In the past, "dnssec-validation" was not looked up in the global
defaults unless "dnssec-enable" was true. "dnssec-enable" has been
obsolete for several years, but dnssec-validation was still being
configured in two steps. This commit removes the vestigial bits of
the old logic.
"max-cache-size default;" is allowed, according to the documentation
and the parser, but when it's configured, named crashes due to an
INSIST that the only legal string value is "unlimited". this has
been fied.
the configuration has also been simplified. previously, we checked for
max-cache-size in view and options, then determined whether to look in
the global default options based on whether the view had recursion set.
the default value set there was only applicable to views with recursion.
now, the default is an explicit "default", which affects views with
and without recursion in different ways.
the cfg type for "max-cache-size" has been changed from
cfg_type_sizeorpercent to cfg_type_maxcachesize.
Reimplement the custom server using the asyncserver Python module.
Behavior change: The new server doesn't copy CD and DO flags and a client cookie to responses.
Merge branch 'stepan/statistics-asyncserver' into 'main'
See merge request isc-projects/bind9!10928
Reimplement the custom server using the asyncserver Python module.
Behavior change: The new server doesn't copy CD and DO flags and a
client cookie to responses.
Add a new ResponseHandler subclass, QnameHandler, which enables
conveniently matching specific QNAMEs (without also matching their
subdomains like DomainHandler does).
This is mostly for cases where no zone is set up and all response stubs
come to response handler with REFUSED as RCODE.
This commit allows to override the RCODE before QueryContext is passed
to response handlers.
Replace the custom DNS servers in the "cookie" system test with new code
based on the isctest.asyncserver module. The convoluted test logic is
split into multiple response handlers which are shared between the two
servers.
Behavior change: returned SOA records have the zone name set properly.
Merge branch 'stepan/cookie-asyncserver' into 'main'
See merge request isc-projects/bind9!10691
Replace the custom DNS servers in the "cookie" system test with new code
based on the isctest.asyncserver module. The convoluted test logic is
split into multiple response handlers which are shared between the two
servers.
Behavior change: returned SOA records have the zone name set properly.
Replace the custom server with new implementation using the
AsyncDnsServer class.
Behavior changes:
- DNS cookie is not copied to the responses.
- CD, DO flags aren't set on responses.
Merge branch 'stepan/rpzrecurse-asyncserver' into 'main'
See merge request isc-projects/bind9!10916
Replace the custom server with new implementation using the
AsyncDnsServer class.
Behavior changes:
- DNS cookie is not copied to the responses.
- CD, DO flags aren't set on responses.
Reimplement the custom server using isctest.asyncserver. Factor most of
the logic out of the server code to two (identical) zones and only
implement the non-standard behavior.
Behavior changes:
- RRSIG Expiration and Inception is now static and covering the whole
timeline instead of being calculated everytime.
- NXDOMAIN is returned where suitable by standard.
- Returned SOA records have properly set zone names.
Merge branch 'stepan/dnssec-asyncserver' into 'main'
See merge request isc-projects/bind9!10906
Reimplement the custom server using isctest.asyncserver. Factor most of
the logic out of the server code to two (identical) zones and only
implement the non-standard behavior.
Behavior changes:
- RRSIG Expiration and Inception is now static and covering the whole
timeline instead of being calculated everytime.
- NXDOMAIN is returned where suitable by standard.
- Returned SOA records have properly set zone names.
Previously, `named` could trigger an assertion in `dns_dispatchmgr_getblackhole`
while shutting down. This has been fixed.
Closes#5525
Merge branch '5525-attach-to-dispatchmgr-to-fctx' into 'main'
See merge request isc-projects/bind9!11131
While shutting down view->dispatchmgr is no longer valid. Attach
to it and when creates a fetch context and use that pointer instead
of view->dispatchmgr. Use dns_view_getdispatchmgr to do the attaching
as view->dispatchmgr is it managed using rcu.
Introduce `cfg_obj_clone` which takes a `cfg_obj_t` node and clones it.
it allocates a new node, copies its scalar values and recursively
allocates child nodes, copying their scalar values as well and so on.
Internally, a new method `cfg_copyfunc_t` copy is added in `cfg_rep_t`,
which enables implementing a copy function specific for each
representation type a node can hold.
