = dp; -#ifdef DATUMREFCNT nsp[1] = NULL; dp->d_rcnt++; -#endif return (NXDOMAIN); } else { /* XXX: zone isn't loaded but we're @@ -2365,6 +2354,7 @@ findns(npp, class, nsp, countp, flag) /* If no SOA records, look for NS records. */ nspp = &nsp[0]; *nspp = NULL; + delete_stale(np); for (dp = np->n_data; dp != NULL; dp = dp->d_next) { if (!match(dp, class, T_NS)) continue; @@ -2380,15 +2370,10 @@ findns(npp, class, nsp, countp, flag) * XXX: this is horribly bogus. */ if ((dp->d_zone == 0) && -#ifdef DATUMREFCNT (dp->d_ttl < tt.tv_sec) && -#else - (dp->d_ttl < (tt.tv_sec+900)) && -#endif !(dp->d_flags & DB_F_HINT)) { dprintf(1, (ddt, "findns: stale entry '%s'\n", NAME(*np))); -#ifdef DATUMREFCNT /* * We may have already added NS databufs * and are going to throw them away. Fix @@ -2398,20 +2383,12 @@ findns(npp, class, nsp, countp, flag) */ while (nspp > &nsp[0]) (*--nspp)->d_rcnt--; -#endif - /* Cache invalidate the NS RR's. */ -#ifndef DATUMREFCNT - if (dp->d_ttl < tt.tv_sec) -#endif - delete_all(np, class, T_NS); nsp[0] = NULL; goto try_parent; } if (nspp < &nsp[NSMAX-1]) { *nspp++ = dp; -#ifdef DATUMREFCNT dp->d_rcnt++; -#endif } } @@ -2423,7 +2400,7 @@ findns(npp, class, nsp, countp, flag) *npp = np; return (OK); /* Success, got some NS's */ } -try_parent: + try_parent: np = np_parent(np); } if (htp == hashtab) { @@ -2440,6 +2417,7 @@ try_parent: return (SERVFAIL); } + /* * Extract RR's from the given node that match class and type. * Return number of bytes added to response. @@ -2455,7 +2433,9 @@ finddata(np, class, type, hp, dnamep, lenp, countp) { register struct databuf *dp; register char *cp; - int buflen, n, count = 0, foundstale = 0; + int buflen, n, count = 0; + + delete_stale(np); #ifdef ROUND_ROBIN if (type != T_ANY && type != T_PTR) { @@ -2498,33 +2478,20 @@ finddata(np, class, type, hp, dnamep, lenp, countp) #endif /*NCACHE*/ continue; } - if (stale(dp)) { - /* - * Don't use stale data. - * Would like to call delete_all here - * and continue, but the data chain would get - * munged; can't restart, as make_rr has side - * effects (leaving pointers in dnptr). - * Just skip this entry for now - * and call delete_all at the end. - */ - dprintf(3, (ddt, - "finddata: stale entry '%s'\n", - NAME(*np))); - if (dp->d_zone == 0) - foundstale++; - continue; - } if (dp->d_cred == DB_C_ADDITIONAL) { +#ifdef NOADDITIONAL + continue; +#else /* we want to expire additional data very * quickly. current strategy is to cut 5% * off each time it is accessed. this makes - * stale(dp) true faster when this datum is + * stale(dp) true earlier when this datum is * used often. */ dp->d_ttl = tt.tv_sec + 0.95 * (int) (dp->d_ttl - tt.tv_sec); +#endif } #ifdef NCACHE /* -ve $ing stuff, anant@isi.edu @@ -2541,15 +2508,14 @@ finddata(np, class, type, hp, dnamep, lenp, countp) *dnamep, type, class); continue; } - if (type != T_ANY) { - hp->rcode = NOERROR_NODATA; + if (type == T_ANY) + continue; + hp->rcode = NOERROR_NODATA; + if (dp->d_size == 0) { /* !RETURNSOA */ *countp = 0; return 1; /* XXX - we have to report success */ } - /* don't satisfy T_ANY queries from -$ info */ - continue; } -#ifndef RETURNSOA if (dp->d_rcode == NXDOMAIN) { if (count != 0) { /* @@ -2560,17 +2526,20 @@ finddata(np, class, type, hp, dnamep, lenp, countp) *dnamep, type, class); continue; } - if (type != T_ANY) { - hp->rcode = NXDOMAIN; + hp->rcode = NXDOMAIN; + if (dp->d_size == 0) { /* !RETURNSOA */ *countp = 0; return 1; /* XXX - we have to report success */ } - /* don't satisfy T_ANY queries from -$ info */ - continue; } -#endif #endif /*NCACHE*/ + /* Don't put anything but key or sig RR's in response to + requests for key or sig */ + if (((type == T_SIG) || (type == T_KEY)) && + (!((dp->d_type == T_SIG) || (dp->d_type == T_KEY))) ) + continue; + if ((n = make_rr(*dnamep, dp, (u_char *)cp, buflen, 1)) < 0) { hp->tc = 1; *countp = count; @@ -2588,7 +2557,11 @@ finddata(np, class, type, hp, dnamep, lenp, countp) hp->aa = 1; /* XXX */ #endif if (dp->d_type == T_CNAME) { - if (type != T_ANY) { /* or T_NS? */ + /* don't alias if querying for key, sig, nxt, or any */ + if ((type != T_KEY) && + (type != T_SIG) && + (type != T_NXT) && + (type != T_ANY)) { /* or T_NS? */ *dnamep = (caddr_t) dp->d_data; if (dp->d_zone != DB_Z_CACHE && (zones[dp->d_zone].z_flags & Z_AUTH) && @@ -2602,14 +2575,6 @@ finddata(np, class, type, hp, dnamep, lenp, countp) * Cache invalidate the other RR's of same type * if some have timed out */ - if (foundstale) { - delete_all(np, class, type); - /* XXX this isn't right if 'type' is something special - * such as T_AXFR or T_MAILB, since the matching done - * by match() in delete_all() is different from that - * done by wanted() above. - */ - } dprintf(3, (ddt, "finddata: added %d class %d type %d RRs\n", count, class, type)); *countp = count; @@ -2618,19 +2583,25 @@ finddata(np, class, type, hp, dnamep, lenp, countp) /* * Do we want this data record based on the class and type? + * (We always return found unexpired SIG RR's that cover the wanted rrtype.) */ int wanted(dp, class, type) struct databuf *dp; int class, type; { + u_char *cp; + u_int16_t coveredType; + time_t expiration; + dprintf(3, (ddt, "wanted(%#lx, %d, %d) [%s %s]\n", (u_long)dp, class, type, p_class(dp->d_class), p_type(dp->d_type))); if (dp->d_class != class && class != C_ANY) return (0); - if (type == dp->d_type) + /* Must check SIG for expiration below, other matches return OK here. */ + if (type == dp->d_type && (type != T_SIG)) return (1); #ifdef NCACHE /*-ve $ing stuff, for a T_ANY query, we do not want to return @@ -2640,7 +2611,26 @@ wanted(dp, class, type) return (0); #endif + /* First, look at the type of RR. */ switch (dp->d_type) { + + /* Cases to deal with: + T_ANY search, return all unexpired SIGs. + T_SIG search, return all unexpired SIGs. + T_<foo> search, return all unexp SIG <FOO>s. + */ + case T_SIG: + cp = dp->d_data; + GETSHORT(coveredType,cp); + cp += INT16SZ + INT32SZ; /* skip alg, labels, & orig TTL */ + GETLONG(expiration,cp); + + if (type == T_ANY || type == T_SIG || type == coveredType) { + if (expiration > time(0)) + return (1); /* Unexpired matching SIG */ + } + return (0); /* We don't return this SIG. */ + case T_ANY: return (1); case T_CNAME: @@ -2653,6 +2643,7 @@ wanted(dp, class, type) break; #endif } + /* OK, now look at the type of query. */ switch (type) { case T_ANY: return (1); @@ -2713,6 +2704,225 @@ add_data(np, dpp, cp, buflen, countp) return (bytes); } +static void +rrsetadd(flushset, name, dp) + struct flush_set *flushset; + char *name; + struct databuf *dp; +{ + struct flush_set *fs = flushset; + struct db_list *dbl; + + while (fs->fs_name && ( + strcasecmp(fs->fs_name,name) || + (fs->fs_class != dp->d_class) || + (fs->fs_type != dp->d_type) || + (fs->fs_cred != dp->d_cred))) { + fs++; + } + if (!fs->fs_name) { + fs->fs_name = strdup(name); + if (!fs->fs_name) + panic(-1, "rrsetadd: out of memory"); + fs->fs_class = dp->d_class; + fs->fs_type = dp->d_type; + fs->fs_cred = dp->d_cred; + fs->fs_list = NULL; + } + dbl = (struct db_list *)malloc(sizeof(struct db_list)); + if (!dbl) + panic(-1, "rrsetadd: out of memory"); + dbl->db_next = fs->fs_list; + dbl->db_dp = dp; + fs->fs_list = dbl; +} + +static int +ttlcheck(name,dbl) + char *name; + struct db_list *dbl; +{ + int type = dbl->db_dp->d_type; + int class = dbl->db_dp->d_class; + struct hashbuf *htp = hashtab; + const char *fname; + register struct namebuf *np; + struct db_list *dbp = dbl; + struct databuf *dp; + u_int32_t ttl; + int first; + + + np = nlookup(name, &htp, &fname, 0); + if (np == NULL || fname != name || ns_wildcard(NAME(*np))) { + return(1); + } + + /* check that all the ttl's we have are the same, if not return 1 */ + first = 1; + for (dp = np->n_data; dp != NULL; dp = dp->d_next) { + if (!match(dp, class, type)) + continue; + if (first) { + ttl = dp->d_ttl; + first = 0; + } else if (ttl != dp->d_ttl) { + return(1); + } + } + + /* there are no records of this type in the cache */ + if (first) + return(1); + + /* + * the ttls of all records we have in the cache are the same + * if the ttls differ in the new set we don't want it. + */ + + /* check that all the ttl's we have are the same, if not return 0 */ + first = 1; + while (dbp) { + if (first) { + ttl = dbp->db_dp->d_ttl; + first = 0; + } else if (ttl != dbp->db_dp->d_ttl) { + return(0); + } + dbp = dbp->db_next; + } + return(1); +} + +static int +rrsetcmp(name, dbl) + char *name; + struct db_list *dbl; +{ + int type = dbl->db_dp->d_type; + int class = dbl->db_dp->d_class; + struct hashbuf *htp = hashtab; + const char *fname; + register struct namebuf *np; + struct db_list *dbp = dbl; + struct databuf *dp; + int exists = 0; + + + np = nlookup(name, &htp, &fname, 0); + if (np == NULL || fname != name || ns_wildcard(NAME(*np))) { + dprintf(1, (ddt, "rrsetcmp: name not in database\n")); + return(-1); + } + + /* check that all entries in dbl are in the cache */ + while (dbp) { + for (dp = np->n_data; dp != NULL; dp = dp->d_next) { + if (match(dp, class, type)) + exists++; + if (!db_cmp(dp, dbp->db_dp) +#ifdef NOADDITIONAL + && ((dp->d_cred == dbp->db_dp->d_cred) || + (dp->d_cred != DB_C_ADDITIONAL)) +#endif + ) + break; + } + if (!dp) { + dprintf(1, (ddt, "rrsetcmp: %srecord%s in database\n", + exists ? "" : "no ", exists ? " not" : "s")); + return(exists? 1 : -1); + } + dbp = dbp->db_next; + } + + /* Check that all cache entries are in the list. */ + for (dp = np->n_data; dp != NULL; dp = dp->d_next) { + if (!match(dp, class, type)) + continue; +#ifdef NCACHE + if (dp->d_rcode) + return(1); +#endif + dbp = dbl; + while (dbp) { + if (!db_cmp(dp, dbp->db_dp)) + break; + dbp = dbp->db_next; + } + if (!dbp) { + dprintf(1, (ddt, "rrsetcmp: record not in rrset\n")); + return(1); + } + } + dprintf(1, (ddt, "rrsetcmp: rrsets matched\n")); + return(0); +} + +static void +rrsetupdate(flushset, flags) + struct flush_set * flushset; + int flags; +{ + struct flush_set *fs = flushset; + struct db_list *dbp, *odbp; + int n; + + while (fs->fs_name) { + dprintf(1,(ddt, "rrsetupdate: %s\n", + fs->fs_name[0] ? fs->fs_name : ".")); + if ((n = rrsetcmp(fs->fs_name,fs->fs_list)) && + ttlcheck(fs->fs_name,fs->fs_list)) { + if (n > 0) + flushrrset(fs); + + dbp = fs->fs_list; + while (dbp) { + n = db_update(fs->fs_name, dbp->db_dp, + dbp->db_dp, flags, hashtab); + dprintf(1,(ddt, "rrsetupdate: %s %d\n", + fs->fs_name[0] ? fs->fs_name : ".", n)); + if (n != OK) + db_free(dbp->db_dp); + odbp = dbp; + dbp = dbp->db_next; + free((char *)odbp); + } + } else { + dbp = fs->fs_list; + while (dbp) { + db_free(dbp->db_dp); + odbp = dbp; + dbp = dbp->db_next; + free((char *)odbp); + } + } + fs->fs_list = NULL; + fs++; + } +} + +static void +flushrrset(fs) + struct flush_set * fs; +{ + struct databuf *dp; + int n; + + dprintf(1, (ddt, "flushrrset(%s, %s, %s, %d)\n", + fs->fs_name[0]?fs->fs_name:".", p_type(fs->fs_type), + p_class(fs->fs_class), fs->fs_cred)); + dp = savedata(fs->fs_class, fs->fs_type, 0, NULL, 0); + dp->d_zone = 0; + dp->d_cred = fs->fs_cred; + dp->d_clev = 0; + do { + n = db_update(fs->fs_name, dp, NULL, DB_DELETE, hashtab); + dprintf(1, (ddt, "flushrrset: %d\n", n)); + } while (n == OK); + db_free(dp); +} + /* * This is best thought of as a "cache invalidate" function. * It is called whenever a piece of data is determined to have @@ -2741,3 +2951,26 @@ delete_all(np, class, type) dp = dp->d_next; } } + +/* delete_stale(np) + * for all RRs associated with this name, check for staleness (& delete) + * arguments: + * np = pointer to namebuf to be cleaned. + * returns: + * void. + * side effects: + * delete_all() can be called, freeing memory and relinking chains. + */ +void +delete_stale(np) + struct namebuf *np; +{ + struct databuf *dp; + again: + for (dp = np->n_data; dp != NULL; dp = dp->d_next) { + if ((dp->d_zone == 0) && stale(dp)) { + delete_all(np, dp->d_class, dp->d_type); + goto again; + } + } +} diff --git a/contrib/bind/named/ns_stats.c b/contrib/bind/named/ns_stats.c index 9a29fb1..1fe382a 100644 --- a/contrib/bind/named/ns_stats.c +++ b/contrib/bind/named/ns_stats.c @@ -1,6 +1,6 @@ #if !defined(lint) && !defined(SABER) static char sccsid[] = "@(#)ns_stats.c 4.10 (Berkeley) 