2
0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 05:28:00 +00:00

39719 Commits

Author SHA1 Message Date
Evan Hunt
cfad194e1d Merge branch 'each-qp-nta' into 'main'
Use a QP trie for the NTA table, forwarders and key tables

See merge request isc-projects/bind9!7811
2023-08-15 17:16:21 +00:00
Ondřej Surý
bf1223bf13 Add CHANGES note for [GL !7811] 2023-08-15 17:34:20 +02:00
Evan Hunt
b466439437
use a qp-trie for the keytable
Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-08-15 14:25:24 +02:00
Evan Hunt
dea79e7053
use a qp-trie for the forwarders table
Instead of an RBT for the forwarders table, use a QP trie.

We now use reference counting for dns_forwarders_t. When a forwarders
object is retrieved by dns_fwdtable_find(), it must now be explicitly
detached by the caller afterward.

QP tries require stored objects to include their names, so the
the forwarders object now has that. This obviates the need to
pass back a separate 'foundname' value from dns_fwdtable_find().
2023-08-15 14:25:24 +02:00
Evan Hunt
5768dd96ea
clean up some unused functions
dns_fwdtable_delete() was only used by dns_client_clearservers(),
which in turn was never used. both functions have now been deleted.
2023-08-15 14:24:46 +02:00
Evan Hunt
aff01bda54
use a qp-trie for the NTA table
replace the red-black tree used by the negative trust anchor table
with a QP trie.

because of this change, dns_ntatable_init() can no longer fail, and
neither can dns_view_initntatable(). these functions have both been
changed to type void.
2023-08-15 14:24:46 +02:00
Evan Hunt
06216f4f90
rename dns_qp_findname_parent() to _findname_ancestor()
this function finds the closest matching ancestor, but the function
name could be read to imply that it returns the direct parent node;
this commit suggests a slightly less misleading name.
2023-08-15 14:24:46 +02:00
Tony Finch
b38c71961d
Improve qp-trie leaf return values
Make the `pval_r` and `ival_r` out arguments optional.

Add `pval_r` and `ival_r` out arguments to `dns_qp_deletekey()`
and `dns_qp_deletename()`, to return the deleted leaf.
2023-08-15 14:24:39 +02:00
Ondřej Surý
8a2763487d Merge branch 'fanf/add-SET_IF_NOT_NULL-macro' into 'main'
A SET_IF_NOT_NULL() macro for optional return values

See merge request isc-projects/bind9!8201
2023-08-15 11:23:27 +00:00
Tony Finch
c622b349e4
Apply the SET_IF_NOT_NULL() semantic patch
spatch --sp-file cocci/set_if_not_null.spatch --use-gitgrep --dir "." --include-headers --in-place
2023-08-15 12:21:41 +02:00
Tony Finch
0d6dcd217d
A SET_IF_NOT_NULL() macro for optional return values
The SET_IF_NOT_NULL() macro avoids a fair amount of tedious boilerplate,
checking pointer parameters to see if they're non-NULL and updating
them if they are.  The macro was already in the dns_zone unit, and this
commit moves it to the <isc/util.h> header.

I have included a Coccinelle semantic patch to use SET_IF_NOT_NULL()
where appropriate. The patch needs an #include in `openssl_shim.c`
in order to work.
2023-08-15 12:04:29 +02:00
Mark Andrews
5a36bebfce Merge branch '4259-statschannel-leftovers' into 'main'
Resolve "Statschannel leftovers"

Closes #4259

See merge request isc-projects/bind9!8199
2023-08-15 04:21:33 +00:00
Mark Andrews
7da47fd858 Remove bind9.xsl.1, bind9.xsl.2 and bind9.xsl.3 2023-08-15 10:34:19 +10:00
Mark Andrews
cc491f539b Merge branch '4238-the-mkeys-system-test-can-update-the-root-zone-too-fast' into 'main'
Resolve "The mkeys system test can update the root zone too fast"

Closes #4238

See merge request isc-projects/bind9!8161
2023-08-14 23:23:33 +00:00
Mark Andrews
40e3529379 Add sleeps so that the modification time changes
The mkeys system test could fail because root zone was resigned
within the same second as it was previously signed causing reloads
to fail.  Add delays to the test to prevent this.
2023-08-14 22:49:16 +00:00
Ondřej Surý
dadc214b0f Merge branch '4124-check-statschannel-if-modified-since' into 'main'
Fix a stack buffer overflow in the statistics channel

Closes #4124

See merge request isc-projects/bind9!8195
2023-08-14 10:59:02 +00:00
Ondřej Surý
57c8bdaff5
Add CHANGES and release notes for [GL #4124] 2023-08-14 11:30:45 +02:00
Tony Finch
b22c87ca61
Fix a stack buffer overflow in the statistics channel
A long timestamp in an If-Modified-Since header could overflow a
fixed-size buffer.
2023-08-14 11:30:24 +02:00
Mark Andrews
bafb3f97c2 Merge branch 'marka-fix-formatting-errors' into 'main'
Follow-up: Fixes to provider/engine based ECDSA key handling