This is pre-require work for MR !11121!11122!11123
Merge branch 'colin/effective-config-clone' into 'main'
See merge request isc-projects/bind9!11124
Add a unit test for `cfg_obj_clone` to verify that the cloned tree
indeed has independent child nodes. The test also verifies that the
clone is semantically correct by comparing a text dump of the original
tree and the cloned one.
Introduce `cfg_obj_clone` which takes a `cfg_obj_t` node and clones it.
it allocates a new node, copies its scalar values and recursively
allocates child nodes, copying their scalar values as well and so on.
Internally, a new method `cfg_copyfunc_t` copy is added in `cfg_rep_t`,
which enables implementing a copy function specific for each
representation type a node can hold.
In cfg_parse_buffer and cfg_parse_file 'pctx' was being checked
for being non-NULL when it was guaranteed to be non-NULL. This
raised Coverity issues ID 637688 and ID 637689.
Closes#5599
Merge branch '5599-remove-unnecessary-null-checks' into 'main'
See merge request isc-projects/bind9!11154
In cfg_parse_buffer and cfg_parse_file 'pctx' was being checked
for being non-NULL when it was guarenteed to be non-NULL. This
raised Coverity issues ID 637688 and ID 637689.
Use @DYLIB@ instead of hard coded extension "so".
Closes#5600
Merge branch '5600-fix-hooks-conf-good-viewzonelevel-conf-j2' into 'main'
See merge request isc-projects/bind9!11156
Tarball uploading steps are to be included in the pipeline.
They are manual jobs that:
1. uploads a release tarball prepared by the "sign" job.
2. publish a previously staged release to a destination.
3. publishes a previously staged release to a well-known URL.
A template has been included since all three follow the same pattern.
Besides, rules commonly used by tag pipeline jobs.
Merge branch 'andoni/ci-release-process' into 'main'
See merge request isc-projects/bind9!11158
Define and use more YAML anchors for triggering rules commonly used by
tag pipeline jobs. This builds on top of the work done in commit
675d9c7425, improving readability and
reuse.
Add a new SSH-confirmed GitLab CI job that publishes a previously staged
release to a well-known URL. The details of what specifically this
entails are controlled by the staging environment.
Add a new SSH-confirmed GitLab CI job that publishes a previously staged
release to a destination that is not a well-known URL. The details of
what specifically this entails are controlled by the staging
environment.
Add a YAML template for jobs that require an SSH connection to a
dedicated, locked-down runner for signing off on sensitive operations
(e.g. signing, publishing).
These jobs all follow a similar scheme:
1. Runner prepares the necessary files in a well-known location (/tmp).
2. Runner generates a shell script to be run by an authorized user.
3. Runner sleeps while waiting for a signal that the script was run.
4. Authorized user logs in to the runner over SSH and runs the script.
5. Runner collects the relevant files and logs as job artifacts.
One additional complication is that each of the above steps needs to be
carried out under the assumption that GitLab Runner is running under a
different user account than the one used for logging in over SSH,
necessitating careful file permission handling.
Having a YAML template for jobs that need to follow the above scheme
significantly improves readability and reuse as each job only needs to
define (via the "variables" YAML key):
- SSH_SCRIPT_RUNNER_PRE: the code the runner should execute before an
authorized user logs in over SSH (typically: setting up files in a
well-known location),
- SSH_SCRIPT_CLIENT: contents of the shell script to be run by an
authorized user,
- SSH_SCRIPT_RUNNER_POST: the code the runner should execute after an
authorized user runs the script over SSH (typically: artifact
collection and cleanup).
Include the Git tag in the name of the release directory rather than
just the version number. Revise the script for the "release" job
accordingly. This enables using the $CI_COMMIT_TAG variable in job
scripts without the need to resort to string manipulation to strip the
leading "v", improving readability. The only place where string
manipulation is applied to the Git tag is now the "release" job itself,
to verify that the Git tag matches the version number embedded in the
source tarball name.
The variables example2com, example3com, and example4com where not
being initalised on all paths leading to Coverity issues ID 637690,
ID 637691 and ID 637692 being raised. In addition the tests to free
them were wrong as they depended on the unintialised variables. This
has been fixed.
Closes#5598
Merge branch '5598-properly-determine-if-name-is-dynamic' into 'main'
See merge request isc-projects/bind9!11155
The variables example2com, example3com, and example4com where not
being initalised on all paths leading to Coverity issues ID 637690,
ID 637691 and ID 637692 being raised. In addition the tests to free
them were wrong as they depended on the unintialised variables. This
has been fixed.
