Martin Basti [Thu, 23 Jul 2026 09:09:54 +0000 (09:09 +0000)]
Gate the dig source-address crash check on IPv6 availability
The check for the crash with an IPv4 source address and a server with
both IPv4 and IPv6 addresses relies on @localhost resolving to ::1 as
well as 127.0.0.1: without IPv6 the address-family mismatch under test
never happens and the test passes without exercising anything. Skip
it on hosts without IPv6 instead, like the other IPv6-dependent digdelv
tests. The remaining unmarked tests that mention IPv6 addresses only
parse them (the IPv4-mapped server refusal) or read them as record
data, so they work without IPv6.
Martin Basti [Thu, 23 Jul 2026 09:01:11 +0000 (09:01 +0000)]
Require PyYAML for the digdelv system test
Previously the digdelv +yaml checks were skipped when PyYAML was not
installed. Treat PyYAML as a hard test dependency instead.
Drop the conditional needs_pyyaml skips, so a missing module now
fails the tests at import time.
Martin Basti [Wed, 22 Jul 2026 22:26:06 +0000 (22:26 +0000)]
Migrate digdelv delv +ns checks to pytest, dropping tests.sh
Move the delv +ns checks from tests.sh into tests_delv.py: the NS
records in the iterative-mode output, lookups with and without
validation and query name minimization, the -4/-6 address family
selection, and the DNS COOKIE options. This migrates the last check
left in tests.sh, so tests.sh, the tests_sh_digdelv.py wrapper and the
now-unused yamlget.py helper are removed.
Martin Basti [Mon, 27 Jul 2026 14:12:10 +0000 (14:12 +0000)]
Migrate digdelv delv checks to pytest
Move the delv checks from tests.sh into a new tests_delv.py module:
+short/+sh, +split/+sp, +unknownformat, the rrcomments/multi matrix,
+nosplit field counts, +cookie/+nocookie, class handling, reverse
lookups, -q -m, -t ANY, -4/-6 handling and address family mismatches,
the malformed query name exit code, key-style and DS-style trust
anchors, REFUSED while chasing DS records, and the +yaml output
structure for positive and negative responses. check_ttl_range()
learns to look inside delv's commented records ("; name ttl class
type ..."), where its textual type comparison also matches delv's
\-ANY pseudo-type; the duplicated "-c CH" check is folded into one
test, and the module is skipped entirely when the delv executable is
not available.
Add __init__.py to avoid a module-name collision with
dnssec/tests_delv.py: without it, pytest imports the file as plain
tests_delv, which conflicts.
Martin Basti [Wed, 22 Jul 2026 22:04:19 +0000 (22:04 +0000)]
Migrate digdelv mdig checks to pytest
Move the mdig checks from tests.sh into a new tests_mdig.py module:
the source address and port handling over TCP, the malformed
'+ednsopt=:' option, the +multi +norrcomments output for DNSKEY and
SOA, and the +yaml output structure. Like tests_dig.py, the module is
skipped entirely when the mdig executable is not available.
Martin Basti [Wed, 22 Jul 2026 21:47:34 +0000 (21:47 +0000)]
Migrate digdelv dig +yaml structure checks to pytest
Move the remaining dig checks from tests.sh into tests_dig.py: the
structure of +yaml output for an ANY query, the printing of an IPv6
address ending in zeroes, the quoting of qnames containing characters
special to YAML, and the quoting of all 256 character values in TXT
rdata, whose expected string is now computed instead of spelled out
over thirty lines. This completes the dig section of tests.sh, so the
dig_with_opts and set_response_sequence helpers are removed with it.
Martin Basti [Wed, 22 Jul 2026 21:24:12 +0000 (21:24 +0000)]
Migrate digdelv dig failover checks to pytest
Move the dig connection-handling checks from tests.sh into
tests_dig.py: AXFR retries upon TCP EOF driven by the ans5 response
sequences, trying the next server after unreachable/read/connection
errors and timeouts, timeout followed by SERVFAIL, the retry comment
with +short +comments, the startup banner and +nocmd on the error
path, +yaml validity when no server is reached, the IPv4-mapped IPv6
server refusal, -4/-6 handling and the source-address crash check.