6/27/90"; -static char rcsid[] = "$Id: ns_stats.c,v 8.7 1996/08/05 08:31:30 vixie Exp $"; +static char rcsid[] = "$Id: ns_stats.c,v 8.8 1996/09/22 00:13:10 vixie Exp $"; #endif /* not lint */ /* @@ -132,11 +132,6 @@ ns_stats() fprintf(f, "%ld\ttime since reset (secs)\n", (long)(timenow - resettime)); -#ifdef DMALLOC - /* malloc statistics */ - dmallocstats(f); -#endif - /* query type statistics */ fprintf(f, "%lu\tUnknown query types\n", (u_long)typestats[0]); for(i=1; i < T_ANY+1; i++) diff --git a/contrib/bind/named/ns_udp.c b/contrib/bind/named/ns_udp.c new file mode 100644 index 0000000..7fb5831 --- /dev/null +++ b/contrib/bind/named/ns_udp.c @@ -0,0 +1,113 @@ +#if !defined(lint) && !defined(SABER) +static char rcsid[] = "$Id: ns_udp.c,v 8.3 1996/08/27 08:33:23 vixie Exp $"; +#endif /* not lint */ + +/* + * Copyright (c) 1996 by Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +#include <sys/types.h> +#include <sys/param.h> +#include <sys/stat.h> +#include <sys/socket.h> +#include <sys/file.h> + +#include <netinet/in.h> +#include <arpa/nameser.h> +#include <arpa/inet.h> + +#include <ctype.h> +#include <errno.h> +#include <stdio.h> +#include <syslog.h> +#include <netdb.h> +#include <nlist.h> +#include <resolv.h> + +#include "named.h" + +void +ns_udp() { +#if defined(CHECK_UDP_SUM) || defined(FIX_UDP_SUM) + struct nlist nl[2]; + int fd; + int sum; + u_long res, offset; + + nl[0].n_name = UDPSUM; + nl[1].n_name = 0; + + if (nlist(KSYMS, nl)) { + dprintf(1, (ddt, "ns_udp: nlist (%s,%s) failed\n", + KSYMS, UDPSUM)); + return; + } + + dprintf(1, (ddt, "ns_udp: %s %d %lu (%ld)\n", + nl[0].n_name, nl[0].n_type, nl[0].n_value, + nl[0].n_value)); + + if (!nl[0].n_type) + return; + + if ((fd = open(KMEM, O_RDWR, 0)) < 0) { + dprintf(1, (ddt, "ns_udp: open %s failed\n", KMEM)); + return; + } + + offset = nl[0].n_value; +#ifdef KMAP + offset &= ((~0UL)>>1); +#endif + + res = lseek(fd, offset, SEEK_SET); + if (res != offset) { + dprintf(1, (ddt, "ns_udp: lseek %ul failed %lu %d\n", + offset, res, errno)); + goto cleanup; + } + + if (read(fd, &sum, sizeof(sum)) != sizeof(sum)) { + dprintf(1, (ddt, "ns_udp: read failed\n")); + goto cleanup; + } + + dprintf(1, (ddt, "ns_udp: %d\n", sum)); + if (sum == 0) { +#ifdef FIX_UDP_SUM + sum = 1; + lseek(fd, offset, SEEK_SET); + if (res != offset) { + dprintf(1, (ddt, "ns_udp: lseek %ul failed %lu %d\n", + offset, res, errno)); + goto cleanup; + } + if (write(fd, &sum, sizeof(sum)) != sizeof(sum)) { + dprintf(1, (ddt, "ns_udp: write failed\n")); + goto cleanup; + } + dprintf(1, (ddt, "ns_udp: set to 1\n")); + syslog(LOG_WARNING, "ns_udp: check sums turned on"); +#else + dprintf(1, (ddt, "ns_udp: Exiting\n")); + syslog(LOG_WARNING, "ns_udp: checksums NOT turned on: Exiting"); + exit(1); +#endif + } +cleanup: + close(fd); +#endif +} diff --git a/contrib/bind/named/ns_validate.c b/contrib/bind/named/ns_validate.c index 00df9d7..1192471 100644 --- a/contrib/bind/named/ns_validate.c +++ b/contrib/bind/named/ns_validate.c @@ -116,9 +116,7 @@ validate(dname, qdomain, server, type, class, data, dlen int exactmatch = 0; struct fwdinfo *fwd; -#ifdef DATUMREFCNT nsp[0] = NULL; -#endif dprintf(3, (ddt, "validate(), d:%s, s:[%s], t:%d, c:%d\n", dname, inet_ntoa(server->sin_addr), type, class)); @@ -155,9 +153,7 @@ validate(dname, qdomain, server, type, class, data, dlen * in either case, do not cache **/ dprintf(5, (ddt, "validate: auth data found\n")); -#ifdef DATUMREFCNT free_nsp(nsp); -#endif if (needs_prime_cache) needs_prime_cache = 0; @@ -211,9 +207,7 @@ validate(dname, qdomain, server, type, class, data, dlen /* stick_in_queue(dname, type, class, data); */ if (needs_prime_cache) needs_prime_cache = 0; -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (INVALID); case OK: /*proceed */ @@ -222,21 +216,15 @@ validate(dname, qdomain, server, type, class, data, dlen needs_prime_cache = 0; if (samedomain(dname, qdomain) || check_addr_ns(nsp, server, dname)) { -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (VALID_CACHE); } /* server is not one of those we know of */ /* stick_in_queue(dname, type, class, data); */ -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (INVALID); default: -#ifdef DATUMREFCNT free_nsp(nsp); -#endif return (INVALID); } /*switch*/ diff --git a/contrib/bind/res/Makefile b/contrib/bind/res/Makefile index fe9f399..8aaabab 100644 --- a/contrib/bind/res/Makefile +++ b/contrib/bind/res/Makefile @@ -1,6 +1,6 @@ # # from @(#)Makefile 5.16 (Berkeley) 3/14/88 -# $Id: Makefile,v 8.11 1996/08/05 08:31:35 vixie Exp $ +# $Id: Makefile,v 8.13 1996/08/08 22:49:48 vixie Exp $ # ## ++Copyright++ 1988, 1995 @@ -73,17 +73,17 @@ AROBJS= ${ARPREF} ${OBJS} ${ARSUFF} CFLAGS= ${CDEBUG} -I${INCL} -I${COMPINCL} ${DEFS} ${LOCDEFS} -SRCS= herror.c res_debug.c res_data.c \ +SRCS= base64.c herror.c res_debug.c res_data.c \ res_comp.c res_init.c res_mkquery.c res_query.c res_send.c \ getnetbyaddr.c getnetbyname.c getnetent.c getnetnamadr.c \ - gethnamaddr.c sethostent.c nsap_addr.c hostnamelen.c \ - inet_addr.c inet_ntop.c inet_pton.c + gethnamaddr.c sethostent.c nsap_addr.c hostnamelen.c inet_addr.c \ + inet_ntop.c inet_neta.c inet_pton.c inet_net_ntop.c inet_net_pton.c -OBJS= herror.o res_debug.o res_data.o \ +OBJS= base64.o herror.o res_debug.o res_data.o \ res_comp.o res_init.o res_mkquery.o res_query.o res_send.o \ getnetbyaddr.o getnetbyname.o getnetent.o getnetnamadr.o \ - gethnamaddr.o sethostent.o nsap_addr.o hostnamelen.o \ - inet_addr.o inet_ntop.o inet_pton.o + gethnamaddr.o sethostent.o nsap_addr.o hostnamelen.o inet_addr.o \ + inet_ntop.o inet_neta.o inet_pton.o inet_net_ntop.o inet_net_pton.o all: libresolv.a @@ -98,7 +98,7 @@ ${DESTDIR}${DESTLIB}/libresolv.a: libresolv.a ( cd ${DESTDIR}${DESTLIB} ; $(RANLIB) libresolv.a ) .c.o: - ${CC} ${CPPFLAGS} ${CFLAGS} -c $*.c + ${CC} ${CFLAGS} -c $*.c -${LDS} ld -x -r $*.o ${LDS} mv a.out $*.o diff --git a/contrib/bind/res/base64.c b/contrib/bind/res/base64.c new file mode 100644 index 0000000..868826a --- /dev/null +++ b/contrib/bind/res/base64.c @@ -0,0 +1,321 @@ +/* + * Copyright (c) 1996 by Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +/* + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. + */ + +#include <sys/types.h> +#include <sys/param.h> +#include <sys/socket.h> +#include <netinet/in.h> +#include <arpa/inet.h> +#include <arpa/nameser.h> + +#include <ctype.h> +#include <resolv.h> +#include <stdio.h> + +#if defined(BSD) && (BSD >= 199103) && defined(AF_INET6) +# include <stdlib.h> +# include <string.h> +#else +# include "../conf/portability.h" +#endif + +#define Assert(Cond) if (!(Cond)) abort() + +static const char Base64[] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; +static const char Pad64 = '='; + +/* (From RFC1521 and draft-ietf-dnssec-secext-03.txt) + The following encoding technique is taken from RFC 1521 by Borenstein + and Freed. It is reproduced here in a slightly edited form for + convenience. + + A 65-character subset of US-ASCII is used, enabling 6 bits to be + represented per printable character. (The extra 65th character, "=", + is used to signify a special processing function.) + + The encoding process represents 24-bit groups of input bits as output + strings of 4 encoded characters. Proceeding from left to right, a + 24-bit input group is formed by concatenating 3 8-bit input groups. + These 24 bits are then treated as 4 concatenated 6-bit groups, each + of which is translated into a single digit in the base64 alphabet. + + Each 6-bit group is used as an index into an array of 64 printable + characters. The character referenced by the index is placed in the + output string. + + Table 1: The Base64 Alphabet + + Value Encoding Value Encoding Value Encoding Value Encoding + 0 A 17 R 34 i 51 z + 1 B 18 S 35 j 52 0 + 2 C 19 T 36 k 53 1 + 3 D 20 U 37 l 54 2 + 4 E 21 V 38 m 55 3 + 5 F 22 W 39 n 56 4 + 6 G 23 X 40 o 57 5 + 7 H 24 Y 41 p 58 6 + 8 I 25 Z 42 q 59 7 + 9 J 26 a 43 r 60 8 + 10 K 27 b 44 s 61 9 + 11 L 28 c 45 t 62 + + 12 M 29 d 46 u 63 / + 13 N 30 e 47 v + 14 O 31 f 48 w (pad) = + 15 P 32 g 49 x + 16 Q 33 h 50 y + + Special processing is performed if fewer than 24 bits are available + at the end of the data being encoded. A full encoding quantum is + always completed at the end of a quantity. When fewer than 24 input + bits are available in an input group, zero bits are added (on the + right) to form an integral number of 6-bit groups. Padding at the + end of the data is performed using the '=' character. + + Since all base64 input is an integral number of octets, only the + ------------------------------------------------- + following cases can arise: + + (1) the final quantum of encoding input is an integral + multiple of 24 bits; here, the final unit of encoded + output will be an integral multiple of 4 characters + with no "=" padding, + (2) the final quantum of encoding input is exactly 8 bits; + here, the final unit of encoded output will be two + characters followed by two "=" padding characters, or + (3) the final quantum of encoding input is exactly 16 bits; + here, the final unit of encoded output will be three + characters followed by one "=" padding character. + */ + +int +b64_ntop(src, srclength, target, targsize) + u_char const *src; + size_t srclength; + char *target; + size_t targsize; +{ + size_t datalength = 0; + u_char input[3]; + u_char output[4]; + int i; + + while (2 < srclength) { + input[0] = *src++; + input[1] = *src++; + input[2] = *src++; + srclength -= 3; + + output[0] = input[0] >> 2; + output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4); + output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6); + output[3] = input[2] & 0x3f; + Assert(output[0] < 64); + Assert(output[1] < 64); + Assert(output[2] < 64); + Assert(output[3] < 64); + + if (datalength + 4 > targsize) + return (-1); + target[datalength++] = Base64[output[0]]; + target[datalength++] = Base64[output[1]]; + target[datalength++] = Base64[output[2]]; + target[datalength++] = Base64[output[3]]; + } + + /* Now we worry about padding. */ + if (0 != srclength) { + /* Get what's left. */ + input[0] = input[1] = input[2] = '\0'; + for (i = 0; i < srclength; i++) + input[i] = *src++; + + output[0] = input[0] >> 2; + output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4); + output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6); + Assert(output[0] < 64); + Assert(output[1] < 64); + Assert(output[2] < 64); + + if (datalength + 4 > targsize) + return (-1); + target[datalength++] = Base64[output[0]]; + target[datalength++] = Base64[output[1]]; + if (srclength == 1) + target[datalength++] = Pad64; + else + target[datalength++] = Base64[output[2]]; + target[datalength++] = Pad64; + } + if (datalength >= targsize) + return (-1); + target[datalength] = '\0'; /* Returned value doesn't count \0. */ + return (datalength); +} + +/* skips all whitespace anywhere. + converts characters, four at a time, starting at (or after) + src from base - 64 numbers into three 8 bit bytes in the target area. + it returns the number of data bytes stored at the target, or -1 on error. + */ + +int +b64_pton(src, target, targsize) + char const *src; + u_char *target; + size_t targsize; +{ + int tarindex, state, ch; + char *pos; + + state = 0; + tarindex = 0; + + while ((ch = *src++) != '\0') { + if (isspace(ch)) /* Skip whitespace anywhere. */ + continue; + + if (ch == Pad64) + break; + + pos = strchr(Base64, ch); + if (pos == 0) /* A non-base64 character. */ + return (-1); + + switch (state) { + case 0: + if (target) { + if (tarindex >= targsize) + return (-1); + target[tarindex] = (pos - Base64) << 2; + } + state = 1; + break; + case 1: + if (target) { + if (tarindex + 1 >= targsize) + return (-1); + target[tarindex] |= (pos - Base64) >> 4; + target[tarindex+1] = ((pos - Base64) & 0x0f) + << 4 ; + } + tarindex++; + state = 2; + break; + case 2: + if (target) { + if (tarindex + 1 >= targsize) + return (-1); + target[tarindex] |= (pos - Base64) >> 2; + target[tarindex+1] = ((pos - Base64) & 0x03) + << 6; + } + tarindex++; + state = 3; + break; + case 3: + if (target) { + if (tarindex >= targsize) + return (-1); + target[tarindex] |= (pos - Base64); + } + tarindex++; + state = 