2
0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 05:28:00 +00:00

40162 Commits

Author SHA1 Message Date
Petr Špaček
f5a91e2f49 Update BIND version to 9.19.19-dev 2023-11-10 13:50:32 +01:00
Petr Špaček
36aa66bfb4 Merge branch 'matthijs-remove-deprecation-warning-on-dnssec-policy-max-zone-ttl' into 'main'
Remove deprecation warning on dnssec policy max zone ttl

See merge request isc-projects/bind9!8467
2023-11-05 13:10:03 +00:00
Matthijs Mekking
91430cd59a Remove dnssec-policy/max-zone-ttl deprecation text
The readthedocs also placed a deprecation warning on 'max-zone-ttl'
that is part of 'dnssec-policy'. This option is of course not being
deprecated.
2023-11-05 11:37:33 +01:00
Evan Hunt
7d650fde89 Merge branch 'fanf-rndc-nta-newlines' into 'main'
Fix missing newlines in output of `rndc nta -dump`

See merge request isc-projects/bind9!8454
2023-11-02 16:31:25 +00:00
Evan Hunt
37b101b6e2 CHANGES for [GL !8454] 2023-11-02 21:31:43 +11:00
Tony Finch
61b245e318 Fix missing newlines in output of rndc nta -dump
There were no newlines between each view in the list of negative trust
anchors.
2023-11-02 21:31:09 +11:00
Tom Krizek
01b1ae7bef Merge branch '4401-make-check-fix-junitxml-output-processing' into 'main'
Fix pytest junitxml output processing for make check

Closes #4401

See merge request isc-projects/bind9!8443
2023-11-02 09:02:01 +00:00
Tom Krizek
ba25ecd2d2
Fix pytest junitxml output processing for make check
Not every element tagged `skipped` in the JUnitXML tree has to contain
the `type` attribute. An example of that is a test that results in
xpass.

This has been verified with pytest version 7.4.2 and prior.
2023-11-02 09:59:23 +01:00
Michał Kępień
1a724685a0 Merge branch 'michal/add-a-release-signing-job-to-gitlab-ci' into 'main'
Add a release signing job to GitLab CI

See merge request isc-projects/bind9!8418
2023-11-02 06:23:15 +00:00
Michał Kępień
a3a91a1557
Add a release signing job to GitLab CI
Add a GitLab CI job that is only run for tags and makes signing BIND 9
releases more convenient by utilizing a signing VM that is registered as
a GitLab CI runner.  This pulls the signing process into the release
pipelines in GitLab CI, resulting in job artifacts containing the
signatures for BIND 9 releases, which in turns simplifies the subsequent
release publication steps.
2023-11-02 07:22:20 +01:00
Mark Andrews
83053ea740 Merge branch '4406-cleanup-b-in-dnstap-main' into 'main'
Resolve "cleanup 'b' in dnstap-read main"

Closes #4406

See merge request isc-projects/bind9!8455
2023-11-02 04:25:19 +00:00
Mark Andrews
0482451f84 Cleanup dead code in dnstap-read
Remove 'b' from main as it is unused.
2023-11-01 20:58:22 +00:00
Mark Andrews
73b8a311a6 Merge branch '4209-turn-on-qname-minimisation-for-adb-name-fetches' into 'main'
Resolve "Turn on QNAME minimisation for adb name fetches."

Closes #4209

See merge request isc-projects/bind9!8107
2023-11-01 17:13:47 +00:00
Mark Andrews
967bdb33be Add release note for [GL #4209] 2023-11-01 16:51:56 +01:00
Mark Andrews
899527e357 Add CHANGES note for [GL #4209] 2023-11-01 16:51:53 +01:00
Evan Hunt
461b9a0442 if GLUEOK is set, and glue is found in a zone DB, don't check the cache
EXPERIMENT: when DNS_DB_GLUEOK is set, dns_view_find() will now return
glue if it is found it a local zone database, without checking to see
if a better answer has been cached previously.
2023-11-01 16:49:08 +01:00
Mark Andrews
9227b82e71 Also look for additional records in dns_adb_find
If a child zone is served by the same servers as a parent zone and
a NS query is made for the zone name then the addresses of the
nameservers are returned in the additional section are tagged as
trust additional.
2023-11-01 16:49:08 +01:00
Mark Andrews
578da93581 Turn on QNAME minimisation when fetching nameserver addresses 2023-11-01 16:49:08 +01:00
Evan Hunt
a4aa93f46d Merge branch '4340-fix-max-cache-size' into 'main'
restore isc_mem_setwater() call in the cache