The ans5 sequence cases and the UDP/TCP pairs are parametrized, and
each case now arms its own response sequence so the tests are
order-independent.
Martin Basti [Wed, 22 Jul 2026 15:12:13 +0000 (15:12 +0000)]
Migrate digdelv dig +subnet checks to pytest
Move the dig EDNS client-subnet checks from tests.sh into
tests_dig.py: +subnet with IPv4, IPv6 and zero-length subnets, the
precedence of repeated +subnet options, prefix lengths 1-24 and
prefixes between byte boundaries, raw +ednsopt=8 encodings rejected by
the server, and the +yaml counterparts. The prefix-length loops are
parametrized and the expected masked address is computed with the
ipaddress module instead of a hardcoded table.
Martin Basti [Wed, 22 Jul 2026 14:52:10 +0000 (14:52 +0000)]
Migrate digdelv dig EDNS checks to pytest
Move the dig EDNS checks from tests.sh into tests_dig.py: the header
and EDNS flag options (+coflag/+raflag/+tcflag/+zflag, +ednsflags,
+showbadvers, +showtruncated), the +ednsopt family (NSID, KEY-TAG,
CLIENT-TAG, SERVER-TAG, CHAIN, EDE, UPDATE-LEASE, LLQ and malformed
options), +expire, +keepalive and +zoneversion, together with their
+yaml counterparts. The yamlget.py helper script is replaced by a
yaml_get() function which walks the parsed YAML directly, so the +yaml
checks now compare typed values instead of strings, and the client-tag,
server-tag and EDE cases are parametrized.
Martin Basti [Wed, 22 Jul 2026 14:08:43 +0000 (14:08 +0000)]
Migrate digdelv dig formatting checks to pytest
Move the dig output-formatting and command-line handling checks from
tests.sh into a new tests_dig.py module: +short, +split/+sp,
+unknownformat, reverse lookups, the rrcomments/multi matrix,
+header-only, +ttlunits, +expandaaaa, +bufsize, query-time units and
+yaml timestamp precision, +nocrypto, class CHAOS, query-name error
handling and the UPDATE-opcode rejection. Repeated checks are
parametrized and the duplicated "+short +rrcomments" check is folded
into a single test.
The shared check_ttl_range helper mirrors the original awk check: it
scans the output line by line, accepts the class tokens IN and CLASS1
(the RFC 3597 unknown-format spelling), and compares the RR type
token textually and the TTL numerically.
Martin Basti [Wed, 22 Jul 2026 12:27:36 +0000 (12:27 +0000)]
Migrate digdelv nslookup/host/nsupdate checks to pytest
Move the UPDATE-opcode rejection checks for nslookup, host and
nsupdate from tests.sh into a new tests_others.py module, which holds
the checks for the look-up tools other than dig, delv and mdig. The
new tests assert on the exact stream (stdout or stderr) each tool
prints to, instead of the combined output the shell version grepped.
BIND used to cache an NSEC3 closest encloser proof alongside positive wildcard answers so that a resolver could re-send it when answering from its cache. That stopped being used in
BIND 9.9 (2011), when positive wildcard responses were changed to omit that NSEC3 record — RFC 5155 requires only the next closer name proof — and the closest encloser came to be
derived during validation instead. The caching code has been unreachable ever since, so this removes it with no change in behaviour.
The addclosest/getclosest mechanism cached an NSEC3 closest encloser
proof alongside a positive wildcard answer so a recursive server could
re-emit it when answering from cache. It has been dead since changeset
3175 (RT #26200, 2011, first released in 9.9.0), which fixed both ends
of the exchange at once: the authoritative server stopped sending the
closest encloser NSEC3 in positive wildcard responses (RFC 5155 section
7.2.6 only requires the next closer name proof), and the validator
started deriving the closest encloser from the wildcard signature rather
than discovering it from a response record. Since then findnsec3proofs()
never sets DNS_VALIDATOR_CLOSESTENCLOSER for a positive wildcard -- 'val->
closest' is already known, so closest-encloser discovery is skipped -- so
the resolver's addclosest call and everything downstream of it (cache
storage, retrieval, and the query.c response path) can no longer be
reached. Remove the whole chain.
