Ondřej Surý [Thu, 9 Feb 2023 11:27:40 +0000 (12:27 +0100)]
Add magic to fctxcount and replace the atomics with integers
Add magic value to the fctxcount, to check for completely invalid
counters, or counters that have been already destroyed.
Improve the locking around the counters, and because of that we can drop
the atomics and use simple integers - the counters were already locked
and the tiny bits that used the atomics were not worth the extra effort.
Evan Hunt [Wed, 8 Feb 2023 18:33:06 +0000 (10:33 -0800)]
clean up some deprecated/obsolete options and doc
- removed documentation of -S option from named man page
- removed documentation of reserved-sockets from ARM
- simplified documentation of dnssec-secure-to-insecure - it
now just says it's obsolete rather than describing what it
doesn't do anymore
- marked three formerly obsolete options as ancient:
parent-registration-delay, reserved-sockets, and
suppress-initial-notify
Petr Špaček [Mon, 4 Jul 2022 15:25:11 +0000 (17:25 +0200)]
Remove pregenerated manpages from the repo
We don't need them in the repo, it's sufficient if we pregenerate them
while preparing the tarball. That way we don't have overhead while
modifying them but they are still available for installations without
Sphinx.
I assume that this will make rebases and cherry-picks across branches
easier, with less trial and error churn required in the CI.
It's implemented in the way that we build the manpages only when we
either have pregenerated pages available at the configure time or
sphinx-build is installed and working.
Evan Hunt [Thu, 9 Feb 2023 03:28:09 +0000 (19:28 -0800)]
remove isc_bind9 variable
isc_bind9 was a global bool used to indicate whether the library
was being used internally by BIND or by an external caller. external
use is no longer supported, but the variable was retained for use
by dyndb, which needed it only when being built without libtool.
building without libtool is *also* no longer supported, so the variable
can go away.
Ondřej Surý [Wed, 8 Feb 2023 08:29:54 +0000 (09:29 +0100)]
Enforce version drift limits for libuv
libuv support for receiving multiple UDP messages in a single system
call (recvmmsg()) has been tweaked several times between libuv versions
1.35.0 and 1.40.0. Mixing and matching libuv versions within that span
may lead to assertion failures and is therefore considered harmful, so
try to limit potential damage be preventing users from mixing libuv
versions with distinct sets of recvmmsg()-related flags.
Mark Andrews [Thu, 9 Feb 2023 04:11:24 +0000 (15:11 +1100)]
Make notify source port test reliable
Send the test message from ns3 to ns2 instead of ns2 to ns3 as ns2
is started first and therefore the test doesn't have to wait on the
resend of the the NOTIFY message to be successful.
Mark Andrews [Tue, 31 Jan 2023 02:50:36 +0000 (13:50 +1100)]
dnssec-checkds: cleanup memory on error paths
Move and give unique names to the dns_db_t, dns_dbnode_t and
dns_dbversion_t pointers, so they have global scope and therefore
are visible to cleanup. Unique names are not strictly necessary,
as none of the functions involved call each other.
Change free_db to handle NULL pointers and also an optional
(dns_dbversion_t **).
In match_keyset_dsset and free_keytable, ki to be handled
differently to prevent a false positive NULL pointer dereference
warning from scan.
In formatset moved dns_master_styledestroy earlier and freed
buf before calling check_result to prevent memory leak.
In append_new_ds_set freed ds on the default path before
calling check_result to prevent memory leak.
Ondřej Surý [Tue, 10 Jan 2023 10:47:44 +0000 (11:47 +0100)]
Drop RHEL / CentOS / Oracle Linux 7 support
The RHEL (and clones) 7 will reach EOL in June 2024, shortly after BIND
9.20 will be released. Drop the support for building on those
platforms, so we can use features of modern operating systems - newer
compiler that supports at least subset of C23 and OpenSSL 1.1/3.0.
This will simplify some of the code that we are using in BIND 9.