See merge request isc-projects/bind9!8186
2023-08-09 23:49:25 +00:00
Matthijs Mekking
fa108db279 Revert a337dbef
Revert commit that always uses OpenSSL 3.0 API when available,
the new APIs should work always, but OpenSSL has non-obvious
omissions in the automatic mappings it provides.
2023-08-09 23:48:17 +00:00
Mark Andrews
00a09e0d35 Only set key->engine if engine != NULL 2023-08-09 23:48:17 +00:00
Mark Andrews
d527ae11c9 Fix clang formatting 2023-08-09 23:48:17 +00:00
Mark Andrews
3907de98ca Fix line wrap 2023-08-09 23:48:17 +00:00
Mark Andrews
0aeffb55c9 Merge branch '4245-incorrect-return-values-in-rpz-s-addr-and-drop-function' into 'main'
Resolve "Incorrect return values in rpz's addr and drop functions"

Closes #4245

See merge request isc-projects/bind9!8172
2023-08-09 23:33:25 +00:00
Mark Andrews
1394f12a1c Fix 'addr', 'ckresult' and 'drop' functions
'addr', 'ckresult' and 'drop' should return 0 rather than 1 after
calling 'setret' as the error has been logged and these functions
are not expect to fail.
2023-08-09 10:45:38 +10:00
Michal Nowak
a5cf49c378 Merge branch 'mnowak/cross-version-test' into 'main'
Cross-version testing with named configurations

See merge request isc-projects/bind9!7863
2023-08-08 17:37:19 +00:00
Michal Nowak
4eac32fe23
Exclude dupsigs and keymgr2kasp from cross-version-config-tests
pytest should not schedule dupsigs and keymgr2kasp system tests removed
in BIND 9 mainline but still present in BIND 9 baseline version
(v9.19.15). (Can be dropped once the v9.19.16 tag is present.)
2023-08-08 19:18:36 +02:00
Michal Nowak
cc54211baa
Cross-version testing with named configurations
In #3381 (and #3385), we committed a backward-incompatible change to
BIND 9.19.5, 9.18.7, and 9.16.33, explicitly requiring "inline-signing"
for every "dnssec-policy".

We did this backward-incompatible change deliberately, knowing the
consequences for users and their configurations. But if we didn't, say,
we were unaware this is a backward-incompatible change and fixed failing
systems test by "tweaking a knob to make the CI pass", we would not have
a second look before the change hits user configurations.

"cross-version-config-tests" CI job is such a second look. It will run
system tests from the latest release tag specific to the particular
branch (e.g., v9.19.12 for the "main" branch) with BIND 9 binaries from
the current "HEAD" (the future v9.19.13). This Frankenstein build gets
conceived by altering the "TOP_BUILDDIR" variable in
"bin/tests/system/conf.sh".

Caveats:
- Only system test configurations are tested; no actual test code is
  run.
- Problems with namedN.conf configurations are not identified.

When backward-incompatible change is introduced, the CI job is expected
to fail. If the change is deliberate, the job will keep failing until
the version with the backward-incompatible change is tagged, and the
minor version in configure.ac is bumped.
2023-08-08 19:18:36 +02:00
Matthijs Mekking
9f3b5d6841 Merge branch 'tt-provider-engine' into 'main'
Fix keyfromlabel to not use engine parameter for provider keys

See merge request isc-projects/bind9!8153
2023-08-08 14:26:15 +00:00
Timo Teräs
de486d0ec5 Fix keyfromlabel to not use engine parameter for provider keys
- Rework key checks to not require 'engine' tag, private key
  is valid with 'label' tag alone

- Fix _fromlabel() functions to work with engine == NULL

- Update dst__openssl_fromlabel_engine() to do provider lookup
  only when engine is not set
2023-08-08 17:16:14 +03:00
Matthijs Mekking
222f2bd11c Merge branch 'tt-ecdsa-fixes' into 'main'
Fixes to provider/engine based ECDSA key handling

See merge request isc-projects/bind9!8152
2023-08-08 14:13:21 +00:00
Timo Teräs
1b47385f58 Add CHANGES for GL !8152 2023-08-08 14:08:00 +00:00
Timo Teräs
a337dbef22 Always use OpenSSL 3.0 API when available
The new APIs work always as OpenSSL provides glue to access also
old style engines using the new APIs.
2023-08-08 14:08:00 +00:00
Timo Teräs
8de089e514 Fix support for engine/provider ECDSA keys
Exporting private key of on-token keys is not possible. Fix code
to not fail in this case.
2023-08-08 14:08:00 +00:00
Timo Teräs
de45aab184 Fix OpenSSL 3.0 API EC curve names
The OpenSSL man page examples used the NIST curve names which
are supported. But when querying the name, the native OpenSSL
name is returned. Use these names to pass curve type checks for
engine/provider objects.
2023-08-08 14:08:00 +00:00
Michal Nowak
349fa71a0d Merge branch 'mnowak/pytest_rewrite_stress' into 'main'
Rewrite stress test to pytest