With it gone, the 'setclosest' output flag of dns_nsec3_noexistnodata()
has no remaining reader: findnsec3proofs() was its last consumer, and
findnoqname() in the resolver only ever inspected 'setnearest'. Drop the
flag and its scratch variables; the closest encloser name itself is still
discovered and returned via the 'closest' argument.
dns_private_chains wasn't looking for the private records that
indicate that a zone is being signed by a PRIVATE DNSSEC algorithm.
This has been fixed.
Closes #6205
Merge branch '6205-dns_private_chains-fix-private-algorithms-support' into 'main'
Martin Basti [Tue, 28 Jul 2026 15:22:20 +0000 (15:22 +0000)]
Add unit test for dns_private_chains
The private test only exercised dns_private_totext. Add coverage
for dns_private_chains in the no-NSEC, no-NSEC3PARAM case: the old
5-octet signing record form, the new 7-octet form used for PRIVATE
DNSSEC algorithms, records that must not trigger chain building
(mismatched algorithm octet, completed signing), and the combination
with a queued NSEC3 chain creation. The new-form case fails without
the preceding dns_private_chains fix.
dns_private_chains wasn't looking for the private records that
indicate that a zone is being signed by a PRIVATE DNSSEC algorithm.
This has been fixed.
Michal Nowak [Tue, 28 Jul 2026 10:38:21 +0000 (12:38 +0200)]
rem: ci: Drop FreeBSD 13 support
FreeBSD 13 has reached its end of life, so stop testing on it: remove
the CI build, system test, and unit test jobs together with the runner
tag anchor they used, and move the release from the regularly tested
platforms to the best-effort list in the ARM.
The is_host_freebsd_13 helper existed solely to grant one rerun to two
tests that were flaky on that release, so it goes away with them.
Assisted-by: Claude:claude-opus-5[1m]
Merge branch 'mnowak/drop-freebsd-13' into 'main'
Michal Nowak [Tue, 28 Jul 2026 08:47:41 +0000 (10:47 +0200)]
Drop FreeBSD 13 support
FreeBSD 13 has reached its end of life, so stop testing on it: remove
the CI build, system test, and unit test jobs together with the runner
tag anchor they used, and move the release from the regularly tested
platforms to the best-effort list in the ARM.
The is_host_freebsd_13 helper existed solely to grant one rerun to two
tests that were flaky on that release, so it goes away with them.
Michal Nowak [Tue, 28 Jul 2026 09:52:15 +0000 (11:52 +0200)]
chg: dev: Use sanitizer.contains() instead of the "in" operator
muon's static analyzer aborts on the four "'address' in sanitizer"
expressions because it cannot typecheck the "in" operator against the
complex combo type it infers for b_sanitize, which makes "muon analyze"
unusable on the whole tree. Reported upstream as
https://github.com/muon-build/muon/issues/289.
Assisted-by: Claude:claude-fable-5
Merge branch 'mnowak/meson-sanitizer-contains' into 'main'
Michal Nowak [Mon, 27 Jul 2026 14:44:40 +0000 (16:44 +0200)]
Use sanitizer.contains() instead of the "in" operator
muon's static analyzer aborts on the four "'address' in sanitizer"
expressions because it cannot typecheck the "in" operator against the
complex combo type it infers for b_sanitize, which makes "muon analyze"
unusable on the whole tree. Reported upstream as
https://github.com/muon-build/muon/issues/289.
Aydın Mercan [Wed, 22 Jul 2026 15:08:49 +0000 (18:08 +0300)]
use the lint test suite in misc job
The `misc` job in CI already needs to have a build directory configured
when checking for rdata registration. Thus, it is safe to transition the
CI job to use the `lint` test suite instead.