0; + break; + default: + abort(); + } + } + + /* + * We are done decoding Base-64 chars. Let's see if we ended + * on a byte boundary, and/or with erroneous trailing characters. + */ + + if (ch == Pad64) { /* We got a pad char. */ + ch = *src++; /* Skip it, get next. */ + switch (state) { + case 0: /* Invalid = in first position */ + case 1: /* Invalid = in second position */ + return (-1); + + case 2: /* Valid, means one byte of info */ + /* Skip any number of spaces. */ + for (NULL; ch != '\0'; ch = *src++) + if (!isspace(ch)) + break; + /* Make sure there is another trailing = sign. */ + if (ch != Pad64) + return (-1); + ch = *src++; /* Skip the = */ + /* Fall through to "single trailing =" case. */ + /* FALLTHROUGH */ + + case 3: /* Valid, means two bytes of info */ + /* + * We know this char is an =. Is there anything but + * whitespace after it? + */ + for (NULL; ch != '\0'; ch = *src++) + if (!isspace(ch)) + return (-1); + + /* + * Now make sure for cases 2 and 3 that the "extra" + * bits that slopped past the last full byte were + * zeros. If we don't check them, they become a + * subliminal channel. + */ + if (target && target[tarindex] != 0) + return (-1); + } + } else { + /* + * We ended by seeing the end of the string. Make sure we + * have no partial bytes lying around. + */ + if (state != 0) + return (-1); + } + + return (tarindex); +} diff --git a/contrib/bind/res/gethnamaddr.c b/contrib/bind/res/gethnamaddr.c index 54fabd6..8cc26eb 100644 --- a/contrib/bind/res/gethnamaddr.c +++ b/contrib/bind/res/gethnamaddr.c @@ -55,7 +55,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static char sccsid[] = "@(#)gethostnamadr.c 8.1 (Berkeley) 6/4/93"; -static char rcsid[] = "$Id: gethnamaddr.c,v 8.17 1996/08/05 08:31:35 vixie Exp $"; +static char rcsid[] = "$Id: gethnamaddr.c,v 8.20 1996/09/28 06:51:07 vixie Exp $"; #endif /* LIBC_SCCS and not lint */ #include <sys/types.h> @@ -79,10 +79,12 @@ static char rcsid[] = "$Id: gethnamaddr.c,v 8.17 1996/08/05 08:31:35 vixie Exp $ #define MULTI_PTRS_ARE_ALIASES 1 /* XXX - experimental */ #if defined(BSD) && (BSD >= 199103) && defined(AF_INET6) +# include <stdlib.h> # include <string.h> #else # include "../conf/portability.h" #endif + #if defined(USE_OPTIONS_H) # include <../conf/options.h> #endif @@ -100,7 +102,6 @@ static const char AskedForGot[] = "gethostby*.getanswer: asked for \"%s\", got \"%s\""; static char *h_addr_ptrs[MAXADDRS + 1]; -static struct hostent *gethostbyname_ipv4 __P((const char *)); static struct hostent host; static char *host_aliases[MAXALIASES]; @@ -166,7 +167,7 @@ getanswer(answer, anslen, qname, qtype) int type, class, buflen, ancount, qdcount; int haveanswer, had_error; int toobig = 0; - char tbuf[MAXDNAME+1]; + char tbuf[MAXDNAME]; const char *tname; int (*name_ok) __P((const char *)); @@ -340,12 +341,11 @@ getanswer(answer, anslen, qname, qtype) cp += n; continue; /* XXX - had_error++ ? */ } - if (haveanswer) { - if (n != host.h_length) { - cp += n; - continue; - } - } else { + if (n != host.h_length) { + cp += n; + continue; + } + if (!haveanswer) { register int nn; host.h_name = bp; @@ -416,6 +416,10 @@ gethostbyname(name) { struct hostent *hp; + if ((_res.options & RES_INIT) == 0 && res_init() == -1) { + h_errno = NETDB_INTERNAL; + return (NULL); + } if (_res.options & RES_USE_INET6) { hp = gethostbyname2(name, AF_INET6); if (hp) @@ -502,6 +506,36 @@ gethostbyname2(name, af) if (!isdigit(*cp) && *cp != '.') break; } + if (isxdigit(name[0]) || name[0] == ':') + for (cp = name;; ++cp) { + if (!*cp) { + if (*--cp == '.') + break; + /* + * All-IPv6-legal, no dot at the end. + * Fake up a hostent as if we'd actually + * done a lookup. + */ + if (inet_pton(af, name, host_addr) <= 0) { + h_errno = HOST_NOT_FOUND; + return (NULL); + } + strncpy(hostbuf, name, MAXDNAME); + hostbuf[MAXDNAME] = '\0'; + bp = hostbuf + MAXDNAME; + len = sizeof hostbuf - MAXDNAME; + host.h_name = hostbuf; + host.h_aliases = host_aliases; + host_aliases[0] = NULL; + h_addr_ptrs[0] = (char *)host_addr; + h_addr_ptrs[1] = NULL; + host.h_addr_list = h_addr_ptrs; + h_errno = NETDB_SUCCESS; + return (&host); + } + if (!isxdigit(*cp) && *cp != ':' && *cp != '.') + break; + } if ((n = res_search(name, C_IN, type, buf.buf, sizeof(buf))) < 0) { dprintf("res_search failed (%d)\n", n); diff --git a/contrib/bind/res/inet_net_ntop.c b/contrib/bind/res/inet_net_ntop.c new file mode 100644 index 0000000..ff948ff --- /dev/null +++ b/contrib/bind/res/inet_net_ntop.c @@ -0,0 +1,139 @@ +/* + * Copyright (c) 1996 by Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +#if defined(LIBC_SCCS) && !defined(lint) +static const char rcsid[] = "$Id: inet_net_ntop.c,v 8.2 1996/08/08 06:54:44 vixie Exp $"; +#endif + +#include <sys/types.h> +#include <sys/socket.h> +#include <netinet/in.h> +#include <arpa/inet.h> + +#include <errno.h> +#include <stdio.h> +#include <string.h> +#include <stdlib.h> + +#ifdef SPRINTF_CHAR +# define SPRINTF(x) strlen(sprintf/**/x) +#else +# define SPRINTF(x) ((size_t)sprintf x) +#endif + +static char * inet_net_ntop_ipv4 __P((const u_char *src, int bits, + char *dst, size_t size)); + +/* + * char * + * inet_net_ntop(af, src, bits, dst, size) + * convert network number from network to presentation format. + * generates CIDR style result always. + * return: + * pointer to dst, or NULL if an error occurred (check errno). + * author: + * Paul Vixie (ISC), July 1996 + */ +char * +inet_net_ntop(af, src, bits, dst, size) + int af; + const void *src; + int bits; + char *dst; + size_t size; +{ + switch (af) { + case AF_INET: + return (inet_net_ntop_ipv4(src, bits, dst, size)); + default: + errno = EAFNOSUPPORT; + return (NULL); + } +} + +/* + * static char * + * inet_net_ntop_ipv4(src, bits, dst, size) + * convert IPv4 network number from network to presentation format. + * generates CIDR style result always. + * return: + * pointer to dst, or NULL if an error occurred (check errno). + * note: + * network byte order assumed. this means 192.5.5.240/28 has + * 0x11110000 in its fourth octet. + * author: + * Paul Vixie (ISC), July 1996 + */ +static char * +inet_net_ntop_ipv4(src, bits, dst, size) + const u_char *src; + int bits; + char *dst; + size_t size; +{ + char *odst = dst; + char *t; + u_int m; + int b; + + if (bits < 0 || bits > 32) { + errno = EINVAL; + return (NULL); + } + if (bits == 0) { + if (size < sizeof "0") + goto emsgsize; + *dst++ = '0'; + *dst = '\0'; + } + + /* Format whole octets. */ + for (b = bits / 8; b > 0; b--) { + if (size < sizeof "255.") + goto emsgsize; + t = dst; + dst += SPRINTF((dst, "%u", *src++)); + if (b > 1) { + *dst++ = '.'; + *dst = '\0'; + } + size -= (size_t)(dst - t); + } + + /* Format partial octet. */ + b = bits % 8; + if (b > 0) { + if (size < sizeof ".255") + goto emsgsize; + t = dst; + if (dst != odst) + *dst++ = '.'; + m = ((1 << b) - 1) << (8 - b); + dst += SPRINTF((dst, "%u", *src & m)); + size -= (size_t)(dst - t); + } + + /* Format CIDR /width. */ + if (size < sizeof "/32") + goto emsgsize; + dst += SPRINTF((dst, "/%u", bits)); + return (odst); + + emsgsize: + errno = EMSGSIZE; + return (NULL); +} diff --git a/contrib/bind/res/inet_net_pton.c b/contrib/bind/res/inet_net_pton.c new file mode 100644 index 0000000..5dfb132 --- /dev/null +++ b/contrib/bind/res/inet_net_pton.c @@ -0,0 +1,207 @@ +/* + * Copyright (c) 1996 by Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +#if defined(LIBC_SCCS) && !defined(lint) +static const char rcsid[] = "$Id: inet_net_pton.c,v 8.3 1996/11/11 06:36:52 vixie Exp $"; +#endif + +#include <sys/types.h> +#include <sys/socket.h> +#include <netinet/in.h> +#include <arpa/inet.h> + +#include <assert.h> +#include <ctype.h> +#include <errno.h> +#include <stdio.h> +#include <string.h> +#include <stdlib.h> + +#ifdef SPRINTF_CHAR +# define SPRINTF(x) strlen(sprintf/**/x) +#else +# define SPRINTF(x) ((size_t)sprintf x) +#endif + +static int inet_net_pton_ipv4 __P((const char *src, u_char *dst, + size_t size)); + +/* + * static int + * inet_net_pton(af, src, dst, size) + * convert network number from presentation to network format. + * accepts hex octets, hex strings, decimal octets, and /CIDR. + * "size" is in bytes and describes "dst". + * return: + * number of bits, either imputed classfully or specified with /CIDR, + * or -1 if some failure occurred (check errno). ENOENT means it was + * not a valid network specification. + * author: + * Paul Vixie (ISC), June 1996 + */ +int +inet_net_pton(af, src, dst, size) + int af; + const char *src; + void *dst; + size_t size; +{ + switch (af) { + case AF_INET: + return (inet_net_pton_ipv4(src, dst, size)); + default: + errno = EAFNOSUPPORT; + return (-1); + } +} + +/* + * static int + * inet_net_pton_ipv4(src, dst, size) + * convert IPv4 network number from presentation to network format. + * accepts hex octets, hex strings, decimal octets, and /CIDR. + * "size" is in bytes and describes "dst". + * return: + * number of bits, either imputed classfully or specified with /CIDR, + * or -1 if some failure occurred (check errno). ENOENT means it was + * not an IPv4 network specification. + * note: + * network byte order assumed. this means 192.5.5.240/28 has + * 0x11110000 in its fourth octet. + * author: + * Paul Vixie (ISC), June 1996 + */ +static int +inet_net_pton_ipv4(src, dst, size) + const char *src; + u_char *dst; + size_t size; +{ + static const char + xdigits[] = "0123456789abcdef", + digits[] = "0123456789"; + int n, ch, tmp, dirty, bits; + const u_char *odst = dst; + + ch = *src++; + if (ch == '0' && (src[0] == 'x' || src[0] == 'X') + && isascii(src[1]) && isxdigit(src[1])) { + /* Hexadecimal: Eat nybble string. */ + if (size <= 0) + goto emsgsize; + *dst = 0, dirty = 0; + src++; /* skip x or X. */ + while ((ch = *src++) != '\0' && + isascii(ch) && isxdigit(ch)) { + if (isupper(ch)) + ch = tolower(ch); + n = strchr(xdigits, ch) - xdigits; + assert(n >= 0 && n <= 15); + *dst |= n; + if (!dirty++) + *dst <<= 4; + else if (size-- > 0) + *++dst = 0, dirty = 0; + else + goto emsgsize; + } + if (dirty) + size--; + } else if (isascii(ch) && isdigit(ch)) { + /* Decimal: eat dotted digit string. */ + for (;;) { + tmp = 0; + do { + n = strchr(digits, ch) - digits; + assert(n >= 0 && n <= 9); + tmp *= 10; + tmp += n; + if (tmp > 255) + goto enoent; + } while ((ch = *src++) != '\0' && + isascii(ch) && isdigit(ch)); + if (size-- <= 0) + goto emsgsize; + *dst++ = (u_char) tmp; + if (ch == '\0' || ch == '/') + break; + if (ch != '.') + goto enoent; + ch = *src++; + if (!isascii(ch) || !isdigit(ch)) + goto enoent; + } + } else + goto enoent; + + bits = -1; + if (ch == '/' && isascii(src[0]) && isdigit(src[0]) && dst > odst) { + /* CIDR width specifier. Nothing can follow it. */ + ch = *src++; /* Skip over the /. */ + bits = 0; + do { + n = strchr(digits, ch) - digits; + assert(n >= 0 && n <= 9); + bits *= 10; + bits += n; + } while ((ch = *src++) != '\0' && + isascii(ch) && isdigit(ch)); + if (ch != '\0') + goto enoent; + if (bits > 32) + goto emsgsize; + } + + /* Firey death and destruction unless we prefetched EOS. */ + if (ch != '\0') + goto enoent; + + /* If nothing was written to the destination, we found no address. */ + if (dst == odst) + goto enoent; + /* If no CIDR spec was given, infer width from net class. */ + if (bits == -1) { + if (*odst >= 240) /* Class E */ + bits = 32; + else if (*odst >= 224) /* Class D */ + bits = 4; + else if (*odst >= 192) /* Class C */ + bits = 24; + else if (*odst >= 128) /* Class B */ + bits = 16; + else /* Class A */ + bits = 8; + /* If imputed mask is narrower than specified octets, widen. */ + if (bits >= 8 && bits < ((dst - odst) * 8)) + bits = (dst - odst) * 8; + } + /* Extend network to cover the actual mask. */ + while (bits > ((dst - odst) * 8)) { + if (size-- <= 0) + goto emsgsize; + *dst++ = '\0'; + } + return (bits); + + enoent: + errno = ENOENT; + return (-1); + + emsgsize: + errno = EMSGSIZE; + return (-1); +} diff --git a/contrib/bind/res/inet_neta.c b/contrib/bind/res/inet_neta.c new file mode 100644 index 0000000..098059b --- /dev/null +++ b/contrib/bind/res/inet_neta.c @@ -0,0 +1,82 @@ +/* + * Copyright (c) 1996 by Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +#if