Commit graph

35412 commits

Author SHA1 Message Date
Mark Andrews
dc2ea03ea2
Use sub shell to isolate enviroment changes
'HOME=value command' should only change HOME for command but on
some platforms this occasionally sets HOME for the rest of the
test. Explicitly isolate the enviroment change using a sub shell.

(cherry picked from commit 96f75bba18)
2023-08-02 10:47:36 +02:00
Ondřej Surý
2086be9bca Merge branch 'stepan/fix-check-in-ecdsa-system-test-9.16' into 'bind-9.16'
[9.16] Fix ecdsa256 check in ecdsa system test setup

See merge request isc-projects/bind9!8151
2023-07-28 08:09:19 +00:00
Štěpán Balážik
fa8d48ee86
Fix ecdsa256 check in ecdsa system test setup
Probably by copy-paste mistake, ecdsa384 was checked twice.

(cherry picked from commit 10194baa07)
2023-07-28 09:15:17 +02:00
Tom Krizek
8fa55680f6 Merge branch '4055-improve-the-overmem-cache-cleaning-test-9.16' into 'bind-9.16'
[9.16][CVE-2023-2828] Add test for dns_rbtdb overmem purging

See merge request isc-projects/bind9!8145
2023-07-26 14:32:05 +00:00
Ondřej Surý
c7d64009c2
Add test for dns_rbtdb overmem purging
Add a unit test to check if the overmem purging in the RBTDB is
effective when mixed size RR data is inserted into the database.

Co-authored-by: Ondřej Surý <ondrej@isc.org>
Co-authored-by: Jinmei Tatuya <jtatuya@infoblox.com>

(manually picked from 269c03831f)
2023-07-26 15:20:53 +02:00
Tom Krizek
b8f06e61ea Merge branch 'tkrizek/disable-resolve-in-tsan-9.16' into 'bind-9.16'
[9.16] Disable resolve checks under TSAN

See merge request isc-projects/bind9!8140
2023-07-26 08:42:12 +00:00
Tom Krizek
9abdcb23a2
Disable resolve checks under TSAN
The resolve binary is affected by GL#4119 which occassionally makes it
hand during system tests when running with TSAN. This is a workaround to
avoid wasting resources caused by a CI timeout for the system test tsan
jobs.

(cherry picked from commit 774b9bc629)
2023-07-26 10:08:29 +02:00
Tom Krizek
d5ac6efbc4 Merge branch '4089-stale-query-loop-test-9.16' into 'bind-9.16'
[9.16] Reproducer for CVE-2023-2911

See merge request isc-projects/bind9!8136
2023-07-25 09:05:28 +00:00
Tom Krizek
3c30f4a408
Reproducer for CVE-2023-2911
The conditions that trigger the crash:
- a stale record is in cache
- stale-answer-client-timeout is 0
- multiple clients query for the stale record, enough of them to exceed
  the recursive-clients quota
- the response from the authoritative is sufficiently delayed so that
  recursive-clients quota is exceeded first

The reproducer attempts to simulate this situation. However, it hasn't
proven to be 100 % reproducible, especially in CI. When reproducing
locally, the priming query also seems to sometimes interfere and prevent
the crash. When the reproducer is ran twice, it appears to be more
reliable in reproducing the issue.

(cherry picked from commit f617512d37)
2023-07-25 10:35:09 +02:00
Michał Kępień
35b20d6aa5 Merge branch '4215-revert-9.16' into 'bind-9.16'
Revert GL !8123

See merge request isc-projects/bind9!8129
2023-07-24 09:12:01 +00:00
Michał Kępień
d3b0df51cf
Revert GL !8123
This reverts commit 302d0d36f7
(7e9e96ba01 and
bd912b7bed), reversing changes made to
fc6992b3fb.
2023-07-24 11:02:37 +02:00
Mark Andrews
302d0d36f7 Merge branch '4215-add-isc_r_timedout-to-the-reasons-to-call-dns_zonemgr_unreachableadd-in-xfrin-bind-9.16' into 'bind-9.16'
[9.16] Resolve "Add ISC_R_TIMEDOUT to the reasons to call dns_zonemgr_unreachableadd in xfrin"