Michal Nowak [Thu, 23 Jul 2026 09:18:34 +0000 (11:18 +0200)]
Add missing putnull() to named_smf_add_message()
The control channel response text needs to be NUL-terminated.
named_smf_add_message() did not do that, so 'rndc stop' or
'rndc halt' on an SMF-managed named running chrooted could echo
uninitialized heap contents after the 'use svcadm(1M) to manage
named' message.
Michal Nowak [Thu, 23 Jul 2026 09:18:34 +0000 (11:18 +0200)]
Restore SMF support in the build system
libscf detection (AC_CHECK_LIB(scf, smf_enable_instance)) was lost
in the automake rewrite (978c7b2e89aa) and was not added back when
the build system was replaced with meson, so HAVE_LIBSCF was never
defined and the Solaris SMF code in bin/named was dead code.
Detect libscf on SunOS hosts and link named against it.
fix: test: Drop a redundant racy check in fetchlimit test
This particular `fetchlimit` failure has been happening quite often since https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12124 removed the test re-runs with `flaky` (after fixing other instabilities inside the test).
Example failure: https://gitlab.isc.org/isc-projects/bind9/-/jobs/7780648
Merge branch 'nicki/fix-fetchlimit-recovery-quota-flaky' into 'main'
The "lame server recovery" step required the adaptive per-server quota
for the lame server to have dropped further after it started answering
again. That decrease is not reliable: the quota only drops while the
timeout ratio (atr) exceeds the high watermark, and once the server
answers atr falls, so a further drop cannot be relied upon.
Remove the check to improve the fetchlimit test stability in slower
platforms in CI. The quota at the start of the recovery is still
recorded -- it is checked later on that it is increased once the server
recovers.
In `ddns-confgen`, the user-supplied domain name to be updated was not properly escaped and put inside a double-quoted string when generating the example code fragment. This has been corrected.
Closes #6072
Merge branch '6072-ddns-confgen-self-domain-update-policy-injection' into 'main'
In ddns-confgen, the user-supplied domain name to be updated
was not properly escaped and put inside a double quoted string
when generating the example code fragment. This has been corrected.
Michal Nowak [Thu, 23 Jul 2026 16:24:10 +0000 (18:24 +0200)]
fix: dev: Restore arc4random() detection dropped in the v9.21.14 merge
Commit 4db9e5d90e2 ("Use arc4random for CSPRNG when available", part
of the CVE-2025-40780 fix) guarded the arc4random() code paths in
lib/isc/random.h and lib/isc/random.c with HAVE_ARC4RANDOM and added
the corresponding function check to meson.build. The manual conflict
resolution in merge c2a672bbaef ("Merge tag 'v9.21.14'") kept the code
changes but dropped the meson.build hunk, so HAVE_ARC4RANDOM was never
defined and platforms with arc4random() (macOS and the BSDs) silently
fell back to the internal ChaCha-based CSPRNG. Restore the check.
Assisted-by: Claude:claude-fable-5
Merge branch 'mnowak/restore-arc4random-meson-check' into 'main'
Michal Nowak [Thu, 23 Jul 2026 14:47:31 +0000 (16:47 +0200)]
Restore arc4random() detection dropped in the v9.21.14 merge
Commit 4db9e5d90e2 ("Use arc4random for CSPRNG when available", part
of the CVE-2025-40780 fix) guarded the arc4random() code paths in
lib/isc/random.h and lib/isc/random.c with HAVE_ARC4RANDOM and added
the corresponding function check to meson.build. The manual conflict
resolution in merge c2a672bbaef ("Merge tag 'v9.21.14'") kept the code
changes but dropped the meson.build hunk, so HAVE_ARC4RANDOM was never
defined and platforms with arc4random() (macOS and the BSDs) silently
fell back to the internal ChaCha-based CSPRNG. Restore the check.
Michal Nowak [Thu, 23 Jul 2026 12:24:19 +0000 (14:24 +0200)]
fix: ci: Make the scan-build CI job actually run the static analyzer
scan-build was a silent no-op: the native file pinned CC to a name ccc-analyzer never intercepts. Run meson and ninja under scan-build with --use-cc, drop the native file and LTO, and gate on all default checkers via --status-bugs.