Closes #4340

See merge request isc-projects/bind9!8445
2023-11-01 15:18:18 +00:00
Michał Kępień
789879b572 Add release note for GL #4340 2023-11-01 15:18:02 +00:00
Evan Hunt
93f1518c80 CHANGES for [GL #4340] 2023-11-01 15:18:02 +00:00
Evan Hunt
b12f709f05 restore isc_mem_setwater() call in the cache
Commit 4db150437e14b28c5b50ae466af9ce502fd73185 incorrectly removed the
call to isc_mem_setwater() from dns_cache_setcachesize().  The water()
function is a no-op, but we still need to set high- and low-water marks
in the memory context, otherwise overmem conditions will not be
detected.
2023-11-01 15:18:02 +00:00
Tom Krizek
d17d9de8a2 Merge branch 'tkrizek/perf-tests-shotgun' into 'main'
Add DNS Shotgun performance tests to nightly pipelines

See merge request isc-projects/bind9!8373
2023-11-01 13:38:35 +00:00
Tom Krizek
322dfbf6a9
Update release checklist
Add a step to verify results of shotgun:* jobs.
2023-11-01 14:02:52 +01:00
Tom Krizek
c7fcb1ca60
ci: trigger a DNS Shotgun performance test
Run comparative performance tests against the latest released version of
the same branch. This is done for different protocols with an
appropriate load the server is expected to be able to handle.

Currently, the results need to be inspected manually, since a success of
the job doesn't indicate there is no issue. Instead, the job provides an
URL to an overview with latency, memory and CPU charts which display the
test results with the current code against the reference version. There
should be no major unexplained and reproducible differences in the
charts.
2023-11-01 14:02:51 +01:00
Tom Krizek
ff32421a64
util: script to get DNS Shotgun pipeline results
The shotgun performance tests are executed in a different repository, in
a couple of different pipelines. To hide away the complexity, this
script takes the pipeline ID of the triggered pipeline and then takes
care of the rest - waits for the pipeline to finish, locates the child
pipeline and the relevant results. The output from this script is a
convenient link to the charts with the results once they're available.

GitLab also has a mechanism which can wait for another pipeline.
However, it can't be utilized here, since there are variables which
need to be passed in when the pipeline is triggered (like protocol to be
tested, load, runtime etc.). This isn't currently supported by the
GitLab feature.
2023-11-01 09:47:20 +01:00
Tom Krizek
ef4e2d2964
ci: move baseline version detection into separate job
Multiple CI jobs may utilize a baseline version, i.e. the version that
the current code should be tested against when doing comparative
testing. To avoid repeating the non-trivial detection of the baseline
version, move it into a separate job which creates an environment file
that subsequent jobs may require via `needs` option. It is then possible
to use the variable(s) defined in the script section of the new job.
2023-11-01 09:47:19 +01:00
Matthijs Mekking
3f205f3218 Merge branch '4355-serve-stale-unexpected-recursion' into 'main'
Don't ignore authoritative local zones when in serve-stale mode

Closes #4355

See merge request isc-projects/bind9!8415
2023-10-31 12:49:51 +00:00
Matthijs Mekking
ac19d43a32 Add release note and CHANGES for #4355 2023-10-30 20:07:01 +01:00
Matthijs Mekking
2322425016 Don't ignore auth zones when in serve-stale mode
When serve-stale is enabled and recursive resolution fails, the fallback
to lookup stale data always happens in the cache database. Any
authoritative data is ignored, and only information learned through
recursive resolution is examined.

If there is data in the cache that could lead to an answer, and this can
be just the root delegation, the resolver will iterate further, getting
closer to the answer that can be found by recursing down the root, and
eventually puts the final response in the cache.

Change the fallback to serve-stale to use 'query_getdb()', that finds
out the best matching database for the given query.
2023-10-30 20:07:01 +01:00
Matthijs Mekking
e196ba6168 Test case for issue #4355
Add a test case where serve-stale is enabled on a server that also
servers a local authoritative zone.

The particular case tests a lame delegation and checks if falling
back to serving stale data does not attempt to retrieve the query
by recursing from the root down.
2023-10-30 20:07:01 +01:00
Ondřej Surý
2a24ba4618 Merge branch 'ondrej/bump-dns_message-pools-size' into 'main'
Bump the mempool sizes in dns_message

See merge request isc-projects/bind9!8439
2023-10-28 06:52:30 +00:00
Ondřej Surý
c855ed6a0b
Bump the mempool sizes in dns_message
Increasing the initial and freemax sizes for dns_message memory pools
restores the root zone performance.  The former sizes were suited for
per-dns_message memory pools and we need to bump the sizes up for
per-thread memory pools.
2023-10-27 15:28:27 +02:00
Michał Kępień
61e12cde05 Merge branch '4390-always-use-default-rcu-variant-in-pairwise-builds' into 'main'
Always use default RCU variant in pairwise builds

