Ondřej Surý [Tue, 28 Aug 2018 08:30:44 +0000 (10:30 +0200)]
Add CHANGES entry for GL #192
5016. [cleanup] Remove wrappers that try to fix broken or incomplete
implementations of IPv6, pthreads and other core
functionality required and used by BIND. [GL #192]
Michał Kępień [Fri, 24 Aug 2018 11:49:45 +0000 (13:49 +0200)]
Reset dig exit code after a TCP connection is established
The "exitcode" variable is set to 9 if a TCP connection fails, but is
not reset to 0 if a subsequent TCP connection succeeds. This causes dig
to return a non-zero exit code if it succeeds in getting a TCP response
after a retry. Fix by resetting "exitcode" to 0 if connect_done()
receives an event with the "result" field set to ISC_R_SUCCESS.
Michał Kępień [Sat, 25 Aug 2018 19:48:17 +0000 (21:48 +0200)]
Set "use-alt-transfer-source no;" in the "mirror" system test
Force ns3 to use a constant source address (10.53.0.3) when sending
transfer requests for the "initially-unavailable" zone to prevent
failures of transfers not triggered by bin/tests/system/mirror/tests.sh
from causing fallback to using a source address for which transfers of
that zone are refused throughout the entire "mirror" system test since
that might yield false positives.
Michał Kępień [Fri, 24 Aug 2018 12:00:32 +0000 (14:00 +0200)]
Fix line continuation in fuzz/Makefile.in
Add a missing semicolon to prevent "make test" run from the top-level
directory from failing even when all system and unit tests succeed due
to "(cd fuzz && ${MAKE} check)" returning a non-zero exit code.
Michał Kępień [Fri, 24 Aug 2018 08:18:59 +0000 (10:18 +0200)]
Log a message when "ixfr-from-differences" is set for an inline-signed zone
For inline-signed zones, the value of "ixfr-from-differences" is
hardcoded to:
- "yes" for the raw version of the zone,
- "no" for the signed version of the zone.
In other words, any user-provided "ixfr-from-differences" setting is
effectively ignored for an inline-signed zone. Ensure the user is aware
of that by adding a note to the ARM and logging a message when an
"ixfr-from-differences" option is found at the zone level.
Michał Kępień [Fri, 24 Aug 2018 07:37:37 +0000 (09:37 +0200)]
Prevent a race in the "inline" system test
A short time window exists between logging the addition of an NSEC3PARAM
record to a zone and committing it to the current version of the zone
database. If a query arrives during such a time window, an unsigned
response will be returned. One of the checks in the "inline" system
test requires NSEC3 records to be present in an answer - that check
would fail in the case described above. Use rndc instead of log
watching for checking whether zone signing and NSEC3 chain modifications
are complete in order to prevent intermittent "inline" system test
failures.
Michał Kępień [Wed, 22 Aug 2018 09:28:54 +0000 (11:28 +0200)]
Fix reloading inline-signed zones
While "rndc reload" causes dns_zone_asyncload() to be called for the
signed version of an inline-signed zone, the subsequent zone_load() call
causes the raw version to be reloaded from storage. This means that
DNS_ZONEFLG_LOADPENDING gets set for the signed version of the zone by
dns_zone_asyncload() before the reload is attempted, but zone_postload()
is only called for the raw version and thus DNS_ZONEFLG_LOADPENDING is
cleared for the raw version, but not for the signed version. This in
turn prevents zone maintenance from happening for the signed version of
the zone.
Until commit 29b7efdd9f8ce9b49371809498744c4b076dc3ee, this problem
remained dormant because DNS_ZONEFLG_LOADPENDING was previously
immediately, unconditionally cleared after zone loading was started
(whereas it should only be cleared when zone loading is finished or an
error occurs). This behavior caused other issues [1] and thus had to be
changed.
Fix reloading inline-signed zones by clearing DNS_ZONEFLG_LOADPENDING
for the signed version of the zone once the raw version reload
completes. Take care not to clear it prematurely during initial zone
load. Also make sure that DNS_ZONEFLG_LOADPENDING gets cleared when
zone_postload() encounters an error or returns early, to prevent other
scenarios from resulting in the same problem. Add comments aiming to
help explain code flow.
Michał Kępień [Wed, 22 Aug 2018 08:48:07 +0000 (10:48 +0200)]
Set DNS_JOURNALOPT_RESIGN when loading the secure journal for an inline-signed zone
When an inline-signed zone is loaded, the master file for its signed
version is loaded and then a rollforward of the journal for the signed
version of the zone is performed. If DNS_JOURNALOPT_RESIGN is not set
during the latter phase, signatures loaded from the journal for the
signed version of the zone will not be scheduled for refresh. Fix the
conditional expression determining which flags should be used for the
dns_journal_rollforward() call so that DNS_JOURNALOPT_RESIGN is set when
zone_postload() is called for the signed version of an inline-signed
zone.
Extend bin/tests/system/stop.pl so that it can use "rndc halt" instead
of "rndc stop" as the former allows master file flushing upon shutdown
to be suppressed.
Michał Kępień [Wed, 22 Aug 2018 08:12:53 +0000 (10:12 +0200)]
Do not treat a referral with a non-empty ANSWER section as an error
As part of resquery_response() refactoring [1], a goto statement was
replaced [2] with a call to a new function - originally called
rctx_delegation(), now folded into rctx_answer_none() - extracted from
existing code. However, one call site of that refactored function does
not reset the "result" variable, causing a referral with a non-empty
ANSWER section to be inadvertently treated as an error, which prevents
resolution of names reliant on servers sending such responses. Fix by
resetting the "result" variable to ISC_R_SUCCESS when a response
containing a non-empty ANSWER section can be treated as a delegation.
projects / thirdparty / bind9.git / log