Merge branch '6165-scan-build-actually-run-analyzer' into 'main'
Michal Nowak [Mon, 29 Jun 2026 12:41:03 +0000 (12:41 +0000)]
Silence scan-build leak false positive in isccc_cc_checkdup()
On success the symtab owns 'key' and frees it via symtab_undefine(), but
scan-build cannot see that ownership pass through the const key
parameter of isc_symtab_define() and reports a leak. free(key) under
__clang_analyzer__ only, which placates the checker without affecting
real builds:
lib/isccc/cc.c:1015:9: warning: Potential leak of memory pointed to by 'key' [unix.Malloc]
Michal Nowak [Mon, 29 Jun 2026 11:41:20 +0000 (11:41 +0000)]
Assert rdataset precondition in query_addrrset()
rdataset is always non-NULL and is dereferenced unconditionally below.
Make the precondition explicit to silence a scan-build false positive:
lib/ns/query.c:2254:11: warning: Access to field 'type' results in a dereference of a null pointer (loaded from variable 'rdataset') [core.NullDereference]
Michal Nowak [Mon, 29 Jun 2026 11:41:09 +0000 (11:41 +0000)]
Assert fd validity in start_tcp_child()
load_balance_sockets is fixed at netmgr init, so dup(fd) runs only when
the caller supplied a valid descriptor. Assert it to silence a
scan-build false positive:
lib/isc/netmgr/tcp.c:468:15: warning: The 1st argument to 'dup' is -1 but should be >= 0 [unix.StdCLibraryFunctions]
Michal Nowak [Mon, 29 Jun 2026 11:40:50 +0000 (11:40 +0000)]
Assert fd validity in start_udp_child()
load_balance_sockets is fixed at netmgr init, so dup(fd) runs only when
the caller supplied a valid descriptor. Assert it to silence a
scan-build false positive:
lib/isc/netmgr/udp.c:194:15: warning: The 1st argument to 'dup' is -1 but should be >= 0 [unix.StdCLibraryFunctions]
Michal Nowak [Mon, 22 Jun 2026 19:24:33 +0000 (21:24 +0200)]
Remove dead stores reported by scan-build
The syncplugin test driver overwrote two dns_name_fromstring() results
without checking them; wrap the calls in CHECK():
bin/tests/system/hooks/driver/test-syncplugin.c:156:3: warning: Value stored to 'result' is never read [deadcode.DeadStores]
bin/tests/system/hooks/driver/test-syncplugin.c:158:3: warning: Value stored to 'result' is never read [deadcode.DeadStores]
Michal Nowak [Mon, 22 Jun 2026 16:25:16 +0000 (18:25 +0200)]
Run scan-build static analysis in CI
scan-build was a silent no-op: the native file pinned CC to a name
ccc-analyzer never intercepts. Run meson and ninja under scan-build
with --use-cc, drop the native file and LTO, and gate on all default
checkers via --status-bugs.
new: test: Mark each test's boundaries in the named instance logs
Use `rndc null` command to mark each test boundaries in named.run logs.
Since calling the `rndc` binary caused a lot of overhead, import the rndc python interface from [python-rndc](https://gitlab.isc.org/isc-projects/python-rndc/) and adapt it to our use-case.
Merge branch 'nicki/rndc-null-in-system-tests' into 'main'
Mark each test's boundaries in the named instance logs
Send an `rndc null` command with a test ID marker at the start and end
of each test function to all named instances.
This makes it easy to identify the precise point where each test was
executed when reading the named logs. This becomes especially useful for
modules which run multiple test functions, since those are executed on
the same named instances.
Register the rndc module in the isctest package and provide a
NamedInstance.rndc_client() factory next to rndc(), so tests can grab
a client for an instance's control channel without repeating the
address and port details.
