Michał Kępień [Mon, 25 May 2020 12:34:56 +0000 (14:34 +0200)]
Improve the "hint" variable comment
Replace an existing comment with a more verbose explanation of when the
"hint" variable is set in resquery_send() and how its value affects the
advertised UDP buffer size in outgoing queries.
Michał Kępień [Mon, 25 May 2020 12:34:56 +0000 (14:34 +0200)]
Ensure server-specific "edns-udp-size" is obeyed
If "edns-udp-size" is set in a "server" block matching the queried
server, it is accounted for in the process of determining the advertised
UDP buffer size, but its value may still be overridden before the query
is sent. This behavior contradicts the ARM which claims that when set,
the server-specific "edns-udp-size" value is used for all EDNS queries
sent to a given server.
Furthermore, calling dns_peer_getudpsize() with the "udpsize" variable
as an argument makes the code hard to follow as that call may either
update the value of "udpsize" or leave it untouched.
Ensure the code matches the documentation by moving the
dns_peer_getudpsize() call below all other blocks of code potentially
affecting the advertised UDP buffer size, which is where it was located
when server-specific "edns-udp-size" support was first implemented [1].
Improve code readability by calling dns_peer_getudpsize() with a helper
variable instead of "udpsize".
Michał Kępień [Mon, 25 May 2020 12:34:56 +0000 (14:34 +0200)]
Restore semantic meaning of DNS_FETCHOPT_EDNS512
When the DNS_FETCHOPT_EDNS512 flag was first introduced [1], it enforced
advertising a 512-byte UDP buffer size in an outgoing query. Ever since
EDNS processing code got updated [2], that flag has still been set upon
detection of certain query timeout patterns, but it has no longer been
affecting the calculations of the advertised UDP buffer size in outgoing
queries. Restore original semantic meaning of DNS_FETCHOPT_EDNS512 by
ensuring the advertised UDP buffer size is set to 512 bytes when that
flag is set. Update existing comments and add new ones to improve code
readability.
Michał Kępień [Mon, 25 May 2020 12:34:56 +0000 (14:34 +0200)]
Remove fctx->reason and a misleading log message
The following message:
success resolving '<name>' (in '<domain>'?) after reducing the advertised EDNS UDP packet size to 512 octets
can currently be logged even if the EDNS UDP buffer size advertised in
queries sent to a given server had already been set to 512 octets before
the fetch context was created (e.g. due to the server responding
intermittently). In other words, this log message may be misleading as
lowering the advertised EDNS UDP buffer size may not be the actual cause
of <name> being successfully resolved. Remove the log message in
question to prevent confusion.
As this log message is the only existing user of the "reason" field in
struct fetchctx, remove that field as well, along with all the code
related to it.
Michal Nowak [Fri, 3 Apr 2020 09:26:02 +0000 (11:26 +0200)]
Provide unit test driver
This adds a unit test driver for BIND with Automake. It runs the unit
test program provided as its sole command line argument and then looks
for a core dump generated by that test program. If one is found, the
driver prints the backtrace into the test log.
Michał Kępień [Thu, 21 May 2020 09:33:11 +0000 (11:33 +0200)]
Add py.test-3 to the list of tested pytest names
Some operating systems (e.g. CentOS, OpenBSD) install the main pytest
script as "py.test-3". Add that name to the list of names passed to
AC_PATH_PROGS() in order for pytest to be properly detected on a broader
range of operating systems.
Michał Kępień [Thu, 21 May 2020 09:33:11 +0000 (11:33 +0200)]
Do not use f-strings in Python system tests
Use str.format() instead of f-strings in Python system tests to enable
them to work on Python 3 versions older than 3.6 as the latter is not
available on some operating systems used in GitLab CI that are still
actively supported (CentOS 6, Debian 9, Ubuntu 16.04).
Michał Kępień [Thu, 21 May 2020 09:33:11 +0000 (11:33 +0200)]
Do not install doc build tools in GitLab CI jobs
As documentation building utilities are now all included in operating
system images used in GitLab CI, do not install them in each "docs" CI
job any more.
Michał Kępień [Thu, 21 May 2020 09:33:11 +0000 (11:33 +0200)]
Do not install Python packages in GitLab CI jobs
As Python QA tools, BIND system test prerequisites, and documentation
building utilities are now all included in operating system images used
in GitLab CI, do not use pip for installing them in each CI job any
more.
Michał Kępień [Thu, 21 May 2020 07:14:27 +0000 (09:14 +0200)]
Update release checklist
- First merge release branches to maintenance branches, then push
tags. If tags are pushed first and a given set of releases contains
security fixes, the push will be rejected by a server-side Git hook.