defined(LIBC_SCCS) && !defined(lint) +static const char rcsid[] = "$Id: inet_neta.c,v 8.2 1996/08/08 06:54:44 vixie Exp $"; +#endif + +#include <sys/types.h> +#include <sys/socket.h> +#include <netinet/in.h> +#include <arpa/inet.h> + +#include <errno.h> +#include <stdio.h> + +#ifdef SPRINTF_CHAR +# define SPRINTF(x) strlen(sprintf/**/x) +#else +# define SPRINTF(x) ((size_t)sprintf x) +#endif + +/* + * char * + * inet_neta(src, dst, size) + * format a u_long network number into presentation format. + * return: + * pointer to dst, or NULL if an error occurred (check errno). + * note: + * format of ``src'' is as for inet_network(). + * author: + * Paul Vixie (ISC), July 1996 + */ +char * +inet_neta(src, dst, size) + u_long src; + char *dst; + size_t size; +{ + char *odst = dst; + char *tp; + + while (src & 0xffffffff) { + u_char b = (src & 0xff000000) >> 24; + + src <<= 8; + if (b) { + if (size < sizeof "255.") + goto emsgsize; + tp = dst; + dst += SPRINTF((dst, "%u", b)); + if (src != 0L) { + *dst++ = '.'; + *dst = '\0'; + } + size -= (size_t)(dst - tp); + } + } + if (dst == odst) { + if (size < sizeof "0.0.0.0") + goto emsgsize; + strcpy(dst, "0.0.0.0"); + } + return (odst); + + emsgsize: + errno = EMSGSIZE; + return (NULL); +} diff --git a/contrib/bind/res/res_comp.c b/contrib/bind/res/res_comp.c index 38e5a26..5008d47 100644 --- a/contrib/bind/res/res_comp.c +++ b/contrib/bind/res/res_comp.c @@ -55,7 +55,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static char sccsid[] = "@(#)res_comp.c 8.1 (Berkeley) 6/4/93"; -static char rcsid[] = "$Id: res_comp.c,v 8.8 1996/08/05 08:31:35 vixie Exp $"; +static char rcsid[] = "$Id: res_comp.c,v 8.11 1996/12/02 09:17:22 vixie Exp $"; #endif /* LIBC_SCCS and not lint */ #include <sys/types.h> @@ -394,8 +394,12 @@ int res_ownok(dn) const char *dn; { - if (asterchar(dn[0]) && periodchar(dn[1])) - dn += 2; + if (asterchar(dn[0])) { + if (periodchar(dn[1])) + return (res_hnok(dn+2)); + if (dn[1] == '\0') + return (1); + } return (res_hnok(dn)); } @@ -500,36 +504,3 @@ __putlong(l, msgp) { PUTLONG(l, msgp); } - -#ifdef ultrix -/* ultrix 4.0 had some icky packaging in its libc.a. alias for it here. - * there is more gunk of this kind over in res_debug.c. - */ -#undef putshort -void -#if defined(__STDC__) || defined(__cplusplus) -putshort(register u_short s, register u_char *msgp) -#else -putshort(s, msgp) - register u_short s; - register u_char *msgp; -#endif -{ - __putshort(s, msgp); -} -#undef putlong -void -putlong(l, msgp) - register u_int32_t l; - register u_char *msgp; -{ - __putlong(l, msgp); -} - -#undef dn_skipname -dn_skipname(comp_dn, eom) - const u_char *comp_dn, *eom; -{ - return (__dn_skipname(comp_dn, eom)); -} -#endif /* Ultrix 4.0 hackery */ diff --git a/contrib/bind/res/res_debug.c b/contrib/bind/res/res_debug.c index 09e0500..74dda53 100644 --- a/contrib/bind/res/res_debug.c +++ b/contrib/bind/res/res_debug.c @@ -50,12 +50,34 @@ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * --Copyright-- */ #if defined(LIBC_SCCS) && !defined(lint) static char sccsid[] = "@(#)res_debug.c 8.1 (Berkeley) 6/4/93"; -static char rcsid[] = "$Id: res_debug.c,v 8.12 1996/08/05 08:31:35 vixie Exp $"; +static char rcsid[] = "$Id: res_debug.c,v 8.19 1996/11/26 10:11:23 vixie Exp $"; #endif /* LIBC_SCCS and not lint */ #include <sys/param.h> @@ -65,11 +87,14 @@ static char rcsid[] = "$Id: res_debug.c,v 8.12 1996/08/05 08:31:35 vixie Exp $"; #include <arpa/inet.h> #include <arpa/nameser.h> -#include <stdio.h> +#include <ctype.h> #include <netdb.h> #include <resolv.h> -#include <ctype.h> +#include <stdio.h> +#include <time.h> + #if defined(BSD) && (BSD >= 199103) && defined(AF_INET6) +# include <stdlib.h> # include <string.h> #else # include "../conf/portability.h" @@ -213,6 +238,7 @@ __p_query(msg) } #ifdef ultrix +#undef p_query /* ultrix 4.0's packaging has some icky packaging. alias for it here. * there is more junk of this kind over in res_comp.c. */ @@ -261,7 +287,7 @@ __fp_nquery(msg, len, file) if ((_res.options & RES_INIT) == 0 && res_init() == -1) return; -#define TruncTest(x) if (x >= endMark) goto trunc +#define TruncTest(x) if (x > endMark) goto trunc #define ErrorTest(x) if (x == NULL) goto error /* @@ -269,7 +295,7 @@ __fp_nquery(msg, len, file) */ hp = (HEADER *)msg; cp = msg + HFIXEDSZ; - endMark = cp + len; + endMark = msg + len; if ((!_res.pfcode) || (_res.pfcode & RES_PRF_HEADX) || hp->rcode) { fprintf(file, ";; ->>HEADER<<- opcode: %s, status: %s, id: %d", _res_opcodes[hp->opcode], @@ -291,6 +317,12 @@ __fp_nquery(msg, len, file) fprintf(file, " rd"); if (hp->ra) fprintf(file, " ra"); + if (hp->unused) + fprintf(file, " UNUSED-BIT-ON"); + if (hp->ad) + fprintf(file, " ad"); + if (hp->cd) + fprintf(file, " cd"); } if ((!_res.pfcode) || (_res.pfcode & RES_PRF_HEAD1)) { fprintf(file, "; Ques: %d", ntohs(hp->qdcount)); @@ -404,6 +436,30 @@ __p_cdname(cp, msg, file) return (p_cdnname(cp, msg, PACKETSZ, file)); } + +/* Return a fully-qualified domain name from a compressed name (with + length supplied). */ + +const u_char * +__p_fqnname(cp, msg, msglen, name, namelen) + const u_char *cp, *msg; + int msglen; + char *name; + int namelen; +{ + int n, newlen; + + if ((n = dn_expand(msg, cp + msglen, cp, name, namelen)) < 0) + return (NULL); + newlen = strlen (name); + if (newlen == 0 || name[newlen - 1] != '.') + if (newlen+1 >= namelen) /* Lack space for final dot */ + return (NULL); + else + strcpy(name + newlen, "."); + return (cp + n); +} + /* XXX: the rest of these functions need to become length-limited, too. (vix) */ @@ -413,18 +469,13 @@ __p_fqname(cp, msg, file) FILE *file; { char name[MAXDNAME]; - int n; + const u_char *n; - if ((n = dn_expand(msg, cp + MAXCDNAME, cp, name, sizeof name)) < 0) + n = __p_fqnname(cp, msg, MAXCDNAME, name, sizeof name); + if (n == NULL) return (NULL); - if (name[0] == '\0') { - putc('.', file); - } else { - fputs(name, file); - if (name[strlen(name) - 1] != '.') - putc('.', file); - } - return (cp + n); + fputs(name, file); + return (n); } /* @@ -440,13 +491,19 @@ __p_rr(cp, msg, file) const u_char *cp1, *cp2; u_int32_t tmpttl, t; int lcnt; + u_int16_t keyflags; + char rrname[MAXDNAME]; /* The fqdn of this RR */ + char base64_key[MAX_KEY_BASE64]; if ((_res.options & RES_INIT) == 0 && res_init() == -1) { h_errno = NETDB_INTERNAL; return (NULL); } - if ((cp = p_fqname(cp, msg, file)) == NULL) + cp = __p_fqnname(cp, msg, MAXCDNAME, rrname, sizeof rrname); + if (!cp) return (NULL); /* compression error */ + fputs(rrname, file); + type = _getshort((u_char*)cp); cp += INT16SZ; class = _getshort((u_char*)cp); @@ -481,7 +538,7 @@ __p_rr(cp, msg, file) address = inet_ntoa(inaddr); cp += INADDRSZ; protocol = *(u_char*)cp; - cp += sizeof(u_char); + cp += sizeof (u_char); port = _getshort((u_char*)cp); cp += INT16SZ; fprintf(file, "\t%s\t; proto %d, port %d", @@ -505,16 +562,16 @@ __p_rr(cp, msg, file) case T_HINFO: case T_ISDN: - (void) fputs("\t\"", file); cp2 = cp + dlen; + (void) fputs("\t\"", file); if ((n = (unsigned char) *cp++) != 0) { for (c = n; c > 0 && cp < cp2; c--) { if (strchr("\n\"\\", *cp)) (void) putc('\\', file); (void) putc(*cp++, file); } - putc('"', file); } + putc('"', file); if (cp < cp2 && (n = (unsigned char) *cp++) != 0) { (void) fputs ("\t\"", file); for (c = n; c > 0 && cp < cp2; c--) { @@ -572,11 +629,24 @@ __p_rr(cp, msg, file) return (NULL); break; - case T_TXT: case T_X25: + cp2 = cp + dlen; (void) fputs("\t\"", file); + if ((n = (unsigned char) *cp++) != 0) { + for (c = n; c > 0 && cp < cp2; c--) { + if (strchr("\n\"\\", *cp)) + (void) putc('\\', file); + (void) putc(*cp++, file); + } + } + putc('"', file); + break; + + case T_TXT: + (void) putc('\t', file); cp2 = cp1 + dlen; while (cp < cp2) { + putc('"', file); if (n = (unsigned char) *cp++) { for (c = n; c > 0 && cp < cp2; c--) { if (strchr("\n\"\\", *cp)) @@ -584,8 +654,10 @@ __p_rr(cp, msg, file) (void) putc(*cp++, file); } } + putc('"', file); + if (cp < cp2) + putc(' ', file); } - putc('"', file); break; case T_NSAP: @@ -596,18 +668,53 @@ __p_rr(cp, msg, file) case T_AAAA: { char t[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"]; - fprintf(file, "\t%s\n", inet_ntop(AF_INET6, cp, t, sizeof t)); + fprintf(file, "\t%s", inet_ntop(AF_INET6, cp, t, sizeof t)); cp += dlen; break; - } + } case T_LOC: { char t[255]; - (void) fprintf(file, "\t%s\n", loc_ntoa(cp, t)); + fprintf(file, "\t%s", loc_ntoa(cp, t)); cp += dlen; break; - } + } + + case T_NAPTR: { + u_int order, preference; + + order = _getshort(cp); cp += INT16SZ; + preference = _getshort(cp); cp += INT16SZ; + fprintf(file, "\t%u %u ",order, preference); + /* Flags */ + n = *cp++; + fprintf(file,"\"%.*s\" ", (int)n, cp); + cp += n; + /* Service */ + n = *cp++; + fprintf(file,"\"%.*s\" ", (int)n, cp); + cp += n; + /* Regexp */ + n = *cp++; + fprintf(file,"\"%.*s\" ", (int)n, cp); + cp += n; + if ((cp = p_fqname(cp, msg, file)) == NULL) + return (NULL); + break; + } + + case T_SRV: { + u_int priority, weight, port; + + priority = _getshort(cp); cp += INT16SZ; + weight = _getshort(cp); cp += INT16SZ; + port = _getshort(cp); cp += INT16SZ; + fprintf(file, "\t%u %u %u ", priority, weight, port); + if ((cp = p_fqname(cp, msg, file)) == NULL) + return (NULL); + break; + } case T_MINFO: case T_RP: @@ -641,7 +748,7 @@ __p_rr(cp, msg, file) fprintf(file, "\t%s %s ( ", inet_ntoa(inaddr), deproto((int) *cp)); - cp += sizeof(u_char); + cp += sizeof (u_char); n = 0; lcnt = 0; while (cp < cp1 + dlen) { @@ -662,6 +769,72 @@ __p_rr(cp, msg, file) putc(')', file); break; + case T_KEY: + putc('\t', file); + keyflags = _getshort(cp); + cp += 2; + fprintf(file,"0x%04x", keyflags ); /* flags */ + fprintf(file," %u", *cp++); /* protocol */ + fprintf(file," %u (", *cp++); /* algorithm */ + + n = b64_ntop(cp, (cp1 + dlen) - cp, + base64_key, sizeof base64_key); + for (c = 0; c < n; ++c) { + if (0 == (c & 0x3F)) + fprintf(file, "\n\t"); + putc(base64_key[c], file); /* public key data */ + } + + fprintf(file, " )"); + if (n < 0) + fprintf(file, "\t; BAD BASE64"); + fflush(file); + cp = cp1 + dlen; + break; + + case T_SIG: + type = _getshort((u_char*)cp); + cp += INT16SZ; + fprintf(file, " %s", p_type(type)); + fprintf(file, "\t%d", *cp++); /* algorithm */ + /* Check label value and print error if wrong. */ + n = *cp++; + c = dn_count_labels (rrname); + if (n != c) + fprintf(file, "\t; LABELS WRONG (%d should be %d)\n\t", + n, c); + /* orig ttl */ + n = _getlong((u_char*)cp); + if (n != tmpttl) + fprintf(file, " %u", n); + cp += INT32SZ; + /* sig expire */ + fprintf(file, " (\n\t%s", + __p_secstodate(_getlong((u_char*)cp))); + cp += INT32SZ; + /* time signed */ + fprintf(file, " %s", __p_secstodate(_getlong((u_char*)cp))); + cp += INT32SZ; + /* sig footprint */ + fprintf(file," %u ", _getshort((u_char*)cp)); + cp += INT16SZ; + /* signer's name */ + cp = p_fqname(cp, msg, file); + n = b64_ntop(cp, (cp1 + dlen) - cp, + base64_key, sizeof base64_key); + for (c = 0; c < n; c++) { + if (0 == (c & 0x3F)) + fprintf (file, "\n\t"); + putc(base64_key[c], file); /* signature */ + } + /* Clean up... */ + fprintf(file, " )"); + if (n < 0) + fprintf(file, "\t; BAD BASE64"); + fflush(file); + cp = cp1+dlen; + break; + #ifdef ALLOW_T_UNSPEC case T_UNSPEC: { @@ -697,54 +870,144 @@ __p_rr(cp, msg, file) } /* + * Names of RR classes and qclasses. Classes and qclasses are the same, except + * that C_ANY is a qclass but not a class. (You can ask for records of class + * C_ANY, but you can't have any records of that class in the database.) + */ +const struct res_sym __p_class_syms[] = { + {C_IN, "IN"}, + {C_CHAOS, "CHAOS"}, + {C_HS, "HS"}, + {C_HS, "HESIOD"}, + {C_ANY, "ANY"}, + {C_IN, (char *)0} +}; + +/* + * Names of RR types and qtypes. Types and qtypes are the same, except + * that T_ANY is a qtype but not a type. (You can ask for records of type + * T_ANY, but you can't have any records of that type in the database.) + */ +const struct res_sym __p_type_syms[] = { + {T_A, "A", "address"}, + {T_NS, "NS", "name server"}, + {T_MD, "MD", "mail destination (deprecated)"}, + {T_MF, "MF", "mail forwarder (deprecated)"}, + {T_CNAME, "CNAME", "canonical name"}, + {T_SOA, "SOA", "start of authority"}, + {T_MB, "MB", "mailbox"}, + {T_MG, "MG", "mail