In `ddns-confgen`, the user-supplied domain name to be updated was not properly escaped and put inside a double-quoted string when generating the example code fragment. This has been corrected.
Closes #6072
Merge branch '6072-ddns-confgen-self-domain-update-policy-injection' into 'main'
In ddns-confgen, the user-supplied domain name to be updated
was not properly escaped and put inside a double quoted string
when generating the example code fragment. This has been corrected.
Michal Nowak [Thu, 23 Jul 2026 16:24:10 +0000 (18:24 +0200)]
fix: dev: Restore arc4random() detection dropped in the v9.21.14 merge
Commit 4db9e5d90e2 ("Use arc4random for CSPRNG when available", part
of the CVE-2025-40780 fix) guarded the arc4random() code paths in
lib/isc/random.h and lib/isc/random.c with HAVE_ARC4RANDOM and added
the corresponding function check to meson.build. The manual conflict
resolution in merge c2a672bbaef ("Merge tag 'v9.21.14'") kept the code
changes but dropped the meson.build hunk, so HAVE_ARC4RANDOM was never
defined and platforms with arc4random() (macOS and the BSDs) silently
fell back to the internal ChaCha-based CSPRNG. Restore the check.
Assisted-by: Claude:claude-fable-5
Merge branch 'mnowak/restore-arc4random-meson-check' into 'main'
Michal Nowak [Thu, 23 Jul 2026 14:47:31 +0000 (16:47 +0200)]
Restore arc4random() detection dropped in the v9.21.14 merge
Commit 4db9e5d90e2 ("Use arc4random for CSPRNG when available", part
of the CVE-2025-40780 fix) guarded the arc4random() code paths in
lib/isc/random.h and lib/isc/random.c with HAVE_ARC4RANDOM and added
the corresponding function check to meson.build. The manual conflict
resolution in merge c2a672bbaef ("Merge tag 'v9.21.14'") kept the code
changes but dropped the meson.build hunk, so HAVE_ARC4RANDOM was never
defined and platforms with arc4random() (macOS and the BSDs) silently
fell back to the internal ChaCha-based CSPRNG. Restore the check.
Michal Nowak [Thu, 23 Jul 2026 12:24:19 +0000 (14:24 +0200)]
fix: ci: Make the scan-build CI job actually run the static analyzer
scan-build was a silent no-op: the native file pinned CC to a name ccc-analyzer never intercepts. Run meson and ninja under scan-build with --use-cc, drop the native file and LTO, and gate on all default checkers via --status-bugs.
Merge branch '6165-scan-build-actually-run-analyzer' into 'main'
Michal Nowak [Mon, 29 Jun 2026 12:41:03 +0000 (12:41 +0000)]
Silence scan-build leak false positive in isccc_cc_checkdup()
On success the symtab owns 'key' and frees it via symtab_undefine(), but
scan-build cannot see that ownership pass through the const key
parameter of isc_symtab_define() and reports a leak. free(key) under
__clang_analyzer__ only, which placates the checker without affecting
real builds:
lib/isccc/cc.c:1015:9: warning: Potential leak of memory pointed to by 'key' [unix.Malloc]
Michal Nowak [Mon, 29 Jun 2026 11:41:20 +0000 (11:41 +0000)]
Assert rdataset precondition in query_addrrset()
rdataset is always non-NULL and is dereferenced unconditionally below.