See merge request isc-projects/bind9!7905
2023-08-08 12:29:24 +00:00
Michał Kępień
08a8906cfc
Convert setup.pl into static configurations
The setup.pl script has been replaced with static BIND configurations,
and in the course of this change, the unused ns1 server was removed.
This enhancement has greatly improved the overall test's readability.
2023-08-08 10:31:45 +02:00
Michal Nowak
ecd7b30d0a
Rewrite stress test to pytest
The shell version of the test was completed only after all DNS zone
updates were sent, even if the BIND server crashed while processing
them, leading to prolonged execution and potential hang in the CI
environment. The Python rewrite of the test ensures that DNS update
tasks finish within five minutes of starting, irrespective of a BIND
crash possibility or DNS zone updates not finishing in time.
2023-08-08 10:31:45 +02:00
Michał Kępień
448831dde2 Merge branch '4240-dnstap-system-test-fixes' into 'main'
"dnstap" system test fixes

Closes #4240

See merge request isc-projects/bind9!8177
2023-08-07 11:58:54 +00:00
Michał Kępień
67df78e518
Lower the minimum expected dnstap output file size
Lower the size requirement for the dnstap output file produced during
the "dnstap" system test from 454 to 450 bytes; while files of that size
are not generated in any GitLab CI job, they are in other environments
where the test passes.
2023-08-07 11:26:58 +02:00
Michał Kępień
26d3d97f12
Wait until fstrm_capture is ready
The fstrm_capture utility is started in the background during the
"dnstap" system test.  Consequently, "rndc dnstap-reopen" and similar
commands may be executed before fstrm_capture starts listening on the
Unix domain socket it is configured to receive dnstap data on.  This
results in the dnstap data sent to that socket in the meantime to be
lost; while the fstrm writer thread is able to recover from such a
scenario within a couple of seconds (by reopening the configured dnstap
destination itself), only one write attempt is made for data
successfully queued to the writer thread, so dnstap frames can still be
lost in the process.  This may happen during the "dnstap" system test,
leading to the dnstap output file being empty, which in turn causes the
test to fail.

Fix by waiting until fstrm_capture starts listening on the Unix domain
socket it is configured to use before asking named to reopen the
configured dnstap destination.  Since various fstrm_capture versions log
different messages when the listening socket is set up, wait for a
common string that works for all fstrm_capture versions released to
date.  Add a few extra debug messages indicating test progress and make
the test fail if the expected fstrm_capture log message is not generated
within 10 seconds.
2023-08-07 11:26:58 +02:00
Michał Kępień
bd2941fc72
Capture all fstrm_capture output
The fstrm_capture.out file is overwritten when the fstrm_capture utility
is restarted during the "dnstap" system test.  Use a separate output
file for each fstrm_capture instance to ensure all output produced by
that tool during the "dnstap" system test is preserved for forensic
purposes.
2023-08-07 11:26:58 +02:00
Mark Andrews
ac41053d38 Merge branch '4243-_wait_for_stats-errors-not-detected-in-ixfr-system-test' into 'main'
Resolve "_wait_for_stats errors not detected in ixfr system test"

Closes #4243

See merge request isc-projects/bind9!8171
2023-08-07 09:16:55 +00:00
Mark Andrews
287a1ac09b Set ret=1 if _wait_for_stats does not succeed
Errors getting transfer statistics from named.run where not detected
as ret was not set to one if there hadn't been a success after looping
for a while.
2023-08-07 08:49:47 +00:00
Michał Kępień
638db88737 Merge branch 'michal/set-up-version-and-release-notes-for-bind-9.19.17' into 'main'
Set up version and release notes for BIND 9.19.17

See merge request isc-projects/bind9!8173
2023-08-07 08:26:04 +00:00
Michał Kępień
c0a6068215
Set up release notes for BIND 9.19.17 2023-08-07 10:23:55 +02:00
Michał Kępień
7fffb66891
Update BIND version to 9.19.17-dev 2023-08-07 10:23:55 +02:00
Michał Kępień
5c1f9951b3
Update BIND version for release v9.19.16 2023-08-04 11:17:54 +02:00
Michał Kępień
0a13a5e373
Add a CHANGES marker 2023-08-04 11:17:54 +02:00
Michał Kępień
56aad07a4d
Merge branch 'michal/prepare-documentation-for-bind-9.19.16' into 'v9.19.16-release'
Prepare documentation for BIND 9.19.16

See merge request isc-private/bind9!559
2023-08-04 11:17:54 +02:00