Evan Hunt [Mon, 31 Jan 2022 20:10:29 +0000 (12:10 -0800)]
refactor dns_clientinfo_init(); use separate function to set ECS
Instead of using an extra rarely-used paramater to dns_clientinfo_init()
to set ECS information for a client, this commit adds a function
dns_clientinfo_setecs() which can be called only when ECS is needed.
Evan Hunt [Tue, 7 Feb 2023 19:05:13 +0000 (11:05 -0800)]
increase simultaneous updates for quota test
the nsupdate system test was intermittently failing due to the update
quota not being exceeded when it should have been. this is most likely
a timing issue: the client is sending updates too slowly, or the server
is processing them too quickly, for the quota to fill. this commit
attempts to make that the failure less likely by increasing the number
of update transactions from 10 to 20.
Mark Andrews [Tue, 7 Feb 2023 01:08:31 +0000 (12:08 +1100)]
Allow some time to the root trust anchor to appear
Following deleting the root trust anchor and reconfiguring the
server it takes some time to for trust anchor to appear in 'rndc
managed-keys status' output. Retry several times.
Aram Sargsyan [Wed, 1 Feb 2023 14:41:58 +0000 (14:41 +0000)]
Fix a bug in resolver's resume_dslookup() function
A recent refactoring in 7e4e125e5ea5b29c946ce4646461d06a75cd8702
had introduced a logical error which could result in calling the
dns_resolver_createfetch() function with 'nameservers' pointer set
to NULL, but with 'domain' not set to NULL, which is not allowed
by the function.
Make sure 'domain' is set only when 'nsrdataset' is valid.
Mark Andrews [Mon, 30 Jan 2023 07:06:57 +0000 (18:06 +1100)]
named-rrchecker: have fatal cleanup
It is trivial to fully cleanup memory on all the error paths in
named-rrchecker, many of which are triggered by bad user input.
This involves freeing lex and mctx if they exist when fatal is
called.
Evan Hunt [Thu, 2 Feb 2023 21:35:32 +0000 (13:35 -0800)]
add source port configuration tests
check in the log files of receiving servers that the originating
ports for notify and SOA query messages were set correctly from
configured notify-source and transfer-source options.
Evan Hunt [Thu, 2 Feb 2023 20:16:49 +0000 (12:16 -0800)]
use configured source ports for UDP requests
the optional 'port' option, when used with notify-source,
transfer-source, etc, is used to set up UDP dispatches with a
particular source port, but when the actual UDP connection was
established the port would be overridden with a random one. this
has been fixed.
(configuring source ports is deprecated in 9.20 and slated for
removal in 9.22, but should still work correctly until then.)
Evan Hunt [Fri, 3 Feb 2023 22:57:17 +0000 (14:57 -0800)]
remove /etc/bind.keys
the built-in trust anchors in named and delv are sufficent for
validation. named still needs to be able to load trust anchors from
a bind.keys file for testing purposes, but it doesn't need to be
the default behavior.
we now only load trust anchors from a file if explicitly specified
via the "bindkeys-file" option in named or the "-a" command line
argument to delv. documentation has been cleaned up to remove references
to /etc/bind.keys.
Evan Hunt [Fri, 27 Jan 2023 22:43:11 +0000 (14:43 -0800)]
delay trust anchor management until zones are loaded
it was possible for a managed trust anchor needing to send a key
refresh query to be unable to do so because an authoritative zone
was not yet loaded. this has been corrected by delaying the
synchronization of managed-keys zones until after all zones are
loaded.
Tony Finch [Fri, 3 Feb 2023 12:29:00 +0000 (12:29 +0000)]
Fix ISC_MEM_ZERO on allocators with malloc_usable_size()
ISC_MEM_ZERO requires great care to use when the space returned by
the allocator is larger than the requested space, and when memory is
reallocated. You must ensure that _every_ call to allocate or
reallocate a particular block of memory uses ISC_MEM_ZERO, to ensure
that the extra space is zeroed as expected. (When ISC_MEMFLAG_FILL
is set, the extra space will definitely be non-zero.)
