diff -Nru ldns-1.7.0~rc3/Changelog ldns-1.7.0/Changelog --- ldns-1.7.0~rc3/Changelog 2016-12-15 16:34:32.000000000 +0000 +++ ldns-1.7.0/Changelog 2016-12-20 10:48:22.000000000 +0000 @@ -1,4 +1,4 @@ -1.7.0 2016-12-?? +1.7.0 2016-12-20 * Fix lookup of relative names in ldns_resolver_search. * bugfix #548: Double free for answers > 4096 in ldns_resolver_send_pkt * Follow CNAME's when tracing with drill (TODO dnssec trace) @@ -109,6 +109,9 @@ * Clarify data ownership with consts for tsig parameters. Thanks Michael Weiser * bugfix: Fix detection of DSA support with OpenSSL >= 1.1.0 + * bugfix #1160: Provide sha256 for release tarballs + * --enable-gost-anyway compiles GOST support with OpenSSL >= 1.1.0 + even when the GOST engine is not available. 1.6.17 2014-01-10 * Fix ldns_dnssec_zone_new_frm_fp_l to allow the last parsed line of a diff -Nru ldns-1.7.0~rc3/configure ldns-1.7.0/configure --- ldns-1.7.0~rc3/configure 2016-12-15 16:34:48.000000000 +0000 +++ ldns-1.7.0/configure 2016-12-20 10:48:27.000000000 +0000 @@ -808,6 +808,7 @@ with_ssl enable_sha2 enable_gost +enable_gost_anyway enable_ecdsa enable_dsa enable_ed25519 @@ -1474,6 +1475,7 @@ --enable-poll This platform supports poll(7) --disable-sha2 Disable SHA256 and SHA512 RRSIG support --disable-gost Disable GOST support + --enable-gost-anyway Enable GOST even whithout a GOST engine installed --disable-ecdsa Disable ECDSA support --disable-dsa Disable DSA support --enable-ed25519 Enable ED25519 support (experimental) @@ -15461,6 +15463,8 @@ ;; esac +# check wether gost also works + # Check whether --enable-gost was given. if test "${enable_gost+set}" = set; then : enableval=$enable_gost; @@ -15489,10 +15493,145 @@ fi -cat >>confdefs.h <<_ACEOF -#define USE_GOST 1 +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if GOST works" >&5 +$as_echo_n "checking if GOST works... " >&6; } +if test c${cross_compiling} = cno; then +BAKCFLAGS="$CFLAGS" +if test -n "$ssldir"; then + CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib" +fi +if test "$cross_compiling" = yes; then : + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "cannot run test program while cross compiling +See \`config.log' for more details" "$LINENO" 5; } +else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +#include +#include +#include +#include +#include +/* routine to load gost (from sldns) */ +int load_gost_id(void) +{ + static int gost_id = 0; + const EVP_PKEY_ASN1_METHOD* meth; + ENGINE* e; + + if(gost_id) return gost_id; + + /* see if configuration loaded gost implementation from other engine*/ + meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1); + if(meth) { + EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth); + return gost_id; + } + + /* see if engine can be loaded already */ + e = ENGINE_by_id("gost"); + if(!e) { + /* load it ourself, in case statically linked */ + ENGINE_load_builtin_engines(); + ENGINE_load_dynamic(); + e = ENGINE_by_id("gost"); + } + if(!e) { + /* no gost engine in openssl */ + return 0; + } + if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) { + ENGINE_finish(e); + ENGINE_free(e); + return 0; + } + + meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1); + if(!meth) { + /* algo not found */ + ENGINE_finish(e); + ENGINE_free(e); + return 0; + } + EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth); + return gost_id; +} +int main(void) { + EVP_MD_CTX* ctx; + const EVP_MD* md; + unsigned char digest[64]; /* its a 256-bit digest, so uses 32 bytes */ + const char* str = "Hello world"; + const unsigned char check[] = { + 0x40 , 0xed , 0xf8 , 0x56 , 0x5a , 0xc5 , 0x36 , 0xe1 , + 0x33 , 0x7c , 0x7e , 0x87 , 0x62 , 0x1c , 0x42 , 0xe0 , + 0x17 , 0x1b , 0x5e , 0xce , 0xa8 , 0x46 , 0x65 , 0x4d , + 0x8d , 0x3e , 0x22 , 0x9b , 0xe1 , 0x30 , 0x19 , 0x9d + }; + OPENSSL_config(NULL); + (void)load_gost_id(); + md = EVP_get_digestbyname("md_gost94"); + if(!md) return 1; + memset(digest, 0, sizeof(digest)); + ctx = EVP_MD_CTX_create(); + if(!ctx) return 2; + if(!EVP_DigestInit_ex(ctx, md, NULL)) return 3; + if(!EVP_DigestUpdate(ctx, str, 10)) return 4; + if(!EVP_DigestFinal_ex(ctx, digest, NULL)) return 5; + /* uncomment to see the hash calculated. + {int i; + for(i=0; i<32; i++) + printf(" %2.2x", (int)digest[i]); + printf("\n");} + */ + if(memcmp(digest, check, sizeof(check)) != 0) + return 6; + return 0; +} + _ACEOF +if ac_fn_c_try_run "$LINENO"; then : + eval "ac_cv_c_gost_works=yes" +else + eval "ac_cv_c_gost_works=no" +fi +rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ + conftest.$ac_objext conftest.beam conftest.$ac_ext +fi + +CFLAGS="$BAKCFLAGS" +else +eval "ac_cv_c_gost_works=maybe" +fi + + # Check whether --enable-gost-anyway was given. +if test "${enable_gost_anyway+set}" = set; then : + enableval=$enable_gost_anyway; +fi + + if test "$ac_cv_c_gost_works" != "no" -o "$enable_gost_anyway" = "yes"; then + if test "$ac_cv_c_gost_works" = "no"; then + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, but compiling with GOST support anyway" >&5 +$as_echo "no, but compiling with GOST support anyway" >&6; } + else + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +$as_echo "yes" >&6; } + fi + use_gost="yes" +$as_echo "#define USE_GOST 1" >>confdefs.h + + else + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } + { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Gost support does not work because the engine is missing." >&5 +$as_echo "$as_me: WARNING: Gost support does not work because the engine is missing." >&2;} + { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Install gost-engine first or use the --enable-gost-anyway to compile with GOST support anyway" >&5 +$as_echo "$as_me: WARNING: Install gost-engine first or use the --enable-gost-anyway to compile with GOST support anyway" >&2;} + { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: See also https://github.com/gost-engine/engine/wiki for information about gost-engine" >&5 +$as_echo "$as_me: WARNING: See also https://github.com/gost-engine/engine/wiki for information about gost-engine" >&2;} + fi ;; esac diff -Nru ldns-1.7.0~rc3/configure.ac ldns-1.7.0/configure.ac --- ldns-1.7.0~rc3/configure.ac 2016-12-15 16:34:44.000000000 +0000 +++ ldns-1.7.0/configure.ac 2016-12-20 10:48:22.000000000 +0000 @@ -354,6 +354,103 @@ ;; esac +# check wether gost also works +AC_DEFUN([AC_CHECK_GOST_WORKS], +[AC_REQUIRE([AC_PROG_CC]) +AC_MSG_CHECKING([if GOST works]) +if test c${cross_compiling} = cno; then +BAKCFLAGS="$CFLAGS" +if test -n "$ssldir"; then + CFLAGS="$CFLAGS -Wl,-rpath,$ssldir/lib" +fi +AC_RUN_IFELSE([AC_LANG_SOURCE([[ +#include +#include +#include +#include +#include +/* routine to load gost (from sldns) */ +int load_gost_id(void) +{ + static int gost_id = 0; + const EVP_PKEY_ASN1_METHOD* meth; + ENGINE* e; + + if(gost_id) return gost_id; + + /* see if configuration loaded gost implementation from other engine*/ + meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1); + if(meth) { + EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth); + return