Make the precondition explicit to silence a scan-build false positive:
lib/ns/query.c:2254:11: warning: Access to field 'type' results in a dereference of a null pointer (loaded from variable 'rdataset') [core.NullDereference]
Michal Nowak [Mon, 29 Jun 2026 11:41:09 +0000 (11:41 +0000)]
Assert fd validity in start_tcp_child()
load_balance_sockets is fixed at netmgr init, so dup(fd) runs only when
the caller supplied a valid descriptor. Assert it to silence a
scan-build false positive:
lib/isc/netmgr/tcp.c:468:15: warning: The 1st argument to 'dup' is -1 but should be >= 0 [unix.StdCLibraryFunctions]
Michal Nowak [Mon, 29 Jun 2026 11:40:50 +0000 (11:40 +0000)]
Assert fd validity in start_udp_child()
load_balance_sockets is fixed at netmgr init, so dup(fd) runs only when
the caller supplied a valid descriptor. Assert it to silence a
scan-build false positive:
lib/isc/netmgr/udp.c:194:15: warning: The 1st argument to 'dup' is -1 but should be >= 0 [unix.StdCLibraryFunctions]
Michal Nowak [Mon, 22 Jun 2026 19:24:33 +0000 (21:24 +0200)]
Remove dead stores reported by scan-build
The syncplugin test driver overwrote two dns_name_fromstring() results
without checking them; wrap the calls in CHECK():
bin/tests/system/hooks/driver/test-syncplugin.c:156:3: warning: Value stored to 'result' is never read [deadcode.DeadStores]
bin/tests/system/hooks/driver/test-syncplugin.c:158:3: warning: Value stored to 'result' is never read [deadcode.DeadStores]
Michal Nowak [Mon, 22 Jun 2026 16:25:16 +0000 (18:25 +0200)]
Run scan-build static analysis in CI
scan-build was a silent no-op: the native file pinned CC to a name
ccc-analyzer never intercepts. Run meson and ninja under scan-build
with --use-cc, drop the native file and LTO, and gate on all default
checkers via --status-bugs.
new: test: Mark each test's boundaries in the named instance logs
Use `rndc null` command to mark each test boundaries in named.run logs.
Since calling the `rndc` binary caused a lot of overhead, import the rndc python interface from [python-rndc](https://gitlab.isc.org/isc-projects/python-rndc/) and adapt it to our use-case.
Merge branch 'nicki/rndc-null-in-system-tests' into 'main'
Mark each test's boundaries in the named instance logs
Send an `rndc null` command with a test ID marker at the start and end
of each test function to all named instances.
This makes it easy to identify the precise point where each test was
executed when reading the named logs. This becomes especially useful for
modules which run multiple test functions, since those are executed on
the same named instances.
Register the rndc module in the isctest package and provide a
NamedInstance.rndc_client() factory next to rndc(), so tests can grab
a client for an instance's control channel without repeating the
address and port details.
Rework the Python RNDC client API around isctest conventions
Rename the class to RNDCClient and align its interface with the
existing isctest.run helpers so that the binary and the Python RNDC
interfaces feel the same:
- take separate ip/port arguments and accept commands as str
- default the HMAC algorithm and secret to the _common/rndc.key
values used by virtually all control channels in the system tests
- call() returns an RNDCResult mirroring CmdResult (rc/out/err) and
raises RNDCException on a non-zero result code, with the same
raise_on_exception escape hatch as isctest.run.cmd(); the decoded
protocol response stays available as RNDCResult.response
- support the context manager protocol and add close(); the socket
gets a timeout so a stuck server can't hang a test, and a failed
login closes the socket instead of leaking it
- use sendall() and an exact-read loop to avoid short reads/writes
(MSG_WAITALL is ineffective on a socket with a timeout, which
operates in non-blocking mode)
- raise RNDCProtocolError for truncated, malformed, or
unauthenticated responses instead of overloading OSError
- draw the initial message serial from the full 32-bit space like
the rndc binary, keeping the odds of tripping named's duplicate
message suppression negligible
Annotate the module for the mypy CI gate. The locals in _command()
that were reused for values of a different type are split so each name
keeps a single type.
Rename locals that shadow the hash, input, and type builtins and drop
the double-underscore name mangling from private members in favor of
the single-underscore style used across isctest.
Replace percent formatting of str with f-strings and the deprecated
IOError alias with OSError. The bytes interpolation in the protocol
serialization is left alone; f-strings have no bytes counterpart.
Use the standard license header in the imported rndc.py
Replace the upstream header with the SPDX-tagged header used across the
repository and drop the stale __version__ marker, which has no meaning
for an in-tree copy. The module provenance is recorded in the import
commit.
Import rndc.py from the python-rndc project verbatim
Bring in the pure-Python RNDC protocol client as-is, with no
modifications, so that subsequent cleanup and integration changes can
be reviewed against the pristine upstream source.
Source: python-rndc rndc.py (version 0.2.0)
Co-authored-by: Matthew Pounsett <matt@conundrum.com> Assisted-by: Claude:claude-fable-5
chg: test: Deduplicate controls configuration in named.conf test templates
The named.conf.j2 files in system tests had a copy-pasted snippets for control channel configuration. These were replaced with the `_common/controls.conf.j2` template.