Closes #4390

See merge request isc-projects/bind9!8438
2023-10-27 11:59:46 +00:00
Michał Kępień
bf518ba490
Always use default RCU variant in pairwise builds
Commit 42d43aa0758513a45b54e0fd0bff4381fdc4d803 made --with-liburcu
depend on --enable-developer.  This broke pairwise testing as this new
dependency was not codified in configure.ac.  Since the --with-liburcu
option is currently just a convenience for developers, there is no need
to test building against all possible RCU variants in GitLab CI until
they actually work with BIND 9.  Update the pairwise testing
"configuration" in configure.ac so that builds with non-standard RCU
variants are not tested.
2023-10-27 13:19:03 +02:00
Ondřej Surý
ff28f9f8ac Merge branch '4392-increase-dispatch_test-timeouts' into 'main'
Bump the timeouts in the dispatch_test

Closes #4392

See merge request isc-projects/bind9!8437
2023-10-27 11:00:20 +00:00
Ondřej Surý
aa393b9e57
Bump the timeouts in the dispatch_test
The client connection timeout was set to just one second, which might
not be enough on busy systems (and the CI machines are oh-boy-busy).
Bump the server timeouts to 10 seconds and client timeouts to 5 seconds,
this will make the unit test run a little bit longer, but it should be
more reliable.
2023-10-27 12:55:51 +02:00
Ondřej Surý
b7e793b84c
Add tests/dns/badcache.out to .gitignore 2023-10-27 12:55:51 +02:00
Ondřej Surý
f71ca845c1 Merge branch '4211-fix-data-race-in-controlconf' into 'main'
Call isccc_ccmsg_invalidate() when shutting down the connection

Closes #4211

See merge request isc-projects/bind9!8426
2023-10-27 10:47:57 +00:00
Ondřej Surý
2d2c249958
Call isccc_ccmsg_invalidate() when shutting down the connection
Previously, the isccc_ccmsg_invalidate() was called from conn_free() and
this could lead to netmgr calling control_recvmessage() after we
detached the reading controlconnection_t reference, but it wouldn't be
the last reference because controlconnection_t is also attached/detached
when sending response or running command asynchronously.

Instead, move the isccc_ccmsg_invalidate() call to control_recvmessage()
error handling path to make sure that control_recvmessage() won't be
ever called again from the netmgr.
2023-10-27 10:53:26 +02:00
Ondřej Surý
07f569e2f6
Replace mutex for listener->connections with TID check
The controlconf channel runs single-threaded on the main thread.
Replace the listener->connections locking with check that we are still
running on the thread with TID 0.
2023-10-27 10:21:41 +02:00
Ondřej Surý
7a37c516d4 Merge branch '4391-remove-lock-file-and--X' into 'main'
Remove the lock-file configuration and -X argument to named

Closes #4391

See merge request isc-projects/bind9!8428
2023-10-27 06:36:16 +00:00
Ondřej Surý
3a08cb5807
Add CHANGES and release note for [GL #4391] 2023-10-26 22:43:03 +02:00
Ondřej Surý
f8e264ba6d
Remove the lock-file configuration and -X argument to named
The lock-file configuration (both from configuration file and -X
argument to named) has better alternatives nowadays.  Modern process
supervisor should be used to ensure that a single named process is
running on a given configuration.

Alternatively, it's possible to wrap the named with flock(1).
2023-10-26 22:42:37 +02:00
Ondřej Surý
d3f2766a79
Mark the lock-file configuration option as deprecated
This is first step in removing the lock-file configuration option, it
marks both the `lock-file` configuration directive and -X option to
named as deprecated.
2023-10-26 22:41:45 +02:00
Michal Nowak
40c4540cf9 Merge branch 'mnowak/openbsd-7.4' into 'main'
Add OpenBSD 7.4

See merge request isc-projects/bind9!8395
2023-10-26 14:31:13 +00:00
Michal Nowak
f8733fc051
Add OpenBSD 7.4 2023-10-26 16:27:56 +02:00
Arаm Sаrgsyаn
c70e9f0fef Merge branch 'aram/fix-lock-file-option-and--X-argument-issues' into 'main'
Fix assertion failure when using -X none and lock-file in configuration

See merge request isc-projects/bind9!8432
2023-10-26 13:11:30 +00:00
Aram Sargsyan
41945b32d7 Do not warn about lock-file option change when -X is used
When -X is used the 'lock-file' option change detection condition
is invalid, because it compares the 'lock-file' option's value to
the '-X' argument's value instead of the older 'lock-file' option
value (which was ignored because of '-X').

Don't warn about changing 'lock-file' option if '-X' is used.
2023-10-26 12:34:15 +00:00
Aram Sargsyan
bc891e749f Fix an invalid condition check when detecting a lock-file change
It is obvious that the '!cfg_obj_asstring(obj)' check should be
'cfg_obj_asstring(obj)' instead, because it is an AND logic chain
which further uses 'obj' as a string.

Fix the error.
2023-10-26 12:34:07 +00:00