gost_id; + } + + /* see if engine can be loaded already */ + e = ENGINE_by_id("gost"); + if(!e) { + /* load it ourself, in case statically linked */ + ENGINE_load_builtin_engines(); + ENGINE_load_dynamic(); + e = ENGINE_by_id("gost"); + } + if(!e) { + /* no gost engine in openssl */ + return 0; + } + if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) { + ENGINE_finish(e); + ENGINE_free(e); + return 0; + } + + meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1); + if(!meth) { + /* algo not found */ + ENGINE_finish(e); + ENGINE_free(e); + return 0; + } + EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth); + return gost_id; +} +int main(void) { + EVP_MD_CTX* ctx; + const EVP_MD* md; + unsigned char digest[64]; /* its a 256-bit digest, so uses 32 bytes */ + const char* str = "Hello world"; + const unsigned char check[] = { + 0x40 , 0xed , 0xf8 , 0x56 , 0x5a , 0xc5 , 0x36 , 0xe1 , + 0x33 , 0x7c , 0x7e , 0x87 , 0x62 , 0x1c , 0x42 , 0xe0 , + 0x17 , 0x1b , 0x5e , 0xce , 0xa8 , 0x46 , 0x65 , 0x4d , + 0x8d , 0x3e , 0x22 , 0x9b , 0xe1 , 0x30 , 0x19 , 0x9d + }; + OPENSSL_config(NULL); + (void)load_gost_id(); + md = EVP_get_digestbyname("md_gost94"); + if(!md) return 1; + memset(digest, 0, sizeof(digest)); + ctx = EVP_MD_CTX_create(); + if(!ctx) return 2; + if(!EVP_DigestInit_ex(ctx, md, NULL)) return 3; + if(!EVP_DigestUpdate(ctx, str, 10)) return 4; + if(!EVP_DigestFinal_ex(ctx, digest, NULL)) return 5; + /* uncomment to see the hash calculated. + {int i; + for(i=0; i<32; i++) + printf(" %2.2x", (int)digest[i]); + printf("\n");} + */ + if(memcmp(digest, check, sizeof(check)) != 0) + return 6; + return 0; +} +]])] , [eval "ac_cv_c_gost_works=yes"], [eval "ac_cv_c_gost_works=no"]) +CFLAGS="$BAKCFLAGS" +else +eval "ac_cv_c_gost_works=maybe" +fi +])dnl + AC_ARG_ENABLE(gost, AC_HELP_STRING([--disable-gost], [Disable GOST support])) case "$enable_gost" in no) @@ -365,7 +462,22 @@ AC_MSG_CHECKING(for GOST) AC_CHECK_FUNC(EVP_PKEY_set_type_str, [],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support or rerun with --disable-gost])]) AC_CHECK_FUNC(EC_KEY_new, [], [AC_MSG_ERROR([No ECC functions found in OpenSSL: please upgrade OpenSSL or rerun with --disable-gost])]) - AC_DEFINE_UNQUOTED([USE_GOST], [1], [Define this to enable GOST support.]) + AC_CHECK_GOST_WORKS + AC_ARG_ENABLE(gost-anyway, AC_HELP_STRING([--enable-gost-anyway], [Enable GOST even whithout a GOST engine installed])) + if test "$ac_cv_c_gost_works" != "no" -o "$enable_gost_anyway" = "yes"; then + if test "$ac_cv_c_gost_works" = "no"; then + AC_MSG_RESULT([no, but compiling with GOST support anyway]) + else + AC_MSG_RESULT([yes]) + fi + use_gost="yes" + AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.]) + else + AC_MSG_RESULT([no]) + AC_MSG_WARN([Gost support does not work because the engine is missing.]) + AC_MSG_WARN([Install gost-engine first or use the --enable-gost-anyway to compile with GOST support anyway]) + AC_MSG_WARN([See also https://github.com/gost-engine/engine/wiki for information about gost-engine]) + fi ;; esac diff -Nru ldns-1.7.0~rc3/contrib/DNS-LDNS/LDNS.xs ldns-1.7.0/contrib/DNS-LDNS/LDNS.xs --- ldns-1.7.0~rc3/contrib/DNS-LDNS/LDNS.xs 2016-12-15 16:34:34.000000000 +0000 +++ ldns-1.7.0/contrib/DNS-LDNS/LDNS.xs 2016-12-20 10:48:23.000000000 +0000 @@ -2184,7 +2184,7 @@ ALIAS: nameservers_randomize = 1 -char* +const char* ldns_resolver_tsig_keyname(resolver) DNS__LDNS__Resolver resolver; ALIAS: @@ -2197,7 +2197,7 @@ ALIAS: set_tsig_keyname = 1 -char* +const char* ldns_resolver_tsig_algorithm(resolver) DNS__LDNS__Resolver resolver; ALIAS: @@ -2210,7 +2210,7 @@ ALIAS: set_tsig_algorithm = 1 -char* +const char* ldns_resolver_tsig_keydata(resolver) DNS__LDNS__Resolver resolver; ALIAS: diff -Nru ldns-1.7.0~rc3/contrib/python/ldns.i ldns-1.7.0/contrib/python/ldns.i --- ldns-1.7.0~rc3/contrib/python/ldns.i 2016-12-15 16:34:32.000000000 +0000 +++ ldns-1.7.0/contrib/python/ldns.i 2016-12-20 10:48:22.000000000 +0000 @@ -126,6 +126,9 @@ %immutable ldns_struct_rr_descriptor::_name; %immutable ldns_error_str; %immutable ldns_signing_algorithms; +%immutable ldns_tsig_credentials_struct::algorithm; +%immutable ldns_tsig_credentials_struct::keyname; +%immutable ldns_tsig_credentials_struct::keydata; //*_new_frm_fp_l %apply int *OUTPUT { (int *line_nr) }; diff -Nru ldns-1.7.0~rc3/contrib/python/ldns_resolver.i ldns-1.7.0/contrib/python/ldns_resolver.i --- ldns-1.7.0~rc3/contrib/python/ldns_resolver.i 2016-12-15 16:34:32.000000000 +0000 +++ ldns-1.7.0/contrib/python/ldns_resolver.i 2016-12-20 10:48:22.000000000 +0000 @@ -113,9 +113,9 @@ %rename(__ldns_resolver_tsig_algorithm) ldns_resolver_tsig_algorithm; %inline %{ - char * _ldns_resolver_tsig_algorithm(const ldns_resolver *res) + const char * _ldns_resolver_tsig_algorithm(const ldns_resolver *res) { - char *str; + const char *str; str = ldns_resolver_tsig_algorithm(res); if (str != NULL) { str = strdup(str); @@ -128,9 +128,9 @@ %rename(__ldns_resolver_tsig_keydata) ldns_resolver_tsig_keydata; %inline %{ - char * _ldns_resolver_tsig_keydata(const ldns_resolver *res) + const char * _ldns_resolver_tsig_keydata(const ldns_resolver *res) { - char *str; + const char *str; str = ldns_resolver_tsig_keydata(res); if (str != NULL) { str = strdup(str); @@ -143,9 +143,9 @@ %rename(__ldns_resolver_tsig_keyname) ldns_resolver_tsig_keyname; %inline %{ - char * _ldns_resolver_tsig_keyname(const ldns_resolver *res) + const char * _ldns_resolver_tsig_keyname(const ldns_resolver *res) { - char *str; + const char *str; str = ldns_resolver_tsig_keyname(res); if (str != NULL) { str = strdup(str); diff -Nru ldns-1.7.0~rc3/debian/changelog ldns-1.7.0/debian/changelog --- ldns-1.7.0~rc3/debian/changelog 2016-12-17 09:36:30.000000000 +0000 +++ ldns-1.7.0/debian/changelog 2016-12-21 12:12:52.000000000 +0000 @@ -1,3 +1,10 @@ +ldns (1.7.0-1) unstable; urgency=medium + + * Imported Upstream version 1.7.0 + * Use --enable-gost-anyway to enable GOST even when not available at compile time + + -- Ondřej Surý Wed, 21 Dec 2016 13:12:52 +0100 + ldns (1.7.0~rc3-1) unstable; urgency=medium * Imported Upstream version 1.7.0~rc3 diff -Nru ldns-1.7.0~rc3/debian/rules ldns-1.7.0/debian/rules --- ldns-1.7.0~rc3/debian/rules 2016-12-17 09:36:30.000000000 +0000 +++ ldns-1.7.0/debian/rules 2016-12-21 12:12:52.000000000 +0000 @@ -17,7 +17,7 @@ dh $@ --with python2 --with autoreconf --with autotools-dev override_dh_auto_configure: - dh_auto_configure -- --disable-rpath --enable-gost --with-pyldns --with-examples --with-drill --disable-ldns-config + dh_auto_configure -- --disable-rpath --enable-gost --enable-gost-anyway --with-pyldns --with-examples --with-drill --disable-ldns-config override_dh_strip: dh_strip -O--dbgsym-migration='libldns1-dbg (<< 1.7.0~)' diff -Nru ldns-1.7.0~rc3/doc/header.html ldns-1.7.0/doc/header.html --- ldns-1.7.0~rc3/doc/header.html 2016-12-15 16:34:32.000000000 +0000 +++ ldns-1.7.0/doc/header.html 2016-12-20 10:48:22.000000000 +0000 @@ -1,10 +1,55 @@ - - -ldns documentation - - - -