See merge request isc-projects/bind9!8123
2023-07-21 23:43:54 +00:00
Mark Andrews
bd912b7bed Add CHANGES note for [GL #4215] 2023-07-22 09:07:15 +10:00
Mark Andrews
7e9e96ba01 Mark a primary as unreachable on timed out in xfin
When a primary server is not responding, mark it as temporarialy
unreachable.  This will prevent too many zones queuing up on a
unreachable server and allow the refresh process to move onto
the next primary sooner once it has been so marked.
2023-07-22 09:06:42 +10:00
Ondřej Surý
fc6992b3fb Merge branch '4200-dont-process-next-TCP-packet-when-paused-9.16' into 'bind-9.16'
[9.16] Don't process detach and close as priority netmgr events

See merge request isc-projects/bind9!8095
2023-07-20 18:00:09 +00:00
Ondřej Surý
47cafcd8b5
Add CHANGES and release note for [GL #4200]
(cherry picked from commit 7cd1ac2fa7)
2023-07-20 19:22:30 +02:00
Ondřej Surý
36aba0db8f
Don't process detach and close as priority netmgr events
The detach (and possibly close) netmgr events can cause additional
callbacks to be called when under exclusive mode.  The detach can
trigger next queued TCP query to be processed and close will call
configured close callback.

Move the detach and close netmgr events from the priority queue to the
normal queue as the detaching and closing the sockets can wait for the
exclusive mode to be over.

(cherry picked from commit c2c2ec0c96)
2023-07-20 19:21:44 +02:00
Tom Krizek
b09251b2f9 Merge branch 'tkrizek/pytest-conftest-9.16' into 'bind-9.16'
[9.16] Configure pytest to properly locate conftest.py

See merge request isc-projects/bind9!8125
2023-07-20 12:41:37 +00:00
Tom Krizek
90e33052d2
Configure pytest to properly locate conftest.py
In pytest 7.4.0, there were some changes to how the configuration file
for pytest is located. In our case, this resulted in a failure to find
the conftest.py with the needed fixtures which then prevented our python
tests from being executed successfully.

Configure the --confcutdir to ensure it points to the system test
directory, where our conftest.py is located.

Related https://github.com/pytest-dev/pytest/pull/11043
2023-07-20 13:27:03 +02:00
Arаm Sаrgsyаn
4970af5398 Merge branch 'aram/tests-statschannel-fetch.pl-typo-9.16' into 'bind-9.16'
[9.16] Fix a bug in an utility script for the statschannel system test

See merge request isc-projects/bind9!8121
2023-07-19 14:25:38 +00:00
Aram Sargsyan
3a807e554f Fix a bug in an utility script for the statschannel system test
Because of a typo, the fetch.pl script tries to extract the server
address from the input parameter 'a' instead of 's'. Fix the typo.

(cherry picked from commit aa7538fd38)
2023-07-19 13:27:54 +00:00
Mark Andrews
7fc0400617 Merge branch '4203-run-gdb-not-found-bind-9.16' into 'bind-9.16'
[9.16] Resolve "run.gdb not found"

See merge request isc-projects/bind9!8113
2023-07-19 06:11:55 +00:00
Mark Andrews
ce17cdf9cb Use absolute path to locate run.gdb
(cherry picked from commit 3f7723cdff)
2023-07-19 12:53:43 +10:00
Tom Krizek
1773a68e6b Merge branch 'tkrizek/readthedocs-config-9.16' into 'bind-9.16'
[9.16] Add configuration for readthedocs.org

See merge request isc-projects/bind9!8110
2023-07-18 15:00:03 +00:00
Tom Krizek
987129a3c4
Synchronize Sphinx package version on ReadTheDocs with our CI
Related: isc-projects/images!228
2023-07-18 16:17:50 +02:00
Tom Krizek
521a5d00d8
Add configuration for readthedocs.org
readthedocs.org is switching to in-repo configuration file in favor of
the deprecated web interface as it allows more flexibility.

This also fixes our recent doc build issues, as we're switching to a
newer Python which is required by Sphinx.

See https://blog.readthedocs.com/migrate-configuration-v2/

(cherry picked from commit a1a0ccda6e)
2023-07-18 15:33:56 +02:00
Matthijs Mekking
ead36d331e Merge branch '2471-test-three-is-a-crowd-v9_16' into 'bind-9.16'
[9.16] Add "three is a crowd" test case

See merge request isc-projects/bind9!8087
2023-07-06 09:46:28 +00:00
Matthijs Mekking
80a20c9643 Add test for "three is a crowd" bug (GL #2375)
Add this test scenario for a bug fixed a while ago. When a third key is
introduced while the previous rollover hasn't finished yet, the keymgr
could decide to remove the first two keys, because it was not checking
for an indirect dependency on the keys.

