Michał Kępień [Fri, 1 Feb 2019 12:35:53 +0000 (13:35 +0100)]
Test "make install" in one of the build jobs
Running "make install" in a separate job in the "test" phase of a CI
pipeline causes a lot of object files to be rebuilt due to the way
artifacts are passed between GitLab CI jobs (object files extracted from
the artifacts archive have older modification times than their
respective source files checked out using Git by the worker running the
"install" job). Test "make install" in one of the build jobs instead,
in order to prevent object rebuilding.
Using 'after_script' for this purpose was not an option because its
failures are ignored.
Duplicating the build script in two places would be error-prone in the
long run and thus was rejected as a solution. YAML anchors would also
not help in this case.
A "positive" test (`test -n "${RUN_MAKE_INSTALL}" && make install`)
would not work because:
- it would cause the build script to fail for any job not supposed to
run "make install",
- appending `|| :` to the shell pipeline would prevent "make install"
errors from causing a job failure.
Due to the above, a "negative" test is performed, so that:
- jobs not supposed to run "make install" succeed immediately,
- jobs supposed to run "make install" only succeed when "make install"
succeeds.
Michał Kępień [Thu, 31 Jan 2019 14:43:58 +0000 (15:43 +0100)]
Add CHANGES entry
5153. [func] Zone transfer statistics (size, number of records, and
number of messages) are now logged for outgoing
transfers as well as incoming ones. [GL #513]
Michał Kępień [Thu, 31 Jan 2019 14:43:58 +0000 (15:43 +0100)]
Add system tests for IXFR statistics
Ensure IXFR statistics are calculated correctly by dig and named, both
for incoming and outgoing transfers. Disable EDNS when using dig to
request an IXFR so that the same reference file can be used for testing
statistics calculated by both dig and named (dig uses EDNS by default
when sending transfer requests, which affects the number of bytes
transferred).
Michał Kępień [Thu, 31 Jan 2019 14:43:58 +0000 (15:43 +0100)]
Add system tests for AXFR statistics
Ensure AXFR statistics are calculated correctly by dig and named, both
for incoming and outgoing transfers. Rather than employing a zone which
is already used in the "xfer" system test, create a new one whose AXFR
form spans multiple TCP messages. Disable EDNS when using dig to
request an AXFR so that the same reference file can be used for testing
statistics calculated by both dig and named (dig uses EDNS by default
when sending transfer requests, which affects the number of bytes
transferred).
Michał Kępień [Thu, 31 Jan 2019 14:43:58 +0000 (15:43 +0100)]
Maintain and report outgoing transfer statistics
Transfer statistics are currently only reported for incoming transfers,
even though they are equally useful for outgoing transfers. Define a
separate structure for keeping track of the number of messages, records,
and bytes sent during each outgoing transfer, along with the time each
outgoing transfer took. Repurpose the 'nmsg' field of the xfrout_ctx_t
structure for tracking the number of messages actually sent, ensuring it
is only increased after isc_socket_send() indicates success. Report the
statistics gathered when an outgoing transfer completes.
Michał Kępień [Thu, 31 Jan 2019 14:43:58 +0000 (15:43 +0100)]
Track QUESTION section presence using a boolean
The 'nmsg' field of the xfrout_ctx_t structure is an integer, even
though it is only ever compared against 0 (for tracking whether the
QUESTION section has already been sent to the client). Use a boolean
instead as it is more appropriate and also enables 'nmsg' to be
repurposed.
Evan Hunt [Sat, 15 Dec 2018 00:58:54 +0000 (16:58 -0800)]
silence a spurious dnssec-keygen warning in the dnssec system test
the occluded-key test creates both a KEY and a DNSKEY. the second
call to dnssec-keygen calls dns_dnssec_findmatchingkeys(), which causes
a spurious warning to be printed when it sees the type KEY record.
this should be fixed in dnssec.c, but the meantime this change silences
the warning by reversing the order in which the keys are created.
Evan Hunt [Wed, 30 Jan 2019 23:42:04 +0000 (15:42 -0800)]
Change #4148 wasn't complete
- there was a memory leak when using negotiated TSIG keys.
- TKEY responses could only be signed when using a newly negotiated
key; if an existent matching TSIG was found in in the keyring it
would not be used.
Evan Hunt [Mon, 21 Jan 2019 07:50:17 +0000 (23:50 -0800)]
Ancient named.conf options are now a fatal configuration error
- options that were flagged as obsolete or not implemented in 9.0.0
are now flagged as "ancient", and are a fatal error
- the ARM has been updated to remove these, along with other
obsolete descriptions of BIND 8 behavior
- the log message for obsolete options explicitly recommends removal
Matthijs Mekking [Thu, 24 Jan 2019 09:28:41 +0000 (10:28 +0100)]
Add tests for dumpdb stale ttl
This adds a test for rndc dumpdb to ensure the correct "stale
comment" is printed. It also adds a test for non-stale data to
ensure no "stale comment" is printed for active RRsets.
In addition, the serve-stale tests are hardened with more accurate
grep calls.
Matthijs Mekking [Thu, 24 Jan 2019 09:24:44 +0000 (10:24 +0100)]
Print in dump-file stale ttl
This change makes rndc dumpdb correctly print the "; stale" line.
It also provides extra information on how long this data may still
be served to clients (in other words how long the stale RRset may
still be used).
Evan Hunt [Tue, 29 Jan 2019 19:39:06 +0000 (11:39 -0800)]
allow TSIG key to be added to message structure after parsing
up until now, message->tsigkey could only be set during parsing
of the request, but gss-tsig allows one to be created afterward.
this commit adds a new flag to the message structure, `new_tsigkey`,
which indicates that in this case it's okay for `dns_message_settsigkey()`
to be run on a message after parsing, without hitting any assertions due
to the lack of a TSIG in the request. this allows us to keep the current
restriction in place generally, but add an exception for TKEY processing.
it's probably better to just remove the restriction entirely (see next
commit).
Matthijs Mekking [Tue, 29 Jan 2019 17:09:06 +0000 (18:09 +0100)]
Weak verification for signed TKEY response
The introduced grep call checks whether there was a
response that has an answer and an additional record.
There should be only one in the nsupdate output that is
for the TKEY response.
Matthijs Mekking [Tue, 29 Jan 2019 17:09:06 +0000 (18:09 +0100)]
Weak verification for signed TKEY response
The introduced grep call checks whether there was a
response that has an answer and an additional record.
There should be only one in the nsupdate output that is
for the TKEY response.
Evan Hunt [Sun, 20 Jan 2019 00:12:45 +0000 (16:12 -0800)]
added querytrace documentation in README
also:
- rearranged things a little, adding a "dependencies" section
- removed the documentation of 'enable-threads'. (this part of
the change should not be backported.)
Michał Kępień [Mon, 28 Jan 2019 12:37:39 +0000 (13:37 +0100)]
Update the list of supported platforms
- Change 5023 (present in BIND 9.13.3+) removed BIND's internal
implementation of the getifaddrs() function which was required for
iterating network interfaces on Solaris 10 as that system does not
support that function natively.
- As of January 2019, FreeBSD 10.x is neither supported upstream nor
regularly tested by ISC, so move it from the list of regularly tested
platforms to the "Best effort" section.
- Debian 10, OpenBSD 6.3, and Fedora 29 have been released and are now
tested regularly.
Witold Kręcicki [Thu, 24 Jan 2019 11:01:11 +0000 (12:01 +0100)]
- Make isc_quota use atomics instead of locks
- Use getters for isc_quota parameters, make fields private
- Fix a potential data race with recursion clients limits logging
projects / thirdparty / bind9.git / log