The control channel was turned on for all named test instances.
Merge branch 'nicki/pytest-named-conf-controls' into 'main'
The logfileconfig configs used to define an unquoted hyphenated
`key rndc-key` referenced as `keys { "rndc-key"; }`, incidentally
covering quoted/unquoted key-name interchangeability. Now that those
configs use the shared controls include, keep that parser coverage in
a checkconf test.
Mark the configs that deliberately keep a custom controls config
Every remaining deviation from the shared _common/controls.conf.j2
include is intentional; annotate each with a one-line grep-able
comment stating why:
- rndc/ns2 and ns5 test multi-key and read-only channels; ns4 gets a
runtime-generated multi-key channel appended by setup.sh;
- resolver/ns9 runs an IPv6-only channel, which the IPv4-only shared
template cannot express;
- shutdown/resolver lives in a non-ns<N> directory, so the template's
ns.ip variable is not injected there.
Provide a control channel on named instances that had none
Insert _common/controls.conf.j2 right after the options block in every
started named instance config that declared no control channel at all.
This ensure that each named instance exposes its control channel for the
tests.
Note that some configs may include the control channel via a named.conf
include mechanism. Those are left as is, since the control channel is
already configured via that include mechanism -- and those configs
aren't part of this commit at all.
Use controls template in named configs where rndc key was inlined
Replace all occurences of rndc_key and controls channel config with the
standard _common/controls.conf.j2 template.
The server's IP address will be automatically filled in based on the
instance's directory name (nsX -> 10.53.0.X) using the @ns.ip@
dir-specific template variable.
The controls template also include the `rndc_key`, so any uses of that
remain functional.
If present, the empty controls section were removed, since they were
redundant.
The logfileconfig configs used quoted `"rndc-key"` and were switched to
`rndc_key` instead. The specific use-case of quoted key using a hyphen
will be re-added in one of the followup commits as a dedicated test.
Fix controls statements bound to another instance's address
Some of the system test named configs had a mismatched control channel
IP address. As there is no evidence this was intentional (no uses of the
control channel), it was most likely introduced as a copy-paste bug. Fix
the control channel IP to match the instance number.
fix: nil: Don't use wildcard keys in update-policy in ddns-confgen
In `ddns-confgen`, if the requested key name is a wildcard, don't generate
an `update-policy` statement, since using a wildcard as an SSU identity
allows other keys that match the wildcard to update records.
Closes #6235
Merge branch '6235-wildcard-ddns-confgen' into 'main'
Don't use wildcard keys in update-policy in ddns-confgen
In ddns-confgen, if the requested key name is a wildcard, don't generate
an update-policy statement, since using a wildcard as an SSU identity
allows other keys that match the wildcard to update records.
Michał Kępień [Wed, 22 Jul 2026 13:24:02 +0000 (15:24 +0200)]
chg: ci: Revert "allow_failure: true" for the "cross-version-config-tests" job
With the `v9.21.24` release tag now merged back into `main`, revert the
`allow_failure: true` change introduced in !12264 as the
`cross-version-config-tests` job is no longer expected to fail.
Merge branch 'michal/revert-allow_failure-true-for-cross-version-config-tests' into 'main'
Ondřej Surý [Wed, 26 Jan 2022 11:08:10 +0000 (12:08 +0100)]
Add more validity checks to the isc_time API
This commits backport few things from the 64-bit time branch:
* Add ISC_VALID_TIME() and ISC_VALID_INTERVAL() macros that checks
the valid range for nanoseconds
* Add more specific buffer sizes for formatting the dates and require
the buffers passed to the formatting functions to be at least that
big.
* When error happens when formatting the string, always return a valid
buffer with formatted mock datetime string instead of garbage.
Because the formatting functions doesn't return status, the caller
could print garbage (unterminated string).
fix: usr: Treat an unusable NSEC3 chain as a verification failure
When transferring in a mirror zone, DNSSEC verification could incorrectly succeed when the zone had an invalid `NSEC3PARAM` record, leading to subsequent validation failures. This has been fixed.
Closes #6136
Merge branch '6136-zoneverify-nsec3param' into 'main'
Treat unusable NSEC3PARAM as a verification failure
dns_zoneverify_dnssec() could previously return success if the
NSEC3PARAM record was unusable, but no other NSEC/NSEC3 chains were
available. This has been fixed.