In other words, the previous bug behavior was that the first two keys
were removed from the zone too soon.

This test case checks that all three keys stay in the zone, and no keys
are removed premature after another new key has been introduced.

(cherry picked from commit 9c40cf0566)
2023-07-06 10:30:53 +02:00
Matthijs Mekking
83dd0c85a2 Check all keys despite early failure
In the kasp script, if one expected key is not found, continue checking
the other key ids, even if there is no match for the first one.  This
provides a bit more information which keys mismatch and makes for
easier debugging test failures.

(cherry picked from commit 674249f66a)
2023-07-06 10:28:41 +02:00
Michał Kępień
681260b6cd Merge branch '4169-add-google-site-verification-tag-to-the-toc-page-9.16' into 'bind-9.16'
[9.16] Add Google Site Verification tag to the TOC page

See merge request isc-projects/bind9!8078
2023-06-29 16:50:53 +00:00
Michał Kępień
b9ec370c26
Add Google Site Verification tag to the TOC page
This should allow tracking HTTP 404 errors for Read the Docs using the
Google Search Console.

(cherry picked from commit 13c35ab0b3)
2023-06-29 18:49:54 +02:00
Tom Krizek
3655c98c18 Merge branch 'tkrizek-disable-delv-in-tsan-9.16' into 'bind-9.16'
[9.16] Disable delv tests under TSAN

See merge request isc-projects/bind9!8072
2023-06-29 13:42:33 +00:00
Tom Krizek
4efef8cb54
Check for unset variables only after conf.sh is loaded
Make the cds/setup.sh compatible with the workaround which relies on
testing the TSAN_OPTIONS variable which may not be set.

(cherry picked from commit 76d9873ef6)
2023-06-29 14:40:09 +02:00
Tom Krizek
2020ce2010
Fix checking for executables in shell conditions in tests
Surround the variables which are checked whether they're executable in
double quotes. Without them, empty paths won't be properly interpreted
as not executable.

(manually picked from commit 06056c44a7)
2023-06-29 13:19:47 +02:00
Tom Krizek
bd9dabc0c3
Only use delv if available in mkeys test
Check that $DELV is an executable before using it in a test.

(cherry picked from commit 384339dbba)
2023-06-29 13:16:50 +02:00
Tom Krizek
a904cd9a0e
Disable delv tests under TSAN
Since delv can occasionally hang in system tests when running with TSAN
(see GL#4119), disable these tests as a workaround. Otherwise, the hung
delv process will just waste CI resources and prevent any meaningful
output from the rest of the test suite.

(cherry picked from commit fbcf37f914)
2023-06-29 13:16:46 +02:00
Tom Krizek
5fcf0099fa Merge branch 'tkrizek-system-test-fixes-9.16' into 'bind-9.16'
[9.16] Fix a couple of oversights in system tests

See merge request isc-projects/bind9!8057
2023-06-26 13:44:25 +00:00
Tom Krizek
0374c27fc5
Check for proper file size output in dnstap test
Previously, the first check silently failed, as 450 is apparently (in
the CI) the minimum output size for the dnstap output, rather than
470 which the test was expecting. Effectively, the check served as a 5
second sleep rather than waiting for the proper file size.

Additionally, check the expected file sizes and fail if expectations
aren't met.

(manually picked from commit 5f809e50b6)

On main, the minimum file size seems to 454 bytes, while on some
platforms in our CI setup for the 9.16 branch, it appears to be 450
instead.
2023-06-26 14:33:43 +02:00
Tom Krizek
9cfc8da487
Check for proper log message in kasp test
The log message is supposed to contain the zone name which was
erroneously omitted, but didn't pop up during tests, since return code
was silently ignored.

Now it actually waits for the proper log message rather than being an
equivalent of 3 second sleep (which was also sufficient to make the test
pass, thus we detected no failure).

