Arаm Sаrgsyаn [Mon, 26 Aug 2024 15:50:50 +0000 (15:50 +0000)]
chg: usr: Exempt prefetches from the fetches-per-zone and fetches-per-server quotas
Fetches generated automatically as a result of 'prefetch' are now
exempt from the 'fetches-per-zone' and 'fetches-per-server' quotas.
This should help in maintaining the cache from which query responses
can be given.
Closes #4219
Merge branch '4219-exempt-good-queries-from-fetch-limits' into 'main'
Aram Sargsyan [Fri, 7 Jun 2024 16:24:00 +0000 (16:24 +0000)]
Exempt prefetches from the fetches-per-server quota
Give prefetches a free pass through the quota so that the cache
entries for popular zones could be updated successfully even if the
quota for is already reached.
Aram Sargsyan [Fri, 7 Jun 2024 16:19:40 +0000 (16:19 +0000)]
Exempt prefetches from the fetches-per-zone quota
Give prefetches a free pass through the quota so that the cache entry
for a popular zone could be updated successfully even if the quota for
it is already reached.
Ondřej Surý [Mon, 26 Aug 2024 15:01:03 +0000 (15:01 +0000)]
fix: dev: Stop using malloc_usable_size and malloc_size
The `malloc_usable_size()` can return size larger than originally allocated and when these sizes disagree the fortifier enabled by `_FORTIFY_SOURCE=3` detects overflow and stops the `named` execution abruptly. Stop using these convenience functions as they are primary used for introspection-only.
Closes #4880
Merge branch '4880-dont-use-malloc_usable_size' into 'main'
Ondřej Surý [Fri, 23 Aug 2024 04:02:00 +0000 (06:02 +0200)]
Stop using malloc_usable_size and malloc_size
Although the nanual page of malloc_usable_size says:
Although the excess bytes can be over‐written by the application
without ill effects, this is not good programming practice: the
number of excess bytes in an allocation depends on the underlying
implementation.
it looks like the premise is broken with _FORTIFY_SOURCE=3 on newer
systems and it might return a value that causes program to stop with
"buffer overflow" detected from the _FORTIFY_SOURCE. As we do have own
implementation that tracks the allocation size that we can use to track
the allocation size, we can stop relying on this introspection function.
Also the newer manual page for malloc_usable_size changed the NOTES to:
The value returned by malloc_usable_size() may be greater than the
requested size of the allocation because of various internal
implementation details, none of which the programmer should rely on.
This function is intended to only be used for diagnostics and
statistics; writing to the excess memory without first calling
realloc(3) to resize the allocation is not supported. The returned
value is only valid at the time of the call.
Remove usage of both malloc_usable_size() and malloc_size() to be on the
safe size and only use the internal size tracking mechanism when
jemalloc is not available.
Michal Nowak [Mon, 26 Aug 2024 14:28:47 +0000 (14:28 +0000)]
chg: ci: Drop removed system tests from cross-version-config-tests
The cross-version-config-tests job fails when a system test is removed
from the upcoming release. To avoid this, remove the system test also
from the $BIND_BASELINE_VERSION.
See the failure mode at https://gitlab.isc.org/isc-projects/bind9/-/jobs/4668947.
Merge branch 'mnowak/remove-dialup-from-cross-version-config-tests-job' into 'main'
Michal Nowak [Mon, 26 Aug 2024 11:41:47 +0000 (13:41 +0200)]
Drop removed system tests from $BIND_BASELINE_VERSION
The cross-version-config-tests job fails when a system test is removed
from the upcoming release. To avoid this, remove the system test also
from the $BIND_BASELINE_VERSION.
James Addison [Sun, 25 Feb 2024 21:10:36 +0000 (21:10 +0000)]
Preserve de-duplicated tag order in documentation
The 'set' datatype in Python does not provide iteration-order
guarantees related to insertion-order. That means that its
usage in the 'split_csv' helper function during documentation
build can produce nondeterministic results.
