Skip to content

Review/michael panic openssl 3#1

Draft
wtoorop wants to merge 68 commits into
Michael-Panic:openssl-3from
NLnetLabs:review/Michael-Panic-openssl-3
Draft

Review/michael panic openssl 3#1
wtoorop wants to merge 68 commits into
Michael-Panic:openssl-3from
NLnetLabs:review/Michael-Panic-openssl-3

Conversation

@wtoorop
Copy link
Copy Markdown

@wtoorop wtoorop commented Nov 21, 2025

Some fixes and updates that came out of review

jschauma and others added 30 commits July 8, 2023 13:19
Why:

* Compiling a .o file alone will compile with "-c file.c"
* Compiling a .lo file alone will create the corresponding .o files with "-c ./file.c"
* Building with "make -j1" will only execute the .lo rules; the .o rules will
  be skipped since the .o files are already created from the .lo rules with
  option "-c ./file.c"
* Building with "make -j2" will execute the .lo rules and the .o rules in
  parallel with option "-c file.c"
* assert() captures the path of the source file (taken from the -c option) in
  the compiled binary in order to display the source of the assertion error
* Hence the compiled binaries are not reproducible depending on the number of
  make parallel jobs

Example:

* when compiling examples/ldns-dane with "make -j1", the binary contains the
  string "./examples/ldns-dane.c"
* when compiling examples/ldns-dane with "make -j2", the binary contains the
  string "examples/ldns-dane.c"
Most of the time, in most systems the openSSL RNG seeds itself
automatically, in that case rand status returns 1, this is
sufficient to return early.
Swig has changed language specific AppendOutput functions. But helper
macro SWIG_AppendOutput remains unchanged. Use that everywhere instead
of SWIG_Python_AppendOutput, which would require one extra parameter
since swig 4.3.0.

https://github.com/swig/swig/blob/v4.3.0/CHANGES.current#L376
swig/swig#2905
Note that zone output may also be NSEC3 hashed, not just NSEC hashed.

Refer to the SEP bit rather than the KSK bit as there is no KSK bit in a DNSKEY.
Because they don't run anymore
This is an api change, so we bump version to ldns-1.9.0
  instead of passing by when one RRSIG validates. That prints output
  for spurious RRSIGs, the failures for them.
Updates to ldns_is_rrset()

Thanks @tgreenx ! Looks good to me!
Features/additional rr types

Thanks for the review @wcawijngaard
wtoorop and others added 30 commits November 14, 2025 15:21
* PR #286: Fix RR Type AMTRELAY type nogateway, to print relay '.',
  and memory leaks in parsing it.
No long draft-ietf-dnsop-generalized-notify
All the bits and pieces from IANA's DNS Parameters page
Plus updated Extended DNS Errors
…ldns into InfrastructureServices-develop-swig-4.3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.