(cherry picked from commit 1dd4c2b9e2)
2023-06-26 13:08:09 +02:00
Michal Nowak
678bfc4ce0 BIND 9.16.42
-----BEGIN SSH SIGNATURE-----
 U1NIU0lHAAAAAQAAARcAAAAHc3NoLXJzYQAAAAMBAAEAAAEBANamVSTMToLcHCXRu1f52e
 tTJWV3T1GSVrPYXwAGe6EVC7m9CTl06FZ9ZG/ymn1S1++dk4ByVZXf6dODe2Mu0RuqGmyf
 MUEMKXVdj3cEQhgRaMjBXvIZoYAsQlbHO2BEttomq8PhrpLRizDBq4Bv2aThM0XN2QqSGS
 ozwYMcPiGUoMVNcVrC4ZQ+Cptb5C4liqAcpRqrSo8l1vcNg5b1Hk6r7NFPdx542gsGMLae
 wZrnKn3LWz3ZXTGeK2cRmBxm/bydiVSCsc9XjB+tWtIGUpQsfaXqZ7Hs6t+1f1vsnu88oJ
 oi1dRBo3YNRl49UiCukXWayQrPJa8wwxURS9W28JMAAAADZ2l0AAAAAAAAAAZzaGE1MTIA
 AAEUAAAADHJzYS1zaGEyLTUxMgAAAQB4cJVMp4Qu7+A796slVZ/gNJ/LXPUjYEflnDJpcw
 1R2gYboqeemsHHLjKoeGEjO61xEb1EfoeqBFZR/WCLtMnmibGlDoq+2dvfx3SUZrEOLwHS
 035ho5Ln5UfxZ4H0NVyNUr1oZvjlrroYHM4aO526Yi055yp2Bu5qZhF/4sYw2E2+ImPNVX
 eN7MHIUiovRy4ipEkWQ2u9soUJqOoBkijj4FqKdDPF0ox58OQ/4BF9wIp1G+byfEQ2vU92
 8KzL20AblFEhY5tB+cFvv+MgWnI7g7Vg5k2ofWS9E9WvDUZvBQkQ0BFp5f+2Z1FD0XK1RP
 QNkwtMVZTyhLkpGuESYLn0
 -----END SSH SIGNATURE-----
gpgsig -----BEGIN SSH SIGNATURE-----
 U1NIU0lHAAAAAQAAARcAAAAHc3NoLXJzYQAAAAMBAAEAAAEBANamVSTMToLcHCXRu1f52e
 tTJWV3T1GSVrPYXwAGe6EVC7m9CTl06FZ9ZG/ymn1S1++dk4ByVZXf6dODe2Mu0RuqGmyf
 MUEMKXVdj3cEQhgRaMjBXvIZoYAsQlbHO2BEttomq8PhrpLRizDBq4Bv2aThM0XN2QqSGS
 ozwYMcPiGUoMVNcVrC4ZQ+Cptb5C4liqAcpRqrSo8l1vcNg5b1Hk6r7NFPdx542gsGMLae
 wZrnKn3LWz3ZXTGeK2cRmBxm/bydiVSCsc9XjB+tWtIGUpQsfaXqZ7Hs6t+1f1vsnu88oJ
 oi1dRBo3YNRl49UiCukXWayQrPJa8wwxURS9W28JMAAAADZ2l0AAAAAAAAAAZzaGE1MTIA
 AAEUAAAADHJzYS1zaGEyLTUxMgAAAQCOsvfcSyIhtip+J4bWxElY7WxKi5WEID+7hQjFEg
 IYMm+34H+io8Hsgybw3oGxo6gfIKHL/Y1mPBAFpQl2B7IGtNNe2yeSCnsq4Vn56UXvkJwD
 NIkXaoBOFpYTipUaH8MIZRzrAI71nqMtFnbBxAz5loZBPPz7bk5Ex4TFSwDnrlHy72CFd2
 5KhDvkSzkyLtCbUphdNHn1HLiCQDEJwyeSnrofp8n+gopTi+2byNBW0QtJaGTLtfzYngZw
 xaX9jCfIfdZTuSdmHwite2p9IYPLuqus4y59yhx5QJm8ZAohJqg203Wil9kwS1wwGADQNK
 vTj+mqRV+lAnRoSNI7evfK
 -----END SSH SIGNATURE-----

Merge tag 'v9.16.42' into bind-9.16

BIND 9.16.42
2023-06-21 20:24:59 +02:00
Michał Kępień
3e1776ed02 Merge branch '2354-add-a-tool-for-reproducing-isc-spnego-bugs-9.16' into 'bind-9.16'
[9.16] [CVE-2020-8625] [CVE-2021-25216] Add a tool for reproducing ISC SPNEGO bugs

See merge request isc-projects/bind9!8043
2023-06-19 09:09:08 +00:00
Michał Kępień
731a736a91
Add a tool for reproducing ISC SPNEGO bugs
Extend the "tsiggss" system test with reproducers for CVE-2020-8625 and
CVE-2021-25216.