- Update ABI check job name.
- Add an item for updating QA tools used in GitLab CI after each
public release.
Witold Kręcicki [Tue, 19 May 2020 08:08:25 +0000 (10:08 +0200)]
Fix possible deadlock in unix/socket.c
In process_fd we lock sock->lock and then internal_accept locks mgr->lock,
in isc_sockmgr_render* functions we lock mgr->lock and then lock sock->lock,
that can cause a deadlock when accessing stats. Unlock sock->lock early in
all the internal_{send,recv,connect,accept} functions instead of late
in process_fd.
Stephen Morris [Thu, 5 Mar 2020 18:46:46 +0000 (18:46 +0000)]
Add test for reduction in number of fetches
Add a system test that counts how many address fetches are made
for different numbers of NS records and checks that the number
are successfully limited.
Mark Andrews [Thu, 6 Feb 2020 06:19:10 +0000 (17:19 +1100)]
Reduce the number of fetches we make when looking up addresses
If there are more that 5 NS record for a zone only perform a
maximum of 4 address lookups for all the name servers. This
limits the amount of remote lookup performed for server
addresses at each level for a given query.
Mark Andrews [Tue, 19 May 2020 00:09:51 +0000 (10:09 +1000)]
Address race in dnssec system test. 'clear signing records' can fail
as the update triggers by the rndc command to clear the signing records
may not have completed by the time the subsequent rndc command to test
that the records have been removed is commenced. Loop several times to
prevent false negative.
Apparently cppcheck 2.0 has issues with processing (&var)->field syntax,
which is what the macros from lib/isc/include/isc/buffer.h are evaluated
to. This issue was reported upstream [1] and will hopefully be
addressed in a future cppcheck release.
In the meantime, to avoid modifying BIND source code in multiple places
just because of a static checker false positive, work around the issue
by adding intermediate variables to buffer macro definitions using a sed
invocation in the cppcheck job script.
Michał Kępień [Mon, 18 May 2020 08:23:06 +0000 (10:23 +0200)]
Make GCC version extraction work with GCC 10
Add whitespace to the regular expression used for extracting the GCC
version from "gcc --version" output so that it works properly with
multi-digit major version numbers.
Michał Kępień [Mon, 18 May 2020 08:23:06 +0000 (10:23 +0200)]
Ensure cppcheck creates a HTML report upon failure
Commit ec72d1100d7e86c131ab1936f91ed4da87c48a4b broke the cppcheck job
in GitLab CI: when cppcheck fails, the script is immediately
interrupted, preventing cppcheck-htmlreport from being run. To ensure
the HTML report is generated when cppcheck fails, revert to invoking
cppcheck-htmlreport in the "after_script" part of the job.
Evan Hunt [Fri, 15 May 2020 20:10:36 +0000 (13:10 -0700)]
incidental fix: reduce a long timeout in dnstap test
the dnstap test was pausing for 20 seconds to search for a string in
named.run, which only appears if named is built with --enable-developer or
--enable-querytrace.
Evan Hunt [Fri, 15 May 2020 19:57:18 +0000 (12:57 -0700)]
move wire_test back to bin/tests, no longer dependent on dnstap
wire_test is not only used by the dnstap system test, but also in
fuzz testing. it doesn't need to be installed, but it's useful to have it
built when BIND is. this commit moves it back from bin/tests/system to
bin/tests, as a noinst_PROGRAM so that it's built by "make all" but
not installed.
Witold Kręcicki [Tue, 24 Mar 2020 12:38:51 +0000 (13:38 +0100)]
Redesigned TCP accepting: one listen/accept loop, passing the connected socket.
Instead of using bind() and passing the listening socket to the children
threads using uv_export/uv_import use one thread that does the accepting,
and then passes the connected socket using uv_export/uv_import to a random
worker. The previous solution had thundering herd problems (all workers
waking up on one connection and trying to accept()), this one avoids this
and is simpler.
The tcp clients quota is simplified with isc_quota_attach_cb - a callback
is issued when the quota is available.
Ondřej Surý [Tue, 12 May 2020 08:01:35 +0000 (10:01 +0200)]
Fail immediatelly when clean.sh or setup.sh fails
The `statschannel/ns2/` was missing `manykeys.db.in`, but the test
succeeded even when `setup.sh` (or `clean.sh`) failed to execute. This
commit makes run.sh to run in stricter mode and fail the test
immediately when `clean.sh` or `setup.sh` fails.
projects / thirdparty / bind9.git / log