Allow null nameserver for jinja2 test-zone templates
It is now possible to generate a zone file from a jinja2 template that
isn't written to a nameserver directory, but to "zones/" in the top
level of the system test directory, by specifying the server name
"NO_NS" instead of NS1, NS2, etc. This can be used for testing command
line tools such as dnssec-verify on generated zone files, without
starting an unnecessary name server.
Martin Basti [Tue, 21 Jul 2026 20:01:42 +0000 (20:01 +0000)]
fix: usr: dig +yaml producing invalid YAML when a lookup fails
When "dig +yaml" was run and no server could be reached, dig printed its plain-text startup banner (the "; \<\<\>\> DiG ..." and ";; global options" lines) ahead of the machine-readable output, so the result was not valid YAML and could not be parsed. dig no longer emits that banner in YAML mode. As part of the same change, the banner is now built only after the whole command line has been read, so options given after the query name (such as +nocmd, +short and +yaml) are correctly reflected in it.
Closes #1230
Merge branch '1230-dig-fix-error-comments' into 'main'
Martin Basti [Tue, 21 Jul 2026 13:49:00 +0000 (13:49 +0000)]
Test that +short does not leak the ";; " comments
Plain +short already turns lookup->comments off, so the regression it
guards against only surfaces with "+short +comments", where +comments
re-enables the comment toggle while short form is still in effect. The
existing silent-then-servfail scenario is reused because its retry path
reliably prints a "Got SERVFAIL reply from ..." comment; the +comments
case (without +short) is asserted first so the absence check is
meaningful.
Martin Basti [Wed, 15 Jul 2026 17:15:25 +0000 (19:15 +0200)]
Don't print dig's startup banner with +nocmd when the lookup fails
This only affects the failure path. On a successful lookup dig
reprints the banner and re-evaluates the final options as it does so,
so a late +nocmd is honored; but the "no servers could be reached"
error path prints the pre-built banner verbatim, without that
re-check, and that banner had been built too early to be correct.
printgreeting() was called the moment the first query name was seen,
so options appearing later on the command line (e.g. +[no]cmd, +short,
+yaml) were not yet in effect and the banner captured stale state.
That is why a failing "dig . soa @host +yaml" emitted the ";"-prefixed
banner ahead of the error, and why "+nocmd" placed after the query
name was ignored.
Martin Basti [Wed, 15 Jul 2026 16:58:39 +0000 (18:58 +0200)]
Suppress the dig startup banner in +yaml error output
The two "no servers could be reached" error paths printed the
lookup's startup banner (";"-prefixed "<<>> DiG ..." lines) ahead of
the "- type: DIG_ERROR" block. Those lines are not valid YAML, so
with +yaml the whole output failed to parse whenever every server was
unreachable. Guard the banner with the existing yaml flag, matching
how the successful path in printmessage() already gates it.
The isc_crypto_aead_open() and isc_crypto_aead_seal() functions
in ossl3.c didn't check if 'additional_data' exists before using
it. The checks were in place in the ossl1_1.c implementation. Use
the same conditions in the ossl3.c implementation too.
Additionally, the ciphertext length passed to the EVP_DecryptUpdate()
function included the tag length too which caused errors when decrypting.
Use the 'len' variable instead which doesn't include the tag length.
The ciphertext length passed to the EVP_DecryptUpdate() function
included the tag length too. Use the 'len' variable instead which
doesn't include the tag length.
The isc_crypto_aead_open() and isc_crypto_aead_seal() functions
in ossl3.c didn't check if 'additional_data' exists before using
it. The checks were in place in the ossl1_1.c implementation. Use
the same conditions in the ossl3.c implementation too.
The qpdb unit test intermittently aborts on the
`isc_mem_inuse(mctx) >= hiwater` assertion in the overmempurge tests
(#6267) and is not reliably reproducible. Extend the flaky-test retry
mechanism from tests/isc to tests/dns so CI re-runs qpdb before
declaring the job failed.
new: usr: Disclose active Negative Trust Anchors with Extended DNS Error 33
A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a domain,
so a name that would normally fail validation resolves instead. named now
marks such answers with Extended DNS Error code 33, "Negative Trust Anchor",
so operators can see at a glance when a response came back only because
an NTA was in effect.