group member"}, + {T_MR, "MR", "mail rename"}, + {T_NULL, "NULL", "null"}, + {T_WKS, "WKS", "well-known service (deprecated)"}, + {T_PTR, "PTR", "domain name pointer"}, + {T_HINFO, "HINFO", "host information"}, + {T_MINFO, "MINFO", "mailbox information"}, + {T_MX, "MX", "mail exchanger"}, + {T_TXT, "TXT", "text"}, + {T_RP, "RP", "responsible person"}, + {T_AFSDB, "AFSDB", "DCE or AFS server"}, + {T_X25, "X25", "X25 address"}, + {T_ISDN, "ISDN", "ISDN address"}, + {T_RT, "RT", "router"}, + {T_NSAP, "NSAP", "nsap address"}, + {T_NSAP_PTR, "NSAP_PTR", "domain name pointer"}, + {T_SIG, "SIG", "signature"}, + {T_KEY, "KEY", "key"}, + {T_PX, "PX", "mapping information"}, + {T_GPOS, "GPOS", "geographical position (withdrawn)"}, + {T_AAAA, "AAAA", "IPv6 address"}, + {T_LOC, "LOC", "location"}, + {T_NXT, "NXT", "next valid name (unimplemented)"}, + {T_EID, "EID", "endpoint identifier (unimplemented)"}, + {T_NIMLOC, "NIMLOC", "NIMROD locator (unimplemented)"}, + {T_SRV, "SRV", "server selection"}, + {T_ATMA, "ATMA", "ATM address (unimplemented)"}, + {T_IXFR, "IXFR", "incremental zone transfer"}, + {T_AXFR, "AXFR", "zone transfer"}, + {T_MAILB, "MAILB", "mailbox-related data (deprecated)"}, + {T_MAILA, "MAILA", "mail agent (deprecated)"}, + {T_UINFO, "UINFO", "user information (nonstandard)"}, + {T_UID, "UID", "user ID (nonstandard)"}, + {T_GID, "GID", "group ID (nonstandard)"}, + {T_NAPTR, "NAPTR", "URN Naming Authority"}, +#ifdef ALLOW_T_UNSPEC + {T_UNSPEC, "UNSPEC", "unspecified data (nonstandard)"}, +#endif /* ALLOW_T_UNSPEC */ + {T_ANY, "ANY", "\"any\""}, + {0, NULL, NULL} +}; + +int +__sym_ston(syms, name, success) + const struct res_sym *syms; + char *name; + int *success; +{ + for (NULL; syms->name != 0; syms++) { + if (strcasecmp (name, syms->name) == 0) { + if (success) + *success = 1; + return (syms->number); + } + } + if (success) + *success = 0; + return (syms->number); /* The default value. */ +} + +const char * +__sym_ntos(syms, number, success) + const struct res_sym *syms; + int number; + int *success; +{ + static char unname[20]; + + for (NULL; syms->name != 0; syms++) { + if (number == syms->number) { + if (success) + *success = 1; + return (syms->name); + } + } + + sprintf (unname, "%d", number); + if (success) + *success = 0; + return (unname); +} + + +const char * +__sym_ntop(syms, number, success) + const struct res_sym *syms; + int number; + int *success; +{ + static char unname[20]; + + for (NULL; syms->name != 0; syms++) { + if (number == syms->number) { + if (success) + *success = 1; + return (syms->humanname); + } + } + sprintf(unname, "%d", number); + if (success) + *success = 0; + return (unname); +} + +/* * Return a string for the type */ const char * __p_type(type) int type; { - static char nbuf[20]; - - switch (type) { - case T_A: return "A"; - case T_NS: return "NS"; - case T_CNAME: return "CNAME"; - case T_SOA: return "SOA"; - case T_MB: return "MB"; - case T_MG: return "MG"; - case T_MR: return "MR"; - case T_NULL: return "NULL"; - case T_WKS: return "WKS"; - case T_PTR: return "PTR"; - case T_HINFO: return "HINFO"; - case T_MINFO: return "MINFO"; - case T_MX: return "MX"; - case T_TXT: return "TXT"; - case T_RP: return "RP"; - case T_AFSDB: return "AFSDB"; - case T_X25: return "X25"; - case T_ISDN: return "ISDN"; - case T_RT: return "RT"; - case T_NSAP: return "NSAP"; - case T_NSAP_PTR: return "NSAP_PTR"; - case T_SIG: return "SIG"; - case T_KEY: return "KEY"; - case T_PX: return "PX"; - case T_GPOS: return "GPOS"; - case T_AAAA: return "AAAA"; - case T_LOC: return "LOC"; - case T_AXFR: return "AXFR"; - case T_MAILB: return "MAILB"; - case T_MAILA: return "MAILA"; - case T_ANY: return "ANY"; - case T_UINFO: return "UINFO"; - case T_UID: return "UID"; - case T_GID: return "GID"; -#ifdef ALLOW_T_UNSPEC - case T_UNSPEC: return "UNSPEC"; -#endif /* ALLOW_T_UNSPEC */ - default: (void)sprintf(nbuf, "%d", type); return (nbuf); - } + return (__sym_ntos (__p_type_syms, type, (int *)0)); } /* @@ -754,14 +1017,7 @@ const char * __p_class(class) int class; { - static char nbuf[20]; - - switch (class) { - case C_IN: return "IN"; - case C_HS: return "HS"; - case C_ANY: return "ANY"; - default: (void)sprintf(nbuf, "%d", class); return (nbuf); - } + return (__sym_ntos (__p_class_syms, class, (int *)0)); } /* @@ -794,8 +1050,8 @@ __p_option(option) /* * Return a mnemonic for a time to live */ -char * -__p_time(value) +const char * +p_time(value) u_int32_t value; { static char nbuf[40]; @@ -856,7 +1112,7 @@ static const char * precsize_ntoa(prec) u_int8_t prec; { - static char retbuf[sizeof("90000000.00")]; + static char retbuf[sizeof "90000000.00"]; unsigned long val; int mantissa, exponent; @@ -1043,11 +1299,11 @@ loc_aton(ascii, binary) longit = lltemp1; latit = lltemp2; } else { /* some kind of brokenness */ - return 0; + return (0); } break; default: /* we didn't get one of each */ - return 0; + return (0); } /* altitude */ @@ -1122,7 +1378,7 @@ loc_aton(ascii, binary) } /* takes an on-the-wire LOC RR and formats it in a human readable format. */ -char * +const char * loc_ntoa(binary, ascii) const u_char *binary; char *ascii; @@ -1223,3 +1479,53 @@ loc_ntoa(binary, ascii) return (ascii); } + + +/* Return the number of DNS hierarchy levels in the name. */ +int +__dn_count_labels(name) + char *name; +{ + int i, len, count; + + len = strlen(name); + + for(i = 0, count = 0; i < len; i++) { + if (name[i] == '.') + count++; + } + + /* don't count initial wildcard */ + if (name[0] == '*') + if (count) + count--; + + /* don't count the null label for root. */ + /* if terminating '.' not found, must adjust */ + /* count to include last label */ + if (len > 0 && name[len-1] != '.') + count++; + return (count); +} + + +/* + * Make dates expressed in seconds-since-Jan-1-1970 easy to read. + * SIG records are required to be printed like this, by the Secure DNS RFC. + */ +char * +__p_secstodate (secs) + unsigned long secs; +{ + static char output[15]; /* YYYYMMDDHHMMSS and null */ + time_t clock = secs; + struct tm *time; + + time = gmtime(&clock); + time->tm_year += 1900; + time->tm_mon += 1; + sprintf(output, "%04d%02d%02d%02d%02d%02d", + time->tm_year, time->tm_mon, time->tm_mday, + time->tm_hour, time->tm_min, time->tm_sec); + return (output); +} diff --git a/contrib/bind/res/res_init.c b/contrib/bind/res/res_init.c index ab06ecd..c0314c5 100644 --- a/contrib/bind/res/res_init.c +++ b/contrib/bind/res/res_init.c @@ -55,7 +55,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static char sccsid[] = "@(#)res_init.c 8.1 (Berkeley) 6/7/93"; -static char rcsid[] = "$Id: res_init.c,v 8.5 1996/08/05 08:31:35 vixie Exp $"; +static char rcsid[] = "$Id: res_init.c,v 8.7 1996/09/28 06:51:07 vixie Exp $"; #endif /* LIBC_SCCS and not lint */ #include <sys/types.h> @@ -126,7 +126,11 @@ static u_int32_t net_mask __P((struct in_addr)); * Resolver state default settings. */ -struct __res_state _res; +struct __res_state _res +# if defined(__BIND_RES_TEXT) + = { RES_TIMEOUT, } /* Motorola, et al. */ +# endif + ; /* * Set up default settings. If the configuration file exist, the values @@ -641,7 +645,7 @@ netinfo_res_init(haveenv, havesearch) } #endif /* NeXT */ -u_int16_t +u_int res_randomid() { struct timeval now; diff --git a/contrib/bind/res/res_mkquery.c b/contrib/bind/res/res_mkquery.c index 17d6219..7492c20 100644 --- a/contrib/bind/res/res_mkquery.c +++ b/contrib/bind/res/res_mkquery.c @@ -55,7 +55,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static char sccsid[] = "@(#)res_mkquery.c 8.1 (Berkeley) 6/4/93"; -static char rcsid[] = "$Id: res_mkquery.c,v 8.4 1996/08/05 08:31:35 vixie Exp $"; +static char rcsid[] = "$Id: res_mkquery.c,v 8.5 1996/08/27 08:33:28 vixie Exp $"; #endif /* LIBC_SCCS and not lint */ #include <sys/types.h> @@ -94,9 +94,6 @@ res_mkquery(op, dname, class, type, data, datalen, newrr_in, buf, buflen) register HEADER *hp; register u_char *cp; register int n; -#ifdef ALLOW_UPDATES - struct rrec *newrr = (struct rrec *) newrr_in; -#endif u_char *dnptrs[20], **dpp, **lastdnptr; if ((_res.options & RES_INIT) == 0 && res_init() == -1) { @@ -186,63 +183,6 @@ res_mkquery(op, dname, class, type, data, datalen, newrr_in, buf, buflen) hp->ancount = htons(1); break; -#ifdef ALLOW_UPDATES - /* - * For UPDATEM/UPDATEMA, do UPDATED/UPDATEDA followed by UPDATEA - * (Record to be modified is followed by its replacement in msg.) - */ - case UPDATEM: - case UPDATEMA: - - case UPDATED: - /* - * The res code for UPDATED and UPDATEDA is the same; user - * calls them differently: specifies data for UPDATED; server - * ignores data if specified for UPDATEDA. - */ - case UPDATEDA: - buflen -= RRFIXEDSZ + datalen; - if ((n = dn_comp(dname, cp, buflen, dnptrs, lastdnptr)) < 0) - return (-1); - cp += n; - __putshort(type, cp); - cp += INT16SZ; - __putshort(class, cp); - cp += INT16SZ; - __putlong(0, cp); - cp += INT32SZ; - __putshort(datalen, cp); - cp += INT16SZ; - if (datalen) { - bcopy(data, cp, datalen); - cp += datalen; - } - if ( (op == UPDATED) || (op == UPDATEDA) ) { - hp->ancount = htons(0); - break; - } - /* Else UPDATEM/UPDATEMA, so drop into code for UPDATEA */ - - case UPDATEA: /* Add new resource record */ - buflen -= RRFIXEDSZ + datalen; - if ((n = dn_comp(dname, cp, buflen, dnptrs, lastdnptr)) < 0) - return (-1); - cp += n; - __putshort(newrr->r_type, cp); - cp += INT16SZ; - __putshort(newrr->r_class, cp); - cp += INT16SZ; - __putlong(0, cp); - cp += INT32SZ; - __putshort(newrr->r_size, cp); - cp += INT16SZ; - if (newrr->r_size) { - bcopy(newrr->r_data, cp, newrr->r_size); - cp += newrr->r_size; - } - hp->ancount = htons(0); - break; -#endif /* ALLOW_UPDATES */ default: return (-1); } diff --git a/contrib/bind/res/res_query.c b/contrib/bind/res/res_query.c index dcc06cc..d2700e4 100644 --- a/contrib/bind/res/res_query.c +++ b/contrib/bind/res/res_query.c @@ -55,7 +55,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static char sccsid[] = "@(#)res_query.c 8.1 (Berkeley) 6/4/93"; -static char rcsid[] = "$Id: res_query.c,v 8.7 1996/08/05 08:31:35 vixie Exp $"; +static char rcsid[] = "$Id: res_query.c,v 8.9 1996/09/22 00:13:28 vixie Exp $"; #endif /* LIBC_SCCS and not lint */ #include <sys/types.h> @@ -86,7 +86,7 @@ static char rcsid[] = "$Id: res_query.c,v 8.7 1996/08/05 08:31:35 vixie Exp $"; #define MAXPACKET 1024 #endif -char *__hostalias __P((const char *)); +const char *hostalias __P((const char *)); int h_errno; /* @@ -321,7 +321,7 @@ res_querydomain(name, domain, class, type, answer, anslen) u_char *answer; /* buffer to put answer */ int anslen; /* size of answer */ { - char nbuf[2*MAXDNAME+2]; + char nbuf[MAXDNAME]; const char *longname = nbuf; int n; @@ -351,8 +351,8 @@ res_querydomain(name, domain, class, type, answer, anslen) return (res_query(longname, class, type, answer, anslen)); } -char * -__hostalias(name) +const char * +hostalias(name) register const char *name; { register char *cp1, *cp2; diff --git a/contrib/bind/res/res_send.c b/contrib/bind/res/res_send.c index 22712ac..da9b9ec 100644 --- a/contrib/bind/res/res_send.c +++ b/contrib/bind/res/res_send.c @@ -55,7 +55,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static char sccsid[] = "@(#)res_send.c 8.1 (Berkeley) 6/4/93"; -static char rcsid[] = "$Id: res_send.c,v 8.9 1996/08/05 08:31:35 vixie Exp $"; +static char rcsid[] = "$Id: res_send.c,v 8.12 1996/10/08 04:51:06 vixie Exp $"; #endif /* LIBC_SCCS and not lint */ /* change this to "0" @@ -94,8 +94,6 @@ static char rcsid[] = "$Id: res_send.c,v 8.9 1996/08/05 08:31:35 vixie Exp $"; # include <../conf/options.h> #endif -void _res_close __P((void)); - static int s = -1; /* socket used for communications */ static int connected = 0; /* is the socket connected */ static int vc = 0; /* is the socket a virtual ciruit? */ @@ -320,7 +318,7 @@ res_send(buf, buflen, ans, anssiz) struct sockaddr_in *nsap = &_res.nsaddr_list[ns]; same_ns: if (badns & (1 << ns)) { - _res_close(); + res_close(); goto next_ns; } @@ -337,7 +335,7 @@ res_send(buf, buflen, ans, anssiz) done = 1; break; case res_nextns: - _res_close(); + res_close(); goto next_ns; case res_done: return (resplen); @@ -372,7 +370,7 @@ res_send(buf, buflen, ans, anssiz) truncated = 0; if ((s < 