That is non-desirable for two reasons: it means that the
documentation output may appear to vary unnecessarily between
builds, and secondly there could be loss-of-information in cases
where tag order in the source documentation is significant.
This patch implements order-preserving de-duplication of tags,
allowing authors to specify tags using intentional priority
ordering, while also removing tags that appear more than once.
Petr Špaček [Mon, 5 Aug 2024 08:48:34 +0000 (10:48 +0200)]
Automatically adjust MR metadata after merge
1. Set milestone to 'Not released yet' after merge
We will set milestone to actual version number when we actually tag a
particular version. This will get rid of mass MR reassignment when we
do last minute changes to a release plan etc.
2. Adjust No CHANGES and Release Notes MR labels to match gitchangelog
workflow.
Petr Špaček [Mon, 5 Aug 2024 08:21:46 +0000 (10:21 +0200)]
Mark backports CI job as non-interruptible
Previously CI job for the autobackport bot inherited "interruptible:
true" global configuration. This caused premature termination of the job
when another merge was finished before the autobackport job ran to
completion.
Arаm Sаrgsyаn [Thu, 22 Aug 2024 15:33:17 +0000 (15:33 +0000)]
new: usr: implement the 'request-ixfr-max-diffs' configuration option
The new 'request-ixfr-max-diffs' configuration option sets the
maximum number of incoming incremental zone transfer (IXFR) differences,
exceeding which triggers a full zone transfer (AXFR).
Closes #4389
Merge branch '4389-request-ixfr-max-diffs' into 'main'
Aram Sargsyan [Fri, 7 Jun 2024 14:49:59 +0000 (14:49 +0000)]
Test the 'request-ixfr-max-diffs' configuration option
Configure a maximum of 3 allowed differences and add 5 new records.
Check that named detected that the differences exceed the allowed
limit and successfully retries with AXFR.
Aram Sargsyan [Fri, 7 Jun 2024 14:47:55 +0000 (14:47 +0000)]
Implement the 'request-ixfr-max-diffs' configuration option
This limits the maximum number of received incremental zone
transfer differences for a secondary server. Upon reaching the
confgiured limit, the secondary aborts IXFR and initiates a full
zone transfer (AXFR).
Mark Andrews [Thu, 22 Aug 2024 12:55:46 +0000 (12:55 +0000)]
new: usr: Support restricted key tag range when generating new keys
It is useful when multiple signers are being used
to sign a zone to able to specify a restricted
range of range of key tags that will be used by an
operator to sign the zone. This adds controls to
named (dnssec-policy), dnssec-signzone, dnssec-keyfromlabel and
dnssec-ksr (dnssec-policy) to specify such ranges.
Closes #4830
Merge branch '4830-support-restricted-key-tag-range-when-generating-new-keys' into 'main'
Mark Andrews [Wed, 7 Aug 2024 05:47:05 +0000 (15:47 +1000)]
Document -M tag_min:tag_max
A new argument has been added to dnssec-keygen and dnssec-keyfromlabel
to restrict the tag value of key generated / imported to a particular
range. This is intended to be used by multi-signers.
Matthijs Mekking [Thu, 22 Aug 2024 10:11:29 +0000 (10:11 +0000)]
fix: usr: Fix algoritm rollover bug when there are two keys with the same keytag
If there is an algorithm rollover and two keys of different algorithm share the same keytags, then there is a possibility that if we check that a key matches a specific state, we are checking against the wrong key. This has been fixed by not only checking for matching key tag but also key algorithm.
Closes #4878
Merge branch '4878-fix-algorithm-rollover-keytag-conflict-bug' into 'main'
Matthijs Mekking [Wed, 21 Aug 2024 15:14:48 +0000 (17:14 +0200)]
Fix algorithm rollover bug wrt keytag conflicts
If there is an algorithm rollover and two keys of different algorithm
share the same keytags, then there is a possibility that if we check
that a key matches a specific state, we are checking against the wrong
key.