Rework the Python RNDC client API around isctest conventions
Rename the class to RNDCClient and align its interface with the
existing isctest.run helpers so that the binary and the Python RNDC
interfaces feel the same:
- take separate ip/port arguments and accept commands as str
- default the HMAC algorithm and secret to the _common/rndc.key
values used by virtually all control channels in the system tests
- call() returns an RNDCResult mirroring CmdResult (rc/out/err) and
raises RNDCException on a non-zero result code, with the same
raise_on_exception escape hatch as isctest.run.cmd(); the decoded
protocol response stays available as RNDCResult.response
- support the context manager protocol and add close(); the socket
gets a timeout so a stuck server can't hang a test, and a failed
login closes the socket instead of leaking it
- use sendall() and an exact-read loop to avoid short reads/writes
(MSG_WAITALL is ineffective on a socket with a timeout, which
operates in non-blocking mode)
- raise RNDCProtocolError for truncated, malformed, or
unauthenticated responses instead of overloading OSError
- draw the initial message serial from the full 32-bit space like
the rndc binary, keeping the odds of tripping named's duplicate
message suppression negligible
Annotate the module for the mypy CI gate. The locals in _command()
that were reused for values of a different type are split so each name
keeps a single type.
Rename locals that shadow the hash, input, and type builtins and drop
the double-underscore name mangling from private members in favor of
the single-underscore style used across isctest.
Replace percent formatting of str with f-strings and the deprecated
IOError alias with OSError. The bytes interpolation in the protocol
serialization is left alone; f-strings have no bytes counterpart.
Use the standard license header in the imported rndc.py
Replace the upstream header with the SPDX-tagged header used across the
repository and drop the stale __version__ marker, which has no meaning
for an in-tree copy. The module provenance is recorded in the import
commit.
Import rndc.py from the python-rndc project verbatim
Bring in the pure-Python RNDC protocol client as-is, with no
modifications, so that subsequent cleanup and integration changes can
be reviewed against the pristine upstream source.
Source: python-rndc rndc.py (version 0.2.0)
Co-authored-by: Matthew Pounsett <matt@conundrum.com> Assisted-by: Claude:claude-fable-5
chg: test: Deduplicate controls configuration in named.conf test templates
The named.conf.j2 files in system tests had a copy-pasted snippets for control channel configuration. These were replaced with the `_common/controls.conf.j2` template.
The control channel was turned on for all named test instances.
Merge branch 'nicki/pytest-named-conf-controls' into 'main'
The logfileconfig configs used to define an unquoted hyphenated
`key rndc-key` referenced as `keys { "rndc-key"; }`, incidentally
covering quoted/unquoted key-name interchangeability. Now that those
configs use the shared controls include, keep that parser coverage in
a checkconf test.
Mark the configs that deliberately keep a custom controls config
Every remaining deviation from the shared _common/controls.conf.j2
include is intentional; annotate each with a one-line grep-able
comment stating why:
- rndc/ns2 and ns5 test multi-key and read-only channels; ns4 gets a
runtime-generated multi-key channel appended by setup.sh;
- resolver/ns9 runs an IPv6-only channel, which the IPv4-only shared
template cannot express;
- shutdown/resolver lives in a non-ns<N> directory, so the template's
ns.ip variable is not injected there.
Provide a control channel on named instances that had none
Insert _common/controls.conf.j2 right after the options block in every
started named instance config that declared no control channel at all.
This ensure that each named instance exposes its control channel for the
tests.
Note that some configs may include the control channel via a named.conf
include mechanism. Those are left as is, since the control channel is
already configured via that include mechanism -- and those configs
aren't part of this commit at all.
Use controls template in named configs where rndc key was inlined
Replace all occurences of rndc_key and controls channel config with the
standard _common/controls.conf.j2 template.
The server's IP address will be automatically filled in based on the
instance's directory name (nsX -> 10.53.0.X) using the @ns.ip@
dir-specific template variable.
The controls template also include the `rndc_key`, so any uses of that
remain functional.
If present, the empty controls section were removed, since they were
redundant.
The logfileconfig configs used quoted `"rndc-key"` and were switched to
`rndc_key` instead. The specific use-case of quoted key using a hyphen
will be re-added in one of the followup commits as a dedicated test.