(cherry picked from commit a47dc810f7)
2023-06-19 10:36:25 +02:00
Michał Kępień
746833318b Merge branch '4150-fix-entity-renumbering-in-parse_tsan.py-9.16' into 'bind-9.16'
[9.16] Fix entity renumbering in util/parse_tsan.py

See merge request isc-projects/bind9!8040
2023-06-15 14:23:04 +00:00
Michał Kępień
b4f7034074
Fix entity renumbering in util/parse_tsan.py
util/parse_tsan.py builds tables of mutexes, threads, and pointers it
finds in the TSAN report provided to it as a command-line argument and
then replaces all mentions of each of these entities so that they are
numbered sequentially in the processed report.  For example, this line:

    Cycle in lock order graph: M0 (...) => M5 (...) => M9 (...) => M0

is expected to become:

    Cycle in lock order graph: M1 (...) => M2 (...) => M3 (...) => M1

Problems arise when the gaps between mutex/thread identifiers present on
a single line are smaller than the total number of mutexes/threads found
by the script so far.  For example, the following line:

    Cycle in lock order graph: M0 (...) => M1 (...) => M2 (...) => M0

first gets turned into:

    Cycle in lock order graph: M1 (...) => M1 (...) => M2 (...) => M1

and then into:

    Cycle in lock order graph: M2 (...) => M2 (...) => M2 (...) => M2

In other words, lines like this become garbled due to information loss.

The problem stems from the fact that the numbering scheme the script
uses for identifying mutexes and threads is exactly the same as the one
used by TSAN itself.  Update util/parse_tsan.py so that it uses
zero-padded numbers instead, making the "overlapping" demonstrated above
impossible.

(cherry picked from commit 7f0790c82f)
2023-06-15 16:20:11 +02:00
Tom Krizek
e96a82ac72 Merge branch 'tkrizek/respdiff-threshold-9.16' into 'bind-9.16'
Adjust the respdiff failure threshold for a new dataset

See merge request isc-projects/bind9!8032
2023-06-15 08:19:13 +00:00
Tom Krizek
999850821e
Adjust the respdiff failure threshold for a new dataset
This is just a slight tweak for the respdiff CI test. The new dataset
has a different set of queries and it results in a slightly more
SERVFAILs rather than timeouts in the respdiff-long-third-party test.

In our comparison script, timeouts are not counted towards the
threshold. While the total number of differences remains roughly the
same, the different distributions of them (among SERVFAIL vs timeout)
warrants a slight bump in the threshold in order to avoid test failures.

Related isc-private/bind-qa!65
2023-06-14 11:02:39 +02:00
Tom Krizek
72394b2e38 Merge branch '4117-serve-stale-check-9.16' into 'bind-9.16'
[9.16] Avoid false positive in serve-stale system test check

See merge request isc-projects/bind9!8028
2023-06-13 12:54:30 +00:00
Tom Krizek
328d0a1d0a
Avoid false positive in serve-stale system test check
The purpose of the check is to verify the server has survived the
previous barrage of queries. This is done by sending a query and
checking we get a NOERROR response back.

Previously, that query could've been affected by a servfail cache - the
server would return a SERVFAIL answer, thus failing the check, despite
being up and running. Use version.bind txt ch query to avoid the
interference of servfail cache.

(cherry picked from commit dd7bcd2855)
2023-06-13 14:16:44 +02:00
Michal Nowak
a6b90215a8 Merge branch 'mnowak/set-up-version-and-release-notes-for-bind-9.16.43' into 'bind-9.16'
Set up version and release notes for BIND 9.16.43

See merge request isc-projects/bind9!8023
2023-06-12 15:17:44 +00:00
Michal Nowak
fdea64f057
Set up release notes for BIND 9.16.43 2023-06-12 17:06:23 +02:00