When BIND is built without jemalloc, ISC_MEM_ZERO is implemented in
`jemalloc_shim.h`. This had a bug on systems that have malloc_size()
or malloc_usable_size(): memory was only zeroed up to the requested
size, not the allocated size. When an oversized allocation was
returned, and subsequently reallocated larger, memory between the
original requested size and the original allocated size could
contain unexpected nonzero junk. The realloc call does not know the
original requested size and only zeroes from the original allocated
size onwards.
After this change, `jemalloc_shim.h` always zeroes up to the
allocated size, not the requested size.
Michał Kępień [Fri, 3 Feb 2023 08:38:25 +0000 (09:38 +0100)]
Bump statistics channels versions
GL !7412 updated the set of counters exposed via the XML & JSON
statistics channels. Apply a corresponding version bump, which was
not included in that merge request.
Tom Krizek [Mon, 30 Jan 2023 12:48:55 +0000 (13:48 +0100)]
Add container rebuild step to release checklist
It was agreed that the monthly CI container image rebuild should be done
manually rather than be automated. This allows us to have control over
when things could break and the end of the release cycle is the most
convenient time to have that happen.
Michał Kępień [Wed, 1 Feb 2023 10:22:59 +0000 (11:22 +0100)]
Fix 'view' variable scope in load_configuration()
Commit b69e783164cd50e3306364668558e460617ee8fc changed the scope of the
local 'view' variable in load_configuration(), but the code section
guarded by the #ifdef USE_DNSRPS directive was not adjusted accordingly,
causing build errors for DNSRPS-enabled builds. Fix the latter by
declaring the 'view' variable inside the loop in the DNSRPS-specific
block of code.
Michał Kępień [Wed, 1 Feb 2023 10:22:59 +0000 (11:22 +0100)]
Handle iterator options in rpsdb_allrdatasets()
Commit 7695c36a5de01c441690f2a0e46f176321b58896 added a new parameter,
'options', to the prototype of the 'allrdatasets' function pointer in
struct dns_dbmethods. Handle this new parameter accordingly in
rpsdb_allrdatasets().
Michał Kępień [Wed, 1 Feb 2023 10:22:59 +0000 (11:22 +0100)]
Add DNSRPS builds to pairwise testing
The --enable-dnsrps-dl switch for ./configure enables preparing a
DNSRPS-enabled build of BIND 9 that is not directly linked against a
DNSRPS provider library (dlopen() at runtime is used instead). Employ
this switch to test DNSRPS-enabled builds in the pairwise testing job in
GitLab CI.
Evan Hunt [Wed, 26 Oct 2022 01:35:41 +0000 (18:35 -0700)]
refactor isc_ratelimiter to use loop callbacks
the rate limter now uses loop callbacks rather than task events.
the API for isc_ratelimiter_enqueue() has been changed; we now pass
in a loop, a callback function and a callback argument, and
receive back a rate limiter event object (isc_rlevent_t). it
is no longer necessary for the caller to allocate the event.
the callback argument needs to include a pointer to the rlevent
object so that it can be freed using isc_rlevent_free(), or by
dequeueing.
Mark Andrews [Mon, 30 Jan 2023 00:18:49 +0000 (11:18 +1100)]
Handle address lookup failure more gracefully
If the address lookup of the primary server fails just abort
the current update request rather than calling exit. This allows
nsupdate to cleanup gracefully.
Ondřej Surý [Mon, 30 Jan 2023 08:49:35 +0000 (09:49 +0100)]
Properly name ADB hashmap and named log memory contexts
The ADB hashmaps are stored in extra memory contexts, so the hash
tables are excluded from the overmem accounting. The new memory
context was unnamed, give it a proper name.
Same thing has happened with extra memory context used for named
global log context - give the extra memory context a proper name.
projects / thirdparty / bind9.git / log
