The resolver's fetch loop detection now triggers only when a new
fetch would join an already in-flight fetch that is also one of
its own ancestors, which is the actual loop condition. Previously
the check ran against the original request before the fetch was
set up.
Backport of MR !12145
Merge branch 'backport-ondrej/improve-resolver-loop-detection-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12146
dns_resolver_createfetch() guarded against fetch loops by comparing the
raw request name/type/domain before any fetch context existed. Move the
check after the context is obtained and run it against the context
itself, and only when we joined an already in-flight context
(!new_fctx) that is also an ancestor in the parent chain. That is the
real loop condition: the new fetch would block waiting on a fetch that
is itself waiting on us. A newly created context waits on nothing, so it
proceeds, bounded by the fetch depth limit and the complementary ADB
loop detection.
(cherry picked from commit 0e04671b65)
LoadScopeScheduling._split_scope() uses rsplit("::", 1) to
extract the test file scope from a node ID. When parametrized
test values contain "::" (IPv6 addresses like "cafe:cafe::cafe"
or "::1"), the split lands inside the parameter instead of at
the .py:: boundary. This creates spurious scopes that get
assigned to different workers, each triggering a full fixture
setup (starting named instances).
Override _split_scope() in conftest.py to split on ".py::"
which is unambiguous.
Six tests in synthrecord/tests_synthrecord.py are affected.
A verification script is included in util/.
Assisted-by: Claude:claude-opus-4-7
Backport of MR !12103
Merge branch 'backport-mnowak/fix-xdist-loadscope-split-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12137
LoadScopeScheduling._split_scope() uses rsplit("::", 1) to
extract the test file scope from a node ID. When parametrized
test values contain "::" (IPv6 addresses like "cafe:cafe::cafe"
or "::1"), the split lands inside the parameter instead of at
the .py:: boundary. This creates spurious scopes that get
assigned to different workers, each triggering a full fixture
setup (starting named instances).
Override _split_scope() in conftest.py to split on ".py::"
which is unambiguous.
Six tests in synthrecord/tests_synthrecord.py are affected.
A verification script is included in util/.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 4eb893020e)
Update PRIORITY_TESTS with the 10 longest-running test
scopes measured from CI (job 7468217). These get scheduled
first so that with --dist=loadscope they land on separate
workers instead of piling up at the end.
Also fix "serve-stale/" to "serve_stale/" to match the
actual directory name, and add a startup check that fails
if any PRIORITY_TESTS entry does not match an existing
directory.
Assisted-by: Claude:claude-opus-4-7
Backport of MR !12104
Merge branch 'backport-mnowak/prioritize-slow-system-tests-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12134
Update PRIORITY_TESTS with the 10 longest-running test
scopes measured from CI (job 7468217). These get scheduled
first so that with --dist=loadscope they land on separate
workers instead of piling up at the end.
Also fix "serve-stale/" to "serve_stale/" to match the
actual directory name, and add a startup check that fails
if any PRIORITY_TESTS entry does not match an existing
directory.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 5e3c0b8463)
The population of the compile cache is so slow, that a BIND 9 build can