0) || (!vc)) { if (s >= 0) - _res_close(); + res_close(); s = socket(PF_INET, SOCK_STREAM, 0); if (s < 0) { @@ -387,7 +385,7 @@ res_send(buf, buflen, ans, anssiz) Aerror(stderr, "connect/vc", errno, *nsap); badns |= (1 << ns); - _res_close(); + res_close(); goto next_ns; } vc = 1; @@ -404,7 +402,7 @@ res_send(buf, buflen, ans, anssiz) terrno = errno; Perror(stderr, "write failed", errno); badns |= (1 << ns); - _res_close(); + res_close(); goto next_ns; } /* @@ -421,7 +419,7 @@ read_len: if (n <= 0) { terrno = errno; Perror(stderr, "read failed", errno); - _res_close(); + res_close(); /* * A long running process might get its TCP * connection reset if the remote server was @@ -433,10 +431,10 @@ read_len: */ if (terrno == ECONNRESET && !connreset) { connreset = 1; - _res_close(); + res_close(); goto same_ns; } - _res_close(); + res_close(); goto next_ns; } resplen = _getshort(ans); @@ -457,7 +455,7 @@ read_len: if (n <= 0) { terrno = errno; Perror(stderr, "read(vc)", errno); - _res_close(); + res_close(); goto next_ns; } if (truncated) { @@ -504,7 +502,7 @@ read_len: if ((s < 0) || vc) { if (vc) - _res_close(); + res_close(); s = socket(PF_INET, SOCK_DGRAM, 0); if (s < 0) { #if !CAN_RECONNECT @@ -544,7 +542,7 @@ read_len: "connect(dg)", errno, *nsap); badns |= (1 << ns); - _res_close(); + res_close(); goto next_ns; } connected = 1; @@ -552,7 +550,7 @@ read_len: if (send(s, (char*)buf, buflen, 0) != buflen) { Perror(stderr, "send", errno); badns |= (1 << ns); - _res_close(); + res_close(); goto next_ns; } } else { @@ -589,7 +587,7 @@ read_len: != buflen) { Aerror(stderr, "sendto", errno, *nsap); badns |= (1 << ns); - _res_close(); + res_close(); goto next_ns; } } @@ -612,7 +610,7 @@ read_len: if (errno == EINTR) goto wait; Perror(stderr, "select", errno); - _res_close(); + res_close(); goto next_ns; } if (n == 0) { @@ -622,7 +620,7 @@ read_len: Dprint(_res.options & RES_DEBUG, (stdout, ";; timeout\n")); gotsomewhere = 1; - _res_close(); + res_close(); goto next_ns; } errno = 0; @@ -631,7 +629,7 @@ read_len: (struct sockaddr *)&from, &fromlen); if (resplen <= 0) { Perror(stderr, "recvfrom", errno); - _res_close(); + res_close(); goto next_ns; } gotsomewhere = 1; @@ -683,7 +681,7 @@ read_len: (stdout, "server rejected query:\n"), ans, (resplen>anssiz)?anssiz:resplen); badns |= (1 << ns); - _res_close(); + res_close(); /* don't retry if called from dig */ if (!_res.pfcode) goto next_ns; @@ -696,7 +694,7 @@ read_len: Dprint(_res.options & RES_DEBUG, (stdout, ";; truncated answer\n")); v_circuit = 1; - _res_close(); + res_close(); goto same_ns; } } /*if vc/dg*/ @@ -718,7 +716,7 @@ read_len: */ if ((v_circuit && (!(_res.options & RES_USEVC) || ns != 0)) || !(_res.options & RES_STAYOPEN)) { - _res_close(); + res_close(); } if (Rhook) { int done = 0, loops = 0; @@ -734,7 +732,7 @@ read_len: done = 1; break; case res_nextns: - _res_close(); + res_close(); goto next_ns; case res_modified: /* give the hook another try */ @@ -753,7 +751,7 @@ read_len: next_ns: ; } /*foreach ns*/ } /*foreach retry*/ - _res_close(); + res_close(); if (!v_circuit) if (!gotsomewhere) errno = ECONNREFUSED; /* no nameservers found */ @@ -772,7 +770,7 @@ read_len: * This routine is not expected to be user visible. */ void -_res_close() +res_close() { if (s >= 0) { (void) close(s); @@ -781,3 +779,26 @@ _res_close() vc = 0; } } + +#ifdef ultrix +/* ultrix 4.0 had some icky packaging in its libc.a. alias for it here. + * there is more gunk of this kind over in res_debug.c. + */ + +void +_res_close() +{ + res_close(); +} + +#undef res_send +int +res_send(buf, buflen, ans, anssiz) + const u_char *buf; + int buflen; + u_char *ans; + int anssiz; +{ + return (__res_send(buf, buflen, ans, anssiz)); +} +#endif /* Ultrix 4.0 hackery */ diff --git a/contrib/bind/res/sethostent.c b/contrib/bind/res/sethostent.c index 555bf35..2c823df 100644 --- a/contrib/bind/res/sethostent.c +++ b/contrib/bind/res/sethostent.c @@ -33,7 +33,7 @@ #if defined(LIBC_SCCS) && !defined(lint) static char sccsid[] = "@(#)sethostent.c 8.1 (Berkeley) 6/4/93"; -static char rcsid[] = "$Id: sethostent.c,v 8.4 1996/08/05 08:31:35 vixie Exp $"; +static char rcsid[] = "$Id: sethostent.c,v 8.5 1996/09/28 06:51:07 vixie Exp $"; #endif /* LIBC_SCCS and not lint */ #include <sys/types.h> @@ -43,8 +43,6 @@ static char rcsid[] = "$Id: sethostent.c,v 8.4 1996/08/05 08:31:35 vixie Exp $"; #include <netdb.h> #include <resolv.h> -void _res_close __P((void)); - void sethostent(stayopen) int stayopen; @@ -59,5 +57,5 @@ void endhostent() { _res.options &= ~(RES_STAYOPEN | RES_USEVC); - _res_close(); + res_close(); } diff --git a/contrib/bind/tools/dnsquery.c b/contrib/bind/tools/dnsquery.c index 48ef9f1..73949ca 100644 --- a/contrib/bind/tools/dnsquery.c +++ b/contrib/bind/tools/dnsquery.c @@ -54,82 +54,32 @@ char *argv[]; case 'h' : strcpy(name, optarg); break; - case 'c' : if (!strcasecmp(optarg, "IN")) - class = C_IN; - else if (!strcasecmp(optarg, "HS")) - class = C_HS; - else if (!strcasecmp(optarg, "CHAOS")) - class = C_CHAOS; - else if (!strcasecmp(optarg, "ANY")) - class = C_ANY; + case 'c' : { + int success, proto_class; + + proto_class = sym_ston(__p_class_syms, + optarg, &success); + if (success) + class = proto_class; else { - class = T_ANY; - fprintf(stderr, "optarg=%s\n", optarg); + fprintf(stderr, "Bad class (%s)\n", optarg); + exit(-1); } + } break; - case 't' : if (!strcasecmp(optarg, "A")) - type = T_A; - else if (!strcasecmp(optarg, "NS")) - type = T_NS; - else if (!strcasecmp(optarg, "MD")) - type = T_MD; - else if (!strcasecmp(optarg, "MF")) - type = T_MF; - else if (!strcasecmp(optarg, "CNAME")) - type = T_CNAME; - else if (!strcasecmp(optarg, "SOA")) - type = T_SOA; - else if (!strcasecmp(optarg, "MB")) - type = T_MB; - else if (!strcasecmp(optarg, "MG")) - type = T_MG; - else if (!strcasecmp(optarg, "MR")) - type = T_MR; - else if (!strcasecmp(optarg, "NULL")) - type = T_NULL; - else if (!strcasecmp(optarg, "WKS")) - type = T_WKS; - else if (!strcasecmp(optarg, "PTR")) - type = T_PTR; - else if (!strcasecmp(optarg, "HINFO")) - type = T_HINFO; - else if (!strcasecmp(optarg, "MINFO")) - type = T_MINFO; - else if (!strcasecmp(optarg, "MX")) - type = T_MX; - else if (!strcasecmp(optarg, "TXT")) - type = T_TXT; - else if (!strcasecmp(optarg, "RP")) - type = T_RP; - else if (!strcasecmp(optarg, "AFSDB")) - type = T_AFSDB; - else if (!strcasecmp(optarg, "ANY")) - type = T_ANY; - else if (!strcasecmp(optarg, "X25")) - type = T_X25; - else if (!strcasecmp(optarg, "ISDN")) - type = T_ISDN; - else if (!strcasecmp(optarg, "RT")) - type = T_RT; - else if (!strcasecmp(optarg, "NSAP")) - type = T_NSAP; - else if (!strcasecmp(optarg, "SIG")) - type = T_SIG; - else if (!strcasecmp(optarg, "KEY")) - type = T_KEY; - else if (!strcasecmp(optarg, "PX")) - type = T_PX; - else if (!strcasecmp(optarg, "GPOS")) - type = T_GPOS; - else if (!strcasecmp(optarg, "AAAA")) - type = T_AAAA; - else if (!strcasecmp(optarg, "LOC")) - type = T_LOC; + case 't' : { + int success, proto_type; + + proto_type = sym_ston(__p_type_syms, + optarg, &success); + if (success) + type = proto_type; else { - fprintf(stderr, "Bad type (%s)\n", optarg); + fprintf(stderr, "Bad type (%s)\n", optarg); exit(-1); } + } break; case 'd' : debug++; diff --git a/contrib/bind/tools/host.c b/contrib/bind/tools/host.c index b4abb22..9cba5b8 100644 --- a/contrib/bind/tools/host.c +++ b/contrib/bind/tools/host.c @@ -67,7 +67,7 @@ char copyright[] = */ #ifndef lint -static char rcsid[] = "$Id: host.c,v 8.8 1995/12/06 20:34:52 vixie Exp $"; +static char rcsid[] = "$Id: host.c,v 8.12 1996/10/08 04:51:07 vixie Exp $"; #endif /* not lint */ #include <sys/types.h> @@ -121,8 +121,8 @@ int list = 0; int server_specified = 0; u_char *pr_cdname(); -char *pr_class(), *pr_rr(), *pr_type(); -extern char *hostalias(); +char *pr_class(), *pr_rr(); +const char *pr_type(); main(c, v) int c; @@ -268,82 +268,36 @@ main(c, v) } +int parsetype(s) char *s; { -if (strcmp(s,"a") == 0) - return(T_A); -if (strcmp(s,"ns") == 0) - return(T_NS); -if (strcmp(s,"md") == 0) - return(T_MD); -if (strcmp(s,"mf") == 0) - return(T_MF); -if (strcmp(s,"cname") == 0) - return(T_CNAME); -if (strcmp(s,"soa") == 0) - return(T_SOA); -if (strcmp(s,"mb") == 0) - return(T_MB); -if (strcmp(s,"mg") == 0) - return(T_MG); -if (strcmp(s,"mr") == 0) - return(T_MR); -if (strcmp(s,"null") == 0) - return(T_NULL); -if (strcmp(s,"wks") == 0) - return(T_WKS); -if (strcmp(s,"ptr") == 0) - return(T_PTR); -if (strcmp(s,"hinfo") == 0) - return(T_HINFO); -if (strcmp(s,"minfo") == 0) - return(T_MINFO); -if (strcmp(s,"mx") == 0) - return(T_MX); -if (strcmp(s,"txt") == 0) - return(T_TXT); -if (strcmp(s,"rp") == 0) - return(T_RP); -if (strcmp(s,"afsdb") == 0) - return(T_AFSDB); -if (strcmp(s,"x25") == 0) - return(T_X25); -if (strcmp(s,"isdn") == 0) - return(T_ISDN); -if (strcmp(s,"rt") == 0) - return(T_RT); -if (strcmp(s,"uinfo") == 0) - return(T_UINFO); -if (strcmp(s,"uid") == 0) - return(T_UID); -if (strcmp(s,"gid") == 0) - return(T_GID); -if (strcmp(s,"unspec") == 0) - return(T_UNSPEC); -if (strcmp(s,"any") == 0) - return(T_ANY); -if (strcmp(s,"*") == 0) - return(T_ANY); -if (atoi(s)) - return(atoi(s)); -fprintf(stderr, "Invalid query type: %s\n", s); -exit(2); + int type, success; + + type = sym_ston(__p_type_syms, s, &success); + if (success) + return type; + if (strcmp(s,"*") == 0) + return(T_ANY); + if (atoi(s)) + return(atoi(s)); + fprintf(stderr, "Invalid query type: %s\n", s); + exit(2); } +int parseclass(s) char *s; { -if (strcmp(s,"in") == 0) - return(C_IN); -if (strcmp(s,"hs") == 0) - return(C_HS); -if (strcmp(s,"any") == 0) - return(C_ANY); -if (atoi(s)) - return(atoi(s)); -fprintf(stderr, "Invalid query class: %s\n", s); -exit(2); + int class, success; + + class = sym_ston(__p_class_syms, s, &success); + if (success) + return class; + if (atoi(s)) + return(atoi(s)); + fprintf(stderr, "Invalid query class: %s\n", s); + exit(2); } printanswer(hp) @@ -438,6 +392,12 @@ switch(errnum) { case T_GID: fprintf(stderr,"a Group ID.\n"); break; + case T_SRV: + fprintf(stderr,"a Server Selector.\n"); + break; + case T_NAPTR: + fprintf(stderr,"a URN Naming Authority.\n"); + break; case T_UNSPEC: fprintf(stderr,"any Unspecified Format data.\n"); break; @@ -460,7 +420,8 @@ static u_char hostbuf[BUFSIZ+1]; gethostinfo(name) char *name; { - register char *cp, **domain; + char *cp, **domain; + const char *tp; u_int n; int hp; int nDomain; @@ -479,11 +440,11 @@ gethostinfo(name) cp[-1] = '.'; return (hp); } - if (n == 0 && (cp = hostalias(name))) { + if (n == 0 && (tp = hostalias(name))) { if (verbose) - printf("Aliased to \"%s\"\n", cp); + printf("Aliased to \"%s\"\n", tp); _res.options |= RES_DEFNAMES; - return (getdomaininfo(cp, (char *)NULL)); + return (getdomaininfo(tp, (char *)NULL)); } if (n >= _res.ndots) { asis = 1; @@ -549,7 +510,7 @@ getinfo(name, domain, type) querybuf buf, answer; int n, n1, i, j, nmx, ancount, nscount, arcount, qdcount, buflen; u_short pref, class; - char host[2*MAXDNAME+2]; + char host[MAXDNAME]; if (domain == NULL) (void)sprintf(host, "%.*s", MAXDNAME, name); @@ -573,7 +534,7 @@ getinfo(name, domain, type) } eom = (char *)&answer + n; return(printinfo(&answer, eom, T_ANY, 0)); - } +} printinfo(answer, eom, filter, isls) querybuf *answer; @@ -826,6 +787,64 @@ pr_rr(cp, msg, file, filter) fprintf(file, "%s", name); break; + case T_SRV: + /* priority */ + if (doprint) + fprintf(file," %d", _getshort(cp)); + cp += sizeof(u_short); + /* weight */ + if (doprint) + fprintf(file," %d", _getshort(cp)); + cp += sizeof(u_short); + /* port */ + if (doprint) + fprintf(file," %d", _getshort(cp)); + cp += sizeof(u_short); + /* target */ + cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name)); + if (doprint) + fprintf(file,"%s",name); + break; + + case T_NAPTR: + /* order */ + if (doprint) + fprintf(file," %d", _getshort(cp)); + cp += sizeof(u_short); + /* preference */ + if (doprint) + fprintf(file," %d", _getshort(cp)); + cp += sizeof(u_short); + /* Flags */ + n = *cp++; + if (doprint) + if(n) + fprintf(file,"%c%.*s", punc, n, cp); + else + fprintf(file,"%c\"\"",punc); + cp += n; + /* Service */ + n = *cp++; + if (doprint) + if(n) + fprintf(file,"%c%.