Fix this by not only checking for matching key id but also key
algorithm.
Matthijs Mekking [Thu, 22 Aug 2024 07:15:00 +0000 (07:15 +0000)]
new: usr: Support for Offline KSK implemented
Add a new configuration option `offline-ksk` to enable Offline KSK key management. Signed Key Response (SKR) files created with `dnssec-ksr` (or other program) can now be imported into `named` with the new `rndc skr -import` command. Rather than creating new DNSKEY, CDS and CDNSKEY records and generating signatures covering these types, these records are loaded from the currently active bundle from the imported SKR.
The implementation is loosely based on: https://www.iana.org/dnssec/archive/files/draft-icann-dnssec-keymgmt-01.txt
Closes #1128
Merge branch '1128-offline-ksk-rndc-import-skr' into 'main'
Matthijs Mekking [Wed, 19 Jun 2024 11:41:07 +0000 (13:41 +0200)]
Update key states in offline-ksk mode
With offline-ksk enabled, we don't run the keymgr because the key
timings are determined by the SKR. We do update the key states but
we derive them from the timing metadata.
Then, we can skip a other tasks in offline-ksk mode, like DS checking
at the parent and CDS synchronization, because the CDS and CDNSKEY
RRsets also come from the SKR.
Matthijs Mekking [Wed, 19 Jun 2024 09:09:29 +0000 (11:09 +0200)]
Add code to store SKR
This added source code stores SKR data. It is loosely based on:
https://www.iana.org/dnssec/archive/files/draft-icann-dnssec-keymgmt-01.txt
A SKR contains a list of signed DNSKEY RRsets. Each change in data
should be stored in a separate bundle. So if the RRSIG is refreshed that
means it is stored in the next bundle. Likewise, if there is a new ZSK
pre-published, it is in the next bundle.
In addition (not mentioned in the draft), each bundle may contain
signed CDS and CDNSKEY RRsets.
Each bundle has an inception time. These will determine when we need
to re-sign or re-key the zone.
Matthijs Mekking [Wed, 22 May 2024 09:19:20 +0000 (11:19 +0200)]
Test rndc skr import
Test importing a Signed Key Response. Files should be loaded and once
loaded the correct bundle should be used. Alsoe test cases where the
bundle is not the first bundle in the SKR.
Add the code and documentation required to provide KSR import using
rndc. This is just the command, and the feature is at this point in
time still not implemented.
Prepare the system test for tests that require a server to import
created SKR files. This means the test script needs adjustments to
take into account the directory test files are located.
In addition, the check_keys function is renamed to ksr_check_keys
because the name clashes with check_keys from kasp.sh. It also has an
extra parameter added, offset, that can be used to check ksr files that
are created in the past or future.
Matthijs Mekking [Fri, 22 Mar 2024 10:48:53 +0000 (11:48 +0100)]
Add offline-ksk option
Add a new configuration option to enable Offline KSK key management.
Offline KSK cannot work with CSK because it splits how keys with the
KSK and ZSK role operate. Therefore, one key cannot have both roles.
Add a configuration check to ensure this.
Ondřej Surý [Wed, 21 Aug 2024 11:56:10 +0000 (11:56 +0000)]
fix: usr: Fix rare assertion failure when shutting down incoming transfer
A very rare assertion failure can be triggered when the incoming transfer is either forcefully shut down or it is finished during printing the details about the statistics channel. This has been fixed.
Closes #4860
Merge branch '4860-destroy-xfrin-timers-on-the-loop' into 'main'
Ondřej Surý [Mon, 19 Aug 2024 08:14:19 +0000 (10:14 +0200)]
Destroy the dns_xfrin isc_timers on the correct loop
There are few places where we attach/detach from the dns_xfrin object
while running on a different thread than the zone's assigned thread -
xfrin_xmlrender() in the statschannel and dns_zone_stopxfr() to name the
two places where it happens now. In the rare case, when the incoming
transfer completes (or shuts down) in the brief period between the other
thread attaches and detaches from the dns_xfrin, the isc_timer_destroy()
calls would be called by the last thread calling the xfrin_detach().