Test Negative Trust Anchor disclosure via Extended DNS Error 33
Extend the EDE unit test to cover the newly registered code 33 and to
verify it does not collide with lower codes in the used-code bitmap.
Add a resolver system test: a name whose validation is suppressed by a
Negative Trust Anchor is answered with EDE 33 present, while the same
name without an NTA still fails validation and carries no such error.
Disclose Negative Trust Anchors with Extended DNS Error 33
A Negative Trust Anchor (RFC 7646) makes a validating resolver treat an
otherwise-secure name as insecure, but there was no in-band way for a
client to tell that an answer which should have failed DNSSEC validation
was returned because an NTA was in place.
Register Extended DNS Error INFO-CODE 33, "Negative Trust Anchor"
(draft-farrokhi-dnsop-ede-nta), and attach it to a response whenever a
covering NTA suppresses validation for the queried name.
fix: usr: Resolver could return expired records instead of a negative answer
When an unvalidated negative answer (such as one obtained for
a query with the "checking disabled" flag set) arrived for
a name that had DNSSEC-validated records in the cache, those
records blocked the negative answer from being cached even
after they had passed their TTL, and the expired records could
be returned to the client instead. Validated records that have
expired no longer prevent negative answers from being cached.
Merge branch '5877-skip-inactive-headers' into 'main'
Test that an expired RRset does not block negative caching
Cover the inverse of the CD=1 NXDOMAIN guard: a validated RRset that
has passed its TTL, but has not yet been cleaned from the cache, must
not block the unvalidated negative entry. Before the fix the CD=1
query failed with SERVFAIL until the expired header was reaped.
Only active secure data should block negative cache entries
Expired secure headers linger in the node's header list until they
are reaped, so the secure-data check could match a header already
past its TTL, reject the new negative entry, and hand the expired
data back to the caller. Require the matching header to be active.
The authdb variable is used either to check that, on restarts, we
do not cross to a different zone unless recursion is enabled, and to
lookup the zone version when filling the additional section.
Neither use requires the pointer to be attached, and attaching the
pointer causes scalability issues. This commit solves the problem by
turning the pointer into an integer id.
Merge branch 'alessio/authdb-version-lookup' into 'main'
Previously query_validatezonedb would not save the current version of
mirror zones, which would cause the mirror zone not to be found when
non-glue additional data.
We fix this by storing the mirror zone version in the client, and
deferring the acl check in query_validatezonedb.
Returning isc_result_t is more idiomatic. Also, there was some shared
code between ns_client_findversionid and ns_client_findversion that
has now been extracted into an helper function.
The authdb variable is used either to check that, on restarts, we
do not cross to a different zone unless recursion is enabled, and to
lookup the zone version when filling the additional section.
Neither use requires the pointer to be attached, and attaching the
pointer causes scalability issues. This commit solves the problem by
turning the pointer into an integer id.
Mark Andrews [Thu, 16 Jul 2026 20:07:48 +0000 (06:07 +1000)]
fix: usr: Unterminated OpenSSL private-key `Label:` field can be read past its parser buffer
Check that the string encoded in the Label: field of the .private
file of a key pair is NUL terminated and the correct length. Reject
the .private file if it is not.
Closes #6193
Merge branch '6193-check-that-label-is-nul-terminated' into 'main'
Mark Andrews [Wed, 8 Jul 2026 01:18:44 +0000 (11:18 +1000)]
Malformed Label: data in .private files was not detected
Check that the string encoded in the Label: field of the .private
file of a key pair is NUL terminated and the correct length. Reject
the .private file if it is not.
Mark Andrews [Wed, 15 Jul 2026 23:36:30 +0000 (09:36 +1000)]
fix: nil: Extend meson.build to support python 3.13 and 3.14
The later releases of python are not supported by meson.build
requiring the built environment to maintain / install older
versions of python to be able build and test.
Merge branch 'marka-support-python-3.14' into 'main'
When adding a new key into a full list, the newly inserted key
could be evicted just after the insertion if all the existing
keys were marked as visited. This has been fixed.
Closes #6263
Merge branch '6263-tkey-quota-bug-fix' into 'main'
When adding a new key to the SIEVE list, make the eviction decision
first, and then add the new key, so that it doesn't get evicted
immediately after insertion.
