Michał Kępień [Wed, 29 May 2019 09:05:01 +0000 (11:05 +0200)]
Use +dnssec instead of separate TXT records
When testing named instances which are configured to drop outgoing UDP
responses larger than 512 bytes, querying with DO=1 may be used instead
of querying for large TXT records as the effect achieved will be
identical: an unsigned response for a SOA query will be below 512 bytes
in size while a signed response for the same query will be over 512
bytes in size. Doing this makes all resolution checks in the "legacy"
system test more similar. Add checks for the TC flag being set in UDP
responses which are expected to be truncated to further make sure that
tested named instances behave as expected.
Michał Kępień [Wed, 29 May 2019 09:05:01 +0000 (11:05 +0200)]
Properly test servers with TCP support disabled
Sending TCP queries to test named instances with TCP support disabled
should cause dig output to contain the phrase "connection refused", not
"connection timed out", as such instances never open the relevant
sockets. Make sure that the "legacy" system test fails if the expected
phrase is not found in any of the relevant files containing dig output.
Ondřej Surý [Mon, 27 May 2019 14:11:11 +0000 (16:11 +0200)]
Use getconf LFS_{CFLAGS,LDFLAGS,LIBS} to get flags to compile lib/dns/gen
On some systems (namely Debian buster armhf) the readdir() call fails
with `Value too large for defined data type` unless the
_FILE_OFFSET_BITS=64 is defined. The correct way to fix this is to
get the appropriate compilation parameters from getconf system
interface.
Witold Kręcicki [Wed, 22 May 2019 10:37:03 +0000 (12:37 +0200)]
Fix a possible deadlock in TCP accepting
Each network thread holds an array of locks, indexed by a hash
of fd. When we accept a connection we hold a lock in accepting thread.
We then generate the thread number and lock bucket for the new
connection socket - if we hit the same thread and lock bucket as
accepting socket we get a deadlock. Avoid this by checking if we're
in the same thread/lock bucket and not locking in this case.
Ondřej Surý [Mon, 20 May 2019 16:20:55 +0000 (18:20 +0200)]
Add CHANGES entry:
5235. [cleanup] Refactor lib/isc/app.c to be thread-safe, unused
parts of the API has been removed and the
isc_appctx_t data type has been changed to be
fully opaque. [GL #1023]
Ondřej Surý [Mon, 13 May 2019 05:17:21 +0000 (12:17 +0700)]
Add most useful relaxed and acquire-relase stdatomic convenience macros
The header file <isc/atomic.h> now contains convenience macros for
most useful explicit memory ordering for C11 stdatomics, only relaxed
and acquire-release semantics is being used. These macros SHOULD be
used instead of atomic_<func>_explicit functions.
Michał Kępień [Wed, 24 Apr 2019 09:17:15 +0000 (11:17 +0200)]
Make NTAs work with validating forwarders
If named is configured to perform DNSSEC validation and also forwards
all queries ("forward only;") to validating resolvers, negative trust
anchors do not work properly because the CD bit is not set in queries
sent to the forwarders. As a result, instead of retrieving bogus DNSSEC
material and making validation decisions based on its configuration,
named is only receiving SERVFAIL responses to queries for bogus data.
Fix by ensuring the CD bit is always set in queries sent to forwarders
if the query name is covered by an NTA.
Ondřej Surý [Fri, 10 May 2019 02:29:00 +0000 (09:29 +0700)]
Improve the error message about missing PLY Python package
Previously, only a message about missing Python was printed, which was
misleading to many users. The new message clearly states that Python
AND PLY is required and prints basic instructions how to install PLY
package.
Tony Finch [Mon, 4 Feb 2019 13:46:51 +0000 (13:46 +0000)]
Deprecate SHA-1 in `dnssec-checkds`
This changes the behaviour so that it explicitly lists DS records that
are present in the parent but do not have keys in the child. Any
inconsistency is reported as an error, which is somewhat stricter than
before.
This is for conformance with the DS/CDS algorithm requirements in
https://tools.ietf.org/html/draft-ietf-dnsop-algorithm-update
Tony Finch [Thu, 31 Jan 2019 17:05:57 +0000 (17:05 +0000)]
Deprecate SHA-1 in `dnssec-dsfromkey`
This makes the `-12a` options to `dnssec-dsfromkey` work more like
`dnssec-cds`, in that you can specify more than one digest and you
will get multiple records. (Previously you could only get one
non-default digest type at a time.)
The default is now `-2`. You can get the old behaviour with `-12`.
Tests and tools that use `dnssec-dsfromkey` have been updated to use
`-12` where necessary.
This is for conformance with the DS/CDS algorithm requirements in
https://tools.ietf.org/html/draft-ietf-dnsop-algorithm-update
Mark Andrews [Fri, 1 Mar 2019 02:46:48 +0000 (13:46 +1100)]
dns_rdata_fromwire_text fuzzer
Fuzz input to dns_rdata_fromwire(). Then convert the result
to text, back to wire format, to multiline text, and back to wire
format again, checking for consistency throughout the sequence.
Evan Hunt [Thu, 31 Jan 2019 02:16:07 +0000 (18:16 -0800)]
move the test lists into conf.sh.common
there is now a common list of tests in conf.sh.common, with the
tests that are either unique to windows or to unix, or which are
enabled or disabled by configure or Configure, being listed in
separate variables in conf.sh.in and conf.sh.win32.
Evan Hunt [Sat, 26 Jan 2019 18:36:47 +0000 (10:36 -0800)]
enable parallel system tests on windows
this moves the creation of "parallel.mk" into a separate shell script
instead of bin/tests/system/Makefile. that shell script can now be
executed by runall.sh, allowing us to make use of the cygwin "make"
command, which supports parallel execution.
projects / thirdparty / bind9.git / log