*s", punc, n, cp); + else + fprintf(file,"%c\"\"",punc); + cp += n; + /* Regexp */ + n = *cp++; + if (doprint) + if(n) + fprintf(file,"%c%.*s", punc, n, cp); + else + fprintf(file,"%c\"\"",punc); + cp += n; + /* replacement */ + cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name)); + if (doprint) + fprintf(file,"%s",name); + break; + case T_MINFO: case T_RP: cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name)); @@ -842,31 +861,37 @@ pr_rr(cp, msg, file, filter) fprintf(file, " %s", name); break; - case T_TXT: case T_X25: + if (n = *cp++) { + if (doprint) + fprintf(file,"%c%.*s", punc, n, cp); + cp += n; + } + break; + + case T_TXT: { int n,j; u_char * end = cp + dlen; - if (doprint) - (void) fputs(" \"", file); while (cp < end) { - if (n = *cp++) { - for (j = n; j > 0 && cp < end ; j --) - if ((*cp == '\n') || (*cp == '"')) { - if (doprint){ + if (doprint) + (void) fputs(" \"", file); + if (n = *cp++) + for (j = n; j > 0 && cp < end ; j --) { + if (doprint) { + if ((*cp == '\n') || (*cp == '"') || (*cp == '\\')) (void) putc('\\', file); - (void) putc(*cp++, file); - } - } else - if (doprint) - (void) putc(*cp++, file); - } + (void) putc(*cp, file); + } + cp++; + } + if (doprint) + (void) putc('"', file); } - if (doprint) - (void) fputs("\"", file); - break; } + break; + case T_UINFO: if (doprint) fprintf(file,"%c%s", punc, cp); @@ -929,78 +954,33 @@ pr_rr(cp, msg, file, filter) return (char *)cp; } -static char nbuf[20]; - /* - * Return a string for the type + * Return a string for the type. A few get special treatment when + * not in verbose mode, to make the program more chatty and easier to + * understand. */ -char * +const char * pr_type(type) int type; { - switch (type) { + + if (!verbose) switch (type) { case T_A: - return(verbose? "A" : "has address"); - case T_NS: /* authoritative server */ - return("NS"); -#ifdef OLDRR - case T_MD: /* mail destination */ - return("MD"); - case T_MF: /* mail forwarder */ - return("MF"); -#endif /* OLDRR */ + return("has address"); case T_CNAME: /* connonical name */ - return(verbose? "CNAME" : "is a nickname for"); - case T_SOA: /* start of authority zone */ - return("SOA"); - case T_MB: /* mailbox domain name */ - return("MB"); - case T_MG: /* mail group member */ - return("MG"); + return("is a nickname for"); case T_MX: /* mail routing info */ - return(verbose? "MX" : "mail is handled"); + return("mail is handled"); case T_TXT: /* TXT - descriptive info */ - return(verbose? "TXT" : "descriptive text"); + return("descriptive text"); case T_AFSDB: /* AFS/DCE info */ - return(verbose? "AFSDB" : "DCE or AFS service from"); - case T_X25: /* X25 */ - return(verbose? "X25" : "X25 address"); - case T_ISDN: /* ISDN */ - return(verbose? "ISDN" : "ISDN address"); - case T_RT: /* Router */ - return(verbose? "RT" : "router"); - case T_MR: /* mail rename name */ - return("MR"); - case T_NULL: /* null resource record */ - return("NULL"); - case T_WKS: /* well known service */ - return("WKS"); - case T_PTR: /* domain name pointer */ - return("PTR"); - case T_HINFO: /* host information */ - return("HINFO"); - case T_MINFO: /* mailbox information */ - return("MINFO"); - case T_RP: /* responsible person */ - return(verbose?"RP":"responsible person"); - case T_AXFR: /* zone transfer */ - return("AXFR"); - case T_MAILB: /* mail box */ - return("MAILB"); - case T_MAILA: /* mail address */ - return("MAILA"); - case T_ANY: /* matches any type */ - return("ANY"); - case T_UINFO: - return("UINFO"); - case T_UID: - return("UID"); - case T_GID: - return("GID"); - default: - sprintf(nbuf, "%d", type); - return nbuf; + return("DCE or AFS service from"); } + + if (verbose) + return (sym_ntos(__p_type_syms, type, NULL)); + else + return (sym_ntop(__p_type_syms, type, NULL)); } /* @@ -1010,18 +990,18 @@ char * pr_class(class) int class; { + static char spacestr[20]; - switch (class) { + if (!verbose) switch (class) { case C_IN: /* internet class */ - return(verbose? " IN" : ""); - case C_HS: /* internet class */ - return(verbose? " HS" : ""); - case C_ANY: /* matches any class */ - return(" ANY"); - default: - (void) sprintf(nbuf," %d", class); - return nbuf; + return ""; + case C_HS: /* internet class FIXME? */ + return ""; } + + spacestr[0] = ' '; + strcpy (&spacestr[1], p_class (class)); + return spacestr; } u_char * diff --git a/contrib/bind/tools/nslookup/debug.c b/contrib/bind/tools/nslookup/debug.c index e523ae6..e61c08f 100644 --- a/contrib/bind/tools/nslookup/debug.c +++ b/contrib/bind/tools/nslookup/debug.c @@ -55,7 +55,7 @@ #ifndef lint static char sccsid[] = "@(#)debug.c 5.26 (Berkeley) 3/21/91"; -static char rcsid[] = "$Id: debug.c,v 8.4 1996/05/21 07:04:38 vixie Exp $"; +static char rcsid[] = "$Id: debug.c,v 8.10 1996/12/18 04:09:50 vixie Exp $"; #endif /* not lint */ /* @@ -141,6 +141,12 @@ Fprint_query(msg, eom, printHeader,file) fprintf(file,", want recursion"); if (hp->ra) fprintf(file,", recursion avail."); + if (hp->unused) + fprintf(file,", UNUSED-QUERY_BIT"); + if (hp->ad) + fprintf(file,", authentic data"); + if (hp->cd) + fprintf(file,", checking disabled"); fprintf(file,"\n\tquestions = %d", ntohs(hp->qdcount)); fprintf(file,", answers = %d", ntohs(hp->ancount)); fprintf(file,", authority records = %d", ntohs(hp->nscount)); @@ -170,6 +176,11 @@ Fprint_query(msg, eom, printHeader,file) */ if (n = ntohs(hp->ancount)) { fprintf(file," ANSWERS:\n"); + if (type == T_A && n > MAXADDRS) { + printf("Limiting response to MAX Addrs = %d \n", + MAXADDRS); + n = MAXADDRS; + } while (--n >= 0) { fprintf(file, INDENT); cp = Print_rr(cp, msg, eom, file); @@ -248,17 +259,17 @@ Print_cdname2(cp, msg, eom, file) * Print resource record fields in human readable form. */ u_char * -Print_rr(cp, msg, eom, file) - u_char *cp, *msg, *eom; +Print_rr(ocp, msg, eom, file) + u_char *ocp, *msg, *eom; FILE *file; { int type, class, dlen, n, c; u_int32_t rrttl, ttl; struct in_addr inaddr; - u_char *cp1, *cp2; + u_char *cp, *cp1, *cp2; int debug; - if ((cp = Print_cdname(cp, msg, eom, file)) == NULL) { + if ((cp = Print_cdname(ocp, msg, eom, file)) == NULL) { fprintf(file, "(name truncated?)\n"); return (NULL); /* compression error */ } @@ -333,6 +344,45 @@ Print_rr(cp, msg, eom, file) cp += INT16SZ; fprintf(file,", mail exchanger = "); goto doname; + + case T_NAPTR: + fprintf(file, "\torder = %u",_getshort((u_char*)cp)); + cp += INT16SZ; + fprintf(file,", preference = %u\n", _getshort((u_char*)cp)); + cp += INT16SZ; + /* Flags */ + n = *cp++; + fprintf(file,"\tflags = \"%.*s\"\n", (int)n, cp); + cp += n; + /* Service */ + n = *cp++; + fprintf(file,"\tservices = \"%.*s\"\n", (int)n, cp); + cp += n; + /* Regexp */ + n = *cp++; + fprintf(file,"\trule = \"%.*s\"\n", (int)n, cp); + cp += n; + /* Replacement */ + fprintf(file,"\treplacement = "); + cp = Print_cdname(cp, msg, eom, file); + if (cp == NULL) { + fprintf(file, "(replacement truncated?)\n"); + return (NULL); /* compression error */ + } + (void) putc('\n', file); + + break; + case T_SRV: + fprintf(file, "\tpriority = %u",_getshort((u_char*)cp)); + cp += INT16SZ; + fprintf(file,", weight = %u", _getshort((u_char*)cp)); + cp += INT16SZ; + fprintf(file,", port= %u\n", _getshort((u_char*)cp)); + cp += INT16SZ; + + fprintf(file,"\thost = "); + goto doname; + case T_PX: fprintf(file,"\tpreference = %u",_getshort((u_char*)cp)); cp += INT16SZ; @@ -467,19 +517,22 @@ doname: break; case T_TXT: - (void) fputs("\ttext = \"", file); + (void) fputs("\ttext = ", file); cp2 = cp1 + dlen; while (cp < cp2) { + (void) putc('"', file); if (n = (unsigned char) *cp++) { - for (c = n; c > 0 && cp < cp2; c--) - if ((*cp == '\n') || (*cp == '"')) { - (void) putc('\\', file); - (void) putc(*cp++, file); - } else - (void) putc(*cp++, file); + for (c = n; c > 0 && cp < cp2; c--) { + if ((*cp == '\n') || (*cp == '"') || (*cp == '\\')) + (void) putc('\\', file); + (void) putc(*cp++, file); + } } + (void) putc('"', file); + if (cp < cp2) + (void) putc(' ', file); } - (void) fputs("\"\n", file); + (void) putc('\n', file); break; case T_X25: @@ -506,8 +559,9 @@ doname: case T_AAAA: { char t[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"]; - fprintf(file, "IPv6 address = %s\n", + fprintf(file, "\tIPv6 address = %s\n", inet_ntop(AF_INET6, cp, t, sizeof t)); + cp += IN6ADDRSZ; break; } @@ -574,7 +628,9 @@ doname: break; default: - fprintf(file,"\t??? unknown type %d ???\n", type); + fprintf(file,"\trecord type %d, interpreted as:\n", type); + /* Let resolver library try to print it */ + p_rr(ocp, msg, file); cp += dlen; } if (_res.options & RES_DEBUG && type != T_SOA) { diff --git a/contrib/bind/tools/nslookup/getinfo.c b/contrib/bind/tools/nslookup/getinfo.c index 4587fb6..9d31b8f 100644 --- a/contrib/bind/tools/nslookup/getinfo.c +++ b/contrib/bind/tools/nslookup/getinfo.c @@ -55,7 +55,7 @@ #ifndef lint static char sccsid[] = "@(#)getinfo.c 5.26 (Berkeley) 3/21/91"; -static char rcsid[] = "$Id: getinfo.c,v 8.3 1995/12/29 07:16:27 vixie Exp $"; +static char rcsid[] = "$Id: getinfo.c,v 8.6 1996/12/02 09:17:24 vixie Exp $"; #endif /* not lint */ /* @@ -85,11 +85,6 @@ static char rcsid[] = "$Id: getinfo.c,v 8.3 1995/12/29 07:16:27 vixie Exp $"; extern char *_res_resultcodes[]; extern char *res_skip(); -#define MAXALIASES 35 -#define MAXADDRS 35 -#define MAXDOMAINS 35 -#define MAXSERVERS 10 - static char *addr_list[MAXADDRS + 1]; static char *host_aliases[MAXALIASES]; @@ -313,6 +308,11 @@ GetAnswer(nsAddrPtr, queryType, msg, msglen, iquery, hostPtr, isServer) } break; } + if (numAddresses >= MAXADDRS) { + printf("MAXADDRS exceeded: skipping address\n"); + cp += dlen; + continue; + } bcopy(cp, *addrPtr++ = (char *)bp, dlen); bp +=dlen; cp += dlen; @@ -570,7 +570,8 @@ GetHostInfoByName(nsAddrPtr, queryClass, queryType, name, hostPtr, isServer) { int n; register int result; - register char *cp, **domain; + register char **domain; + const char *cp; Boolean got_nodata = FALSE; struct in_addr ina; Boolean tried_as_is = FALSE; diff --git a/contrib/bind/tools/nslookup/list.c b/contrib/bind/tools/nslookup/list.c index 6225e4f..6d746d7 100644 --- a/contrib/bind/tools/nslookup/list.c +++ b/contrib/bind/tools/nslookup/list.c @@ -55,7 +55,7 @@ #ifndef lint static char sccsid[] = "@(#)list.c 5.23 (Berkeley) 3/21/91"; -static char rcsid[] = "$Id: list.c,v 8.5 1996/05/21 07:04:38 vixie Exp $"; +static char rcsid[] = "$Id: list.c,v 8.9 1996/11/26 10:11:26 vixie Exp $"; #endif /* not lint */ /* @@ -209,6 +209,8 @@ ListHosts(string, putToFile) qtype = T_WKS; } else if (strcmp("-d", option) == 0) { qtype = T_ANY; + } else if (strcmp("-n", option) == 0) { + qtype = T_NAPTR; } else { qtype = T_A; } @@ -339,97 +341,6 @@ ListSubr(qtype, domain, cmd) defaultPtr->servers[0]->name); } -#if 0 - if (qtype == T_CNAME) { - fprintf(filePtr, "%-30s", "Alias"); - } else if (qtype == T_TXT) { - fprintf(filePtr, "%-30s", "Key"); - } else { - fprintf(filePtr, "%-30s", "Host or domain name"); - } - switch (qtype) { - case T_A: - fprintf(filePtr, " %-30s\n", "Internet Address"); - break; - case T_AAAA: - fprintf(filePtr, " %-30s\n", "IPv6 Address"); - break; - case T_HINFO: - fprintf(filePtr, " %-30s\n", "CPU & OS"); - break; - case T_CNAME: - fprintf(filePtr, " %-30s\n", "Canonical Name"); - break; - case T_MX: - fprintf(filePtr, " %-30s\n", "Metric & Host"); - break; - case T_PX: - fprintf(filePtr, " %-30s\n", "Mapping information"); - break; - case T_AFSDB: - fprintf(filePtr, " %-30s\n", "Subtype & Host"); - break; - case T_X25: - fprintf(filePtr, " %-30s\n", "X25 Address"); - break; - case T_ISDN: - fprintf(filePtr, " %-30s\n", "ISDN Address"); - break; - case T_WKS: - fprintf(filePtr, " %-4s %s\n", "Protocol", "Services"); - break; - case T_MB: - fprintf(filePtr, " %-30s\n", "Mailbox"); - break; - case T_MG: - fprintf(filePtr, " %-30s\n", "Mail Group"); - break; - case T_MR: - fprintf(filePtr, " %-30s\n", "Mail Rename"); - break; - case T_MINFO: - fprintf(filePtr, " %-30s\n", "Mail List Requests & Errors"); - break; - case T_UINFO: - fprintf(filePtr, " %-30s\n", "User Information"); - break; - case T_UID: - fprintf(filePtr, " %-30s\n", "User ID"); - break; - case T_GID: - fprintf(filePtr, " %-30s\n", "Group ID"); - break; - case T_TXT: - fprintf(filePtr, " %-30s\n", "Text"); - break; - case T_RP: - fprintf(filePtr, " %-30s\n", "Responsible Person"); - break; - case T_RT: - fprintf(filePtr, " %-30s\n", "Router"); - break; - case T_NSAP: - fprintf(filePtr, " %-30s\n", "NSAP address"); - break; - case T_NSAP_PTR: - fprintf(filePtr, " %-30s\n", "NSAP pointer"); - break; - case T_NS: - fprintf(filePtr, " %-30s\n", "Name Servers"); - break; - case T_PTR: - fprintf(filePtr, " %-30s\n", "Pointers"); - break; - case T_SOA: - fprintf(filePtr, " %-30s\n", "Start of Authority"); - break; - case T_ANY: - fprintf(filePtr, " %-30s\n", "Resource Record Info."); - break; - } -#endif - - dname[0][0] = '\0'; for (done = 0; !done; NULL) { unsigned short tmp; @@ -810,22 +721,30 @@ PrintListInfo(file, msg, eom, qtype, domain) cp += nameLen; break; - case T_TXT: case T_X25: + if (n = *cp++) { + fprintf(file," %.