Fix controls statements bound to another instance's address
Some of the system test named configs had a mismatched control channel
IP address. As there is no evidence this was intentional (no uses of the
control channel), it was most likely introduced as a copy-paste bug. Fix
the control channel IP to match the instance number.
fix: nil: Don't use wildcard keys in update-policy in ddns-confgen
In `ddns-confgen`, if the requested key name is a wildcard, don't generate
an `update-policy` statement, since using a wildcard as an SSU identity
allows other keys that match the wildcard to update records.
Closes #6235
Merge branch '6235-wildcard-ddns-confgen' into 'main'
Don't use wildcard keys in update-policy in ddns-confgen
In ddns-confgen, if the requested key name is a wildcard, don't generate
an update-policy statement, since using a wildcard as an SSU identity
allows other keys that match the wildcard to update records.
Michał Kępień [Wed, 22 Jul 2026 13:24:02 +0000 (15:24 +0200)]
chg: ci: Revert "allow_failure: true" for the "cross-version-config-tests" job
With the `v9.21.24` release tag now merged back into `main`, revert the
`allow_failure: true` change introduced in !12264 as the
`cross-version-config-tests` job is no longer expected to fail.
Merge branch 'michal/revert-allow_failure-true-for-cross-version-config-tests' into 'main'
Ondřej Surý [Wed, 26 Jan 2022 11:08:10 +0000 (12:08 +0100)]
Add more validity checks to the isc_time API
This commits backport few things from the 64-bit time branch:
* Add ISC_VALID_TIME() and ISC_VALID_INTERVAL() macros that checks
the valid range for nanoseconds
* Add more specific buffer sizes for formatting the dates and require
the buffers passed to the formatting functions to be at least that
big.
* When error happens when formatting the string, always return a valid
buffer with formatted mock datetime string instead of garbage.
Because the formatting functions doesn't return status, the caller
could print garbage (unterminated string).
fix: usr: Treat an unusable NSEC3 chain as a verification failure
When transferring in a mirror zone, DNSSEC verification could incorrectly succeed when the zone had an invalid `NSEC3PARAM` record, leading to subsequent validation failures. This has been fixed.
Closes #6136
Merge branch '6136-zoneverify-nsec3param' into 'main'
Treat unusable NSEC3PARAM as a verification failure
dns_zoneverify_dnssec() could previously return success if the
NSEC3PARAM record was unusable, but no other NSEC/NSEC3 chains were
available. This has been fixed.
Allow null nameserver for jinja2 test-zone templates
It is now possible to generate a zone file from a jinja2 template that
isn't written to a nameserver directory, but to "zones/" in the top
level of the system test directory, by specifying the server name
"NO_NS" instead of NS1, NS2, etc. This can be used for testing command
line tools such as dnssec-verify on generated zone files, without
starting an unnecessary name server.
Martin Basti [Tue, 21 Jul 2026 20:01:42 +0000 (20:01 +0000)]
fix: usr: dig +yaml producing invalid YAML when a lookup fails
When "dig +yaml" was run and no server could be reached, dig printed its plain-text startup banner (the "; \<\<\>\> DiG ..." and ";; global options" lines) ahead of the machine-readable output, so the result was not valid YAML and could not be parsed. dig no longer emits that banner in YAML mode. As part of the same change, the banner is now built only after the whole command line has been read, so options given after the query name (such as +nocmd, +short and +yaml) are correctly reflected in it.
Closes #1230
Merge branch '1230-dig-fix-error-comments' into 'main'
Martin Basti [Tue, 21 Jul 2026 13:49:00 +0000 (13:49 +0000)]
Test that +short does not leak the ";; " comments
Plain +short already turns lookup->comments off, so the regression it
guards against only surfaces with "+short +comments", where +comments
re-enables the comment toggle while short form is still in effect. The
existing silent-then-servfail scenario is reused because its retry path
reliably prints a "Got SERVFAIL reply from ..." comment; the +comments
case (without +short) is asserted first so the absence check is
meaningful.
Martin Basti [Wed, 15 Jul 2026 17:15:25 +0000 (19:15 +0200)]
Don't print dig's startup banner with +nocmd when the lookup fails
This only affects the failure path. On a successful lookup dig
reprints the banner and re-evaluates the final options as it does so,
so a late +nocmd is honored; but the "no servers could be reached"
error path prints the pre-built banner verbatim, without that
re-check, and that banner had been built too early to be correct.
printgreeting() was called the moment the first query name was seen,
so options appearing later on the command line (e.g. +[no]cmd, +short,
+yaml) were not yet in effect and the banner captured stale state.
That is why a failing "dig . soa @host +yaml" emitted the ";"-prefixed
banner ahead of the error, and why "+nocmd" placed after the query
name was ignored.
Martin Basti [Wed, 15 Jul 2026 16:58:39 +0000 (18:58 +0200)]
Suppress the dig startup banner in +yaml error output
The two "no servers could be reached" error paths printed the
lookup's startup banner (";"-prefixed "<<>> DiG ..." lines) ahead of
the "- type: DIG_ERROR" block. Those lines are not valid YAML, so
with +yaml the whole output failed to parse whenever every server was
unreachable. Guard the banner with the existing yaml flag, matching
how the successful path in printmessage() already gates it.
The isc_crypto_aead_open() and isc_crypto_aead_seal() functions
in ossl3.c didn't check if 'additional_data' exists before using
it. The checks were in place in the ossl1_1.c implementation. Use
the same conditions in the ossl3.c implementation too.
Additionally, the ciphertext length passed to the EVP_DecryptUpdate()
function included the tag length too which caused errors when decrypting.
Use the 'len' variable instead which doesn't include the tag length.
The ciphertext length passed to the EVP_DecryptUpdate() function
included the tag length too. Use the 'len' variable instead which
doesn't include the tag length.
The isc_crypto_aead_open() and isc_crypto_aead_seal() functions
in ossl3.c didn't check if 'additional_data' exists before using
it. The checks were in place in the ossl1_1.c implementation. Use
the same conditions in the ossl3.c implementation too.
The qpdb unit test intermittently aborts on the
`isc_mem_inuse(mctx) >= hiwater` assertion in the overmempurge tests
(#6267) and is not reliably reproducible. Extend the flaky-test retry
mechanism from tests/isc to tests/dns so CI re-runs qpdb before
declaring the job failed.
new: usr: Disclose active Negative Trust Anchors with Extended DNS Error 33
A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a domain,
so a name that would normally fail validation resolves instead. named now
marks such answers with Extended DNS Error code 33, "Negative Trust Anchor",
so operators can see at a glance when a response came back only because
an NTA was in effect.
Test Negative Trust Anchor disclosure via Extended DNS Error 33
Extend the EDE unit test to cover the newly registered code 33 and to
verify it does not collide with lower codes in the used-code bitmap.
Add a resolver system test: a name whose validation is suppressed by a
Negative Trust Anchor is answered with EDE 33 present, while the same
name without an NTA still fails validation and carries no such error.
Disclose Negative Trust Anchors with Extended DNS Error 33
A Negative Trust Anchor (RFC 7646) makes a validating resolver treat an
otherwise-secure name as insecure, but there was no in-band way for a
client to tell that an answer which should have failed DNSSEC validation
was returned because an NTA was in place.
Register Extended DNS Error INFO-CODE 33, "Negative Trust Anchor"
(draft-farrokhi-dnsop-ede-nta), and attach it to a response whenever a
covering NTA suppresses validation for the queried name.
fix: usr: Resolver could return expired records instead of a negative answer
When an unvalidated negative answer (such as one obtained for
a query with the "checking disabled" flag set) arrived for
a name that had DNSSEC-validated records in the cache, those
records blocked the negative answer from being cached even
after they had passed their TTL, and the expired records could
be returned to the client instead. Validated records that have
expired no longer prevent negative answers from being cached.
Merge branch '5877-skip-inactive-headers' into 'main'
Test that an expired RRset does not block negative caching
Cover the inverse of the CD=1 NXDOMAIN guard: a validated RRset that
has passed its TTL, but has not yet been cleaned from the cache, must
not block the unvalidated negative entry. Before the fix the CD=1
query failed with SERVFAIL until the expired header was reaped.
projects / thirdparty / bind9.git / log