Passing the JSON_C_TO_STRING_PRETTY flag to
json_object_to_json_string_ext() makes the latter produce prettified
JSON output. This results in a huge amount of redundant whitespace
being inserted into each HTTP response (whitespace amounts to about 40%
of the entire JSON payload).
The bandwidth cost can be amortized by enabling HTTP compression on the
client side ("Accept-Encoding: deflate"), but that does not affect the
size of data at rest.
Use the JSON_C_TO_STRING_PLAIN flag instead of JSON_C_TO_STRING_PRETTY
to minimize the size of JSON responses sent via the statistics channel.
External tools should be used for prettifying JSON data.
Closes#3304
Merge branch '3304-stop-prettifying-json-statistics' into 'main'
See merge request isc-projects/bind9!10786
Passing the JSON_C_TO_STRING_PRETTY flag to
json_object_to_json_string_ext() makes the latter produce prettified
JSON output. This results in a huge amount of redundant whitespace
being inserted into each HTTP response (whitespace amounts to about 40%
of the entire JSON payload).
The bandwidth cost can be amortized by enabling HTTP compression on the
client side ("Accept-Encoding: deflate"), but that does not affect the
size of data at rest.
Use the JSON_C_TO_STRING_PLAIN flag instead of JSON_C_TO_STRING_PRETTY
to minimize the size of JSON responses sent via the statistics channel.
External tools should be used for prettifying JSON data.
Processing JSON and XML using `grep` and `sed` is error-prone, overly
lax in some ways, overly strict in others, and neither accurate nor
expressive. Use `jq` and `xmllint` with XPath expressions to make
things right in system tests.
See #3304
Merge branch '3304-properly-process-json-and-xml-in-tests' into 'main'
See merge request isc-projects/bind9!10942
The traffic-json.pl and traffic-xml.pl scripts that were used in the
"statschannel" system test in the past became dead code when commit
1202fd912a rewrote parts of that test to
Python. Remove those scripts.
There are no longer any HTML files in the BIND 9 source repository.
Remove the xmllint-html.sh script that was used in the past to check
those for errors.
Inspecting XML data using sed and grep is error-prone, overly lax in
some ways, overly strict in others, and neither accurate nor expressive.
Use xmllint and XPath expressions for inspecting XML data in the
"statistics", "statschannel", and "synthfromdnssec" system tests to
address these deficiencies.
Detect whether and where the xmllint utility is available at build time,
so that it can be used in system tests. If the tool is not found,
specific checks employing it will be skipped.
Inspecting JSON data using grep is error-prone, overly lax in some ways,
overly strict in others, and neither accurate nor expressive. Use jq
for inspecting JSON data in the "statschannel" and "synthfromdnssec"
system tests to address these deficiencies.
Detect whether and where the jq utility is available at build time, so
that it can be used in system tests. If the tool is not found, specific
checks employing it will be skipped.
When the arc4random_uniform() is called on NetBSD with upper_bound that
makes no sense statistically (0 or 1), the call crashes the calling
program. Fix this by returning 0 when upper bound is < 2 as does Linux,
FreeBSD and NetBSD. (Hint: System CSPRNG should never crash.)
Closes#5596
Merge branch '5596-fix-isc_random_uniform-on-NetBSD' into 'main'
See merge request isc-projects/bind9!11147
When the arc4random_uniform() is called on NetBSD with upper_bound that
makes no sense statistically (0 or 1), the call crashes the calling
program. Fix this by returning 0 when upper bound is < 2 as does Linux,
FreeBSD and NetBSD. (Hint: System CSPRNG should never crash.)
Since we are using system routines for randomness, there's no point
in spending time and run the statistical suite for testing PRNG.
Merge branch 'ondrej/drop-random-unit-test' into 'main'
See merge request isc-projects/bind9!11137
The minimal required meson version is 1.3.0.
Where distribution repositories don't provide meson 1.3.0 or newer, meson from PyPI may be used instead.
Merge branch 'aydin/meson-bump-version' into 'main'
See merge request isc-projects/bind9!10997
After a couple releases, it appears that the minimum version can be
increased without much trouble.
Because meson only requires python 3.7 or greater, most supported
distributions can run a newer meson without having to deal with
additional dependencies or a new python version.
Previously fuzzing builds were broken due to some typos in the `meson.build`.
Merge branch 'aydin/fuzz-meson-fix' into 'main'
See merge request isc-projects/bind9!11052