*s", n, cp); + cp += n; + } + break; + + case T_TXT: { u_char *cp2 = cp + dlen; int c; - (void) fputs(" \"", file); - while (cp < cp2) + while (cp < cp2) { + (void) putc('"', file); if (n = (unsigned char) *cp++) - for (c = n; c > 0 && cp < cp2; c--) - if (strchr("\n\"\\", *cp)) { + for (c = n; c > 0 && cp < cp2; c--) { + if (strchr("\n\"\\", *cp)) (void) putc('\\', file); - (void) putc(*cp++, file); - } else - (void) putc(*cp++, file); - (void) putc('"', file); + (void) putc(*cp++, file); + } + (void) putc('"', file); + if (cp < cp2) + (void) putc(' ', file); + } } break; @@ -838,9 +757,56 @@ PrintListInfo(file, msg, eom, qtype, domain) char t[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"]; fprintf(file, " %s", inet_ntop(AF_INET6, cp, t, sizeof t)); + cp += dlen; + break; + } + + case T_LOC: { + char t[255]; + + fprintf(file, "\t%s", loc_ntoa(cp, t)); + cp += dlen; break; } + case T_SRV: { + u_int priority, weight, port; + + priority = _getshort(cp); cp += INT16SZ; + weight = _getshort(cp); cp += INT16SZ; + port = _getshort(cp); cp += INT16SZ; + fprintf(file, "\t%u %u %u ", priority, weight, port); + if ((cp = (u_char *)Print_cdname(cp, msg, eom, file)) == NULL) + return (ERROR); + break; + } + + case T_NAPTR: { + u_int order, preference; + + GETSHORT(order, cp); + fprintf(file, "\t%u", order); + + GETSHORT(preference, cp); + fprintf(file, " %u", preference); + + if (n = *cp++) { + fprintf(file, " \"%.*s\"", (int)n, cp); + cp += n; + } + if (n = *cp++) { + fprintf(file, " \"%.*s\"", (int)n, cp); + cp += n; + } + if (n = *cp++) { + fprintf(file, " \"%.*s\"", (int)n, cp); + cp += n; + } + if ((cp = (u_char *)Print_cdname(cp, msg, eom, file)) == NULL) + return (ERROR); + break; + } + case T_MINFO: case T_RP: (void) putc(' ', file); diff --git a/contrib/bind/tools/nslookup/main.c b/contrib/bind/tools/nslookup/main.c index fb674b5..ff2e429 100644 --- a/contrib/bind/tools/nslookup/main.c +++ b/contrib/bind/tools/nslookup/main.c @@ -61,7 +61,7 @@ char copyright[] = #ifndef lint static char sccsid[] = "@(#)main.c 5.42 (Berkeley) 3/3/91"; -static char rcsid[] = "$Id: main.c,v 8.3 1996/06/02 08:20:41 vixie Exp $"; +static char rcsid[] = "$Id: main.c,v 8.4 1996/11/11 06:36:54 vixie Exp $"; #endif /* not lint */ /* @@ -1102,7 +1102,9 @@ ReadRC() register char *cp; char buf[PATH_MAX]; - if ((cp = getenv("HOME")) != NULL) { + if ((cp = getenv("HOME")) != NULL && + (strlen(cp) + strlen(_PATH_NSLOOKUPRC)) < sizeof(buf)) { + (void) strcpy(buf, cp); (void) strcat(buf, _PATH_NSLOOKUPRC); diff --git a/contrib/bind/tools/nslookup/nslookup.help b/contrib/bind/tools/nslookup/nslookup.help index 18f2e6b..9876e6f 100644 --- a/contrib/bind/tools/nslookup/nslookup.help +++ b/contrib/bind/tools/nslookup/nslookup.help @@ -1,4 +1,4 @@ -$Id: nslookup.help,v 8.3 1996/08/05 08:31:39 vixie Exp $ +$Id: nslookup.help,v 8.4 1996/10/08 04:51:08 vixie Exp $ Commands: (identifiers are shown in uppercase, [] means optional) NAME - print info about the host/domain NAME using default server @@ -16,7 +16,7 @@ set OPTION - set an option root=NAME - set root server to NAME retry=X - set number of retries to X timeout=X - set initial time-out interval to X seconds - querytype=X - set query type, e.g., A,ANY,CNAME,HINFO,MX,PX,NS,PTR,SOA,TXT,WKS + querytype=X - set query type, e.g., A,ANY,CNAME,HINFO,MX,PX,NS,PTR,SOA,TXT,WKS,SRV,NAPTR port=X - set port number to send query on type=X - synonym for querytype class=X - set query class to one of IN (Internet), CHAOS, HESIOD or ANY diff --git a/contrib/bind/tools/nslookup/res.h b/contrib/bind/tools/nslookup/res.h index 9363f38..6fe43c8 100644 --- a/contrib/bind/tools/nslookup/res.h +++ b/contrib/bind/tools/nslookup/res.h @@ -55,7 +55,7 @@ /* * @(#)res.h 5.10 (Berkeley) 6/1/90 - * $Id: res.h,v 8.1 1994/12/15 06:24:31 vixie Exp $ + * $Id: res.h,v 8.3 1996/12/02 09:17:24 vixie Exp $ */ /* @@ -77,6 +77,11 @@ #define FALSE 0 typedef int Boolean; +#define MAXALIASES 35 +#define MAXADDRS 35 +#define MAXDOMAINS 35 +#define MAXSERVERS 10 + /* * Define return statuses in addtion to the ones defined in namserv.h * let SUCCESS be a synonym for NOERROR @@ -159,8 +164,8 @@ extern int Print_query(); extern unsigned char *Print_cdname(); extern unsigned char *Print_cdname2(); /* fixed width */ extern unsigned char *Print_rr(); -extern char *DecodeType(); /* descriptive version of p_type */ -extern char *DecodeError(); +extern const char *DecodeType(); /* descriptive version of p_type */ +extern const char *DecodeError(); extern char *Calloc(); extern char *Malloc(); extern void NsError(); diff --git a/contrib/bind/tools/nslookup/subr.c b/contrib/bind/tools/nslookup/subr.c index 59a47f5..615e6eb 100644 --- a/contrib/bind/tools/nslookup/subr.c +++ b/contrib/bind/tools/nslookup/subr.c @@ -55,7 +55,7 @@ #ifndef lint static char sccsid[] = "@(#)subr.c 5.24 (Berkeley) 3/2/91"; -static char rcsid[] = "$Id: subr.c,v 8.5 1996/05/21 07:04:38 vixie Exp $"; +static char rcsid[] = "$Id: subr.c,v 8.6 1996/08/08 06:54:51 vixie Exp $"; #endif /* not lint */ /* @@ -84,6 +84,7 @@ static char rcsid[] = "$Id: subr.c,v 8.5 1996/05/21 07:04:38 vixie Exp $"; #include <signal.h> #include <setjmp.h> #include <stdio.h> +#include "resolv.h" #include "res.h" #include "../../conf/portability.h" @@ -371,28 +372,35 @@ OpenFile(string, file) ******************************************************************************* */ -char * +const struct res_sym error_syms[] = { + { NOERROR, "Success" }, + { FORMERR, "Format error" }, + { SERVFAIL, "Server failed" }, + { NXDOMAIN, "Non-existent host/domain" }, + { NOTIMP, "Not implemented" }, + { REFUSED, "Query refused" }, +#ifdef NOCHANGE + { NOCHANGE, "No change" }, +#endif + { TIME_OUT, "Timed out" }, + { NO_INFO, "No information" }, + { ERROR, "Unspecified error" }, + { NONAUTH, "Non-authoritative answer" }, + { NO_RESPONSE, "No response from server" }, + { 0, NULL } +}; + +const char * DecodeError(result) int result; { - switch (result) { - case NOERROR: return("Success"); break; - case FORMERR: return("Format error"); break; - case SERVFAIL: return("Server failed"); break; - case NXDOMAIN: return("Non-existent host/domain"); break; - case NOTIMP: return("Not implemented"); break; - case REFUSED: return("Query refused"); break; -#ifdef NOCHANGE - case NOCHANGE: return("No change"); break; -#endif - case TIME_OUT: return("Timed out"); break; - case NO_INFO: return("No information"); break; - case ERROR: return("Unspecified error"); break; - case NONAUTH: return("Non-authoritative answer"); break; - case NO_RESPONSE: return("No response from server"); break; - default: break; - } - return("BAD ERROR VALUE"); + const char *string; + int success; + + string = sym_ntos(error_syms, result, &success); + if (success) + return string; + return ("BAD ERROR VALUE"); } @@ -402,15 +410,12 @@ StringToClass(class, dflt, errorfile) int dflt; FILE *errorfile; { - if (strcasecmp(class, "IN") == 0) - return(C_IN); - if (strcasecmp(class, "HESIOD") == 0 || - strcasecmp(class, "HS") == 0) - return(C_HS); - if (strcasecmp(class, "CHAOS") == 0) - return(C_CHAOS); - if (strcasecmp(class, "ANY") == 0) - return(C_ANY); + int result, success; + + result = sym_ston(__p_class_syms, class, &success); + if (success) + return result; + if (errorfile) fprintf(errorfile, "unknown query class: %s\n", class); return(dflt); @@ -434,67 +439,15 @@ StringToType(type, dflt, errorfile) int dflt; FILE *errorfile; { - if (strcasecmp(type, "A") == 0) - return(T_A); - if (strcasecmp(type, "NS") == 0) - return(T_NS); /* authoritative server */ - if (strcasecmp(type, "MX") == 0) - return(T_MX); /* mail exchanger */ - if (strcasecmp(type, "PX") == 0) - return(T_PX); /* mapping information */ - if (strcasecmp(type, "CNAME") == 0) - return(T_CNAME); /* canonical name */ - if (strcasecmp(type, "SOA") == 0) - return(T_SOA); /* start of authority zone */ - if (strcasecmp(type, "MB") == 0) - return(T_MB); /* mailbox domain name */ - if (strcasecmp(type, "MG") == 0) - return(T_MG); /* mail group member */ - if (strcasecmp(type, "MR") == 0) - return(T_MR); /* mail rename name */ - if (strcasecmp(type, "WKS") == 0) - return(T_WKS); /* well known service */ - if (strcasecmp(type, "PTR") == 0) - return(T_PTR); /* domain name pointer */ - if (strcasecmp(type, "HINFO") == 0) - return(T_HINFO); /* host information */ - if (strcasecmp(type, "MINFO") == 0) - return(T_MINFO); /* mailbox information */ - if (strcasecmp(type, "AXFR") == 0) - return(T_AXFR); /* zone transfer */ - if (strcasecmp(type, "MAILA") == 0) - return(T_MAILA); /* mail agent */ - if (strcasecmp(type, "MAILB") == 0) - return(T_MAILB); /* mail box */ - if (strcasecmp(type, "ANY") == 0) - return(T_ANY); /* matches any type */ - if (strcasecmp(type, "UINFO") == 0) - return(T_UINFO); /* user info */ - if (strcasecmp(type, "UID") == 0) - return(T_UID); /* user id */ - if (strcasecmp(type, "GID") == 0) - return(T_GID); /* group id */ - if (strcasecmp(type, "TXT") == 0) - return(T_TXT); /* text */ - if (strcasecmp(type, "RP") == 0) - return(T_RP); /* responsible person */ - if (strcasecmp(type, "X25") == 0) - return(T_X25); /* x25 address */ - if (strcasecmp(type, "ISDN") == 0) - return(T_ISDN); /* isdn address */ - if (strcasecmp(type, "RT") == 0) - return(T_RT); /* router */ - if (strcasecmp(type, "AFSDB") == 0) - return(T_AFSDB); /* DCE or AFS server */ - if (strcasecmp(type, "NSAP") == 0) - return(T_NSAP); /* NSAP address */ - if (strcasecmp(type, "NSAP_PTR") == 0) - return(T_NSAP_PTR); /* NSAP reverse pointer */ - if (strcasecmp(type, "AAAA") == 0) - return(T_AAAA); /* IPv6 address */ + int result, success; + + result = sym_ston(__p_type_syms, type, &success); + if (success) + return (result); + if (errorfile) fprintf(errorfile, "unknown query type: %s\n", type); - return(dflt); + return (dflt); } /* @@ -509,75 +462,10 @@ StringToType(type, dflt, errorfile) ******************************************************************************* */ -static char nbuf[20]; - -char * +const char * DecodeType(type) int type; { - switch (type) { - case T_A: - return("address"); - case T_AAAA: - return("IPv6 address"); - case T_NS: - return("name server"); - case T_CNAME: - return("canonical name"); - case T_SOA: - return("start of authority"); - case T_MB: - return("mailbox"); - case T_MG: - return("mail group member"); - case T_MR: - return("mail rename"); - case T_NULL: - return("null"); - case T_WKS: - return("well-known service"); - case T_PTR: - return("domain name pointer"); - case T_HINFO: - return("host information"); - case T_MINFO: - return("mailbox information"); - case T_MX: - return("mail exchanger"); - case T_PX: - return("mapping information"); - case T_TXT: - return("text"); - case T_RP: - return("responsible person"); - case T_AFSDB: - return("DCE or AFS server"); - case T_X25: - return("X25 address"); - case T_ISDN: - return("ISDN address"); - case T_RT: - return("router"); - case T_NSAP: - return("nsap address"); - case T_NSAP_PTR: - return("domain name pointer"); - case T_UINFO: - return("user information"); - case T_UID: - return("user ID"); - case T_GID: - return("group ID"); - case T_AXFR: - return("zone transfer"); - case T_MAILB: - return("mailbox-related data"); - case T_MAILA: - return("mail agent"); - case T_ANY: - return("\"any\""); - default: - (void) sprintf(nbuf, "%d", type); - return (nbuf); - } + + return (sym_ntop(__p_type_syms, type, (int *)0)); } |