The new check creates more TSIG keys than the maximum allowed number,
and expectes that all the newly created keys are findable just after
they were created. I.e., when full, the newly created key should not
evicted.
fix: test: Increase timeout for zone update in multisigner test
In slower platforms in CI (e.g. freebsd14), the 10s timeout could be too
short causing the test to fail. Increase it to make the test stable even
during heavy CI load.
Increase timeout for zone update in multisigner test
In slower platforms in CI (e.g. freebsd14), the 10s timeout could be too
short causing the test to fail. Increase it to make the test stable even
during heavy CI load.
fix: test: Extend the check_dnssec_verify retry window to 60 seconds
A fixed ten-iteration poll could be too short for a freshly signed
zone to become fully valid on a heavily loaded host, occasionally
yielding a spurious "zone not verified".
Bump the budget to a 60-second window and, in the process, replace the
hand-rolled retry loop with the standard isctest.run.retry_with_timeout
helper already used by check_next_key_event.
---
Example of the failure: https://gitlab.isc.org/isc-private/bind9/-/jobs/7773885
Merge branch 'nicki/widen-dnssec-verify-timeout' into 'main'
Extend the check_dnssec_verify retry window to 60 seconds
A fixed ten-iteration poll could be too short for a freshly signed
zone to become fully valid on a heavily loaded host, occasionally
yielding a spurious "zone not verified".
Bump the budget to a 60-second window and, in the process, replace the
hand-rolled retry loop with the standard isctest.run.retry_with_timeout
helper already used by check_next_key_event.
Catalog zones might need to inspect the change-of-ownership records
of other catalog zones, which required to release the lock in the
middle of certain operations, leading to possible race conditions.
Since the operations on change-of-ownership records are limited, we
can instead use a design with a second lock protecting the
change-of-ownership records on read. We structure the API so that
holding two change-of-ownership locks at the same time is impossible.
Closes #6131
Merge branch '6131-catz-dns__catz_zones_merge-uaf-fix-v2' into 'main'
Alessio Podda [Wed, 10 Jun 2026 13:24:06 +0000 (15:24 +0200)]
Split lock coos check design
Catalog zones might need to inspect the change-of-ownership records
of other catalog zones, which required to release the lock in the
middle of certain operations, leading to possible race conditions.
Since the operations on change-of-ownership records are limited, we
can instead use a design with a second lock protecting the
change-of-ownership records on read. We structure the API so that
holding two change-of-ownership locks at the same time is impossible.
fix: dev: Use correct port and target for NOTIFY(CDS)
If there is a DSYNC RRset with multiple records, and unsupported scheme/type records follow supported ones, the port and target of the last record were being used to queue the notify. This does not necessarily match the port and target of the supported record. This has been fixed.
Closes #6080
Merge branch '6080-dsync-mismatch-queue' into 'main'
Only save the DSYNC target and port when a record matches CDS NOTIFY,
then after scanning the complete RRset require count == 1 before using
the stored values.
Current system tests cover a mixed RRset in but the unsupported and
supported records use the same target and port, so the test does not
catch that the wrong port and target are being used for the supported
type.
Change the test such that the supported DSYNC record is followed
by the unsupported ones, and use different port and target for
supported and unsupported DSYNC records.
Mark Andrews [Tue, 14 Jul 2026 23:08:44 +0000 (09:08 +1000)]
fix: test: test-syncplugin treats firstlbl as a prefix, not an exact label
The label length and the string length where not being checked so
a label that started with a string that matched the skip label would
incorrectly match.
Closes #6212
Merge branch '6212-fix-syncplugin-test-driver' into 'main'
Mark Andrews [Wed, 8 Jul 2026 02:08:38 +0000 (12:08 +1000)]
Properly check test-syncplugin skip label for equality
The label length and the string length where not being checked so
a label that started with a string that matched the skip label would
incorrectly match.
Mark Andrews [Thu, 9 Jul 2026 04:47:28 +0000 (14:47 +1000)]
cdnxdomain test is failing on some platforms
Ensure the modification time is newer (second granuality) when the
zone file is rewritten as named uses the file modification time to
determine if it needs to reload a file.
projects / thirdparty / bind9.git / log