In the worst case, it would be this other thread causing assertion
failure. Move the isc_timer_destroy() call to xfrin_end() function
which is always called on the right thread and to match this move
isc_timer_create() to xfrin_start() - although this other change makes
no difference.
Arаm Sаrgsyаn [Tue, 20 Aug 2024 17:30:26 +0000 (17:30 +0000)]
new: usr: Print the full path of the working directory in startup log messages
named now prints its initial working directory during startup and the
changed working directory when loading or reloading its configuration
file if it has a valid 'directory' option defined.
Closes #4731
Merge branch '4731-log-workdir-full-path' into 'main'
Aram Sargsyan [Tue, 20 Aug 2024 11:30:13 +0000 (11:30 +0000)]
Print the full path of the working directory in startup log messages
named now prints its initial working directory during startup and the
changed working directory when loading or reloading its configuration
file if it has a valid 'directory' option defined.
Ondřej Surý [Tue, 20 Aug 2024 14:58:39 +0000 (14:58 +0000)]
chg: dev: Use seteuid()/setegid() instead of setreseuid()/setresgid()
It looks like that all supported systems now have support for
_POSIX_SAVED_IDS, so it's safe to use setegid() and setegid() because
those will not change saved used/group IDs.
Closes #4862
Merge branch '4862-just-use-seteuid-and-setegid' into 'main'
Ondřej Surý [Tue, 20 Aug 2024 11:44:06 +0000 (13:44 +0200)]
Use seteuid()/setegid() instead of setreseuid()/setresgid()
It looks like that all supported systems now have support for
_POSIX_SAVED_IDS, so it's safe to use setegid() and setegid() because
those will not change saved used/group IDs.
Ondřej Surý [Tue, 20 Aug 2024 13:57:57 +0000 (13:57 +0000)]
fix: test: Allow TTL skew in the badcache print unit test
If the machine running the job is extra loaded (or extra slow), the
print test in the badcache unit test would fail because the TTL would be
59 (possibly even lower) and the test expects the badcache.out to only
have TTL 60. Refactor the test to check for the expected strings and
check whether the TTL is in the expected range.
Closes #4861
Merge branch '4861-allow-TTL-skew-in-badcache_test' into 'main'
Ondřej Surý [Mon, 19 Aug 2024 09:01:08 +0000 (11:01 +0200)]
Allow TTL skew in the badcache print unit test
If the machine running the job is extra loaded (or extra slow), the
print test in the badcache unit test would fail because the TTL would be
59 (possibly even lower) and the test expects the badcache.out to only
have TTL 60. Refactor the test to check for the expected strings and
check whether the TTL is in the expected range.
Ondřej Surý [Tue, 20 Aug 2024 12:56:04 +0000 (12:56 +0000)]
chg: dev: Use single logging context for everything
Instead of juggling different logging context, use one single logging
context that gets initialized in the libisc constructor and destroyed in
the libisc destructor.
Closes #4848
Merge branch '4848-refactor-isc_log-api-to-use-single-global-logging-context' into 'main'
Ondřej Surý [Wed, 14 Aug 2024 11:25:50 +0000 (13:25 +0200)]
Convert all categories and modules into static lists
Remove the complicated mechanism that could be (in theory) used by
external libraries to register new categories and modules with
statically defined lists in <isc/log.h>. This is similar to what we
have done for <isc/result.h> result codes. All the libraries are now
internal to BIND 9, so we don't need to provide a mechanism to register
extra categories and modules.
Ondřej Surý [Tue, 13 Aug 2024 15:16:57 +0000 (17:16 +0200)]
Remove isc_log_write1() and isc_log_vwrite1() functions
The isc_log_write1() and isc_log_vwrite1() functions were meant to
de-duplicate the messages sent to the isc_log subsystem. However, they
were never used in an entire code base and the whole mechanism around it
was complicated and very inefficient. Just remove those, there are
better ways to deduplicate syslog messages inside syslog daemons now.
Ondřej Surý [Tue, 13 Aug 2024 13:52:51 +0000 (15:52 +0200)]
Replace isc_log_create/destroy with isc_logconfig_get()
Add isc_logconfig_get() function to get the current logconfig and use
the getter to replace most of the little dancing around setting up
logging in the tools. Thus:
For thread-safety, isc_logconfig_get() should be surrounded by RCU read
lock, but since we never use isc_logconfig_get() in threaded context,
the only place where it is actually used (but not really needed) is
named_log_init().
Ondřej Surý [Tue, 13 Aug 2024 12:46:42 +0000 (14:46 +0200)]
Use single logging context for everything
Instead of juggling different logging context, use one single logging
context that gets initialized in the libisc constructor and destroyed in
the libisc destructor.
The application is still responsible for creating the logging
configuration before using the isc_log API.
This patch is first in the series in a way that it is transparent for
the users of the isc_log API as the isc_log_create() and
isc_log_destroy() are now thin shims that emulate the previous
functionality, but it isc_log_create() will always return internal
isc__lctx pointer and isc_log_destroy() will actually not destroy the
internal isc__lctx context.
Ondřej Surý [Tue, 20 Aug 2024 12:46:09 +0000 (12:46 +0000)]
fix: test: Ignore ISC_R_CONNECTIONRESET in the TCP tests
On FreeBSD, the TCP connection callback could spuriously receive
ISC_R_CONNECTIONRESET even when connection to the loopback interface.
Skip the other checks in such case and graciously shutdown the TCP
connection.
Closes #4849
Merge branch '4849-dispatch_test-fails-in-connected_shutdown-on-freebsd' into 'main'
Ondřej Surý [Wed, 14 Aug 2024 08:01:33 +0000 (10:01 +0200)]
Ignore ISC_R_CONNECTIONRESET in the TCP tests
On FreeBSD, the TCP connection callback could spuriously receive
ISC_R_CONNECTIONRESET even when connection to the loopback interface.
Skip the other checks in such case and graciously shutdown the TCP
connection.
Petr Špaček [Tue, 20 Aug 2024 12:36:36 +0000 (12:36 +0000)]
chg: Update Internal_use_only-CVE.md checklist changing some tasks
Update Internal_use_only-CVE.md checklist changing some tasks and responsibilities reflecting the new ASN process with RT vs SF. Support will now be sending ASNs to customers, although Marketing will announce the new releases (both publicly and to support customers).
Nicki Křížek [Tue, 13 Aug 2024 15:28:50 +0000 (17:28 +0200)]
Omit MR link from release notes
When manually handling the release notes (due to rst markup, fixups
etc.), the different MR number for backports causes needless friction.
Remove the reference from release notes and keep it only in changelog
which isn't manually redacted.
Nicki Křížek [Tue, 13 Aug 2024 15:20:54 +0000 (17:20 +0200)]
Sort changelog & relnotes entries by issue number
To reduce the friction when handling the release notes, it is preferable
to have the sections sorted by issue number, rather than merge order.
Fallback to commit subject line if unavailable (e.g. for changelog
entries).
Ondřej Surý [Tue, 20 Aug 2024 10:22:08 +0000 (10:22 +0000)]
fix: dev: Fix the resesuid() shim implementation for NetBSD
The shim implementation of setresuid() was wrong - there was a copy and
paste error and it was calling setresgid() instead. This only affects
NetBSD because Linux, FreeBSD and OpenBSD have setresuid() and
setresgid() implementation available from the system library.
Closes #4862
Merge branch '4862-fix-setresuid-shim' into 'main'
projects / thirdparty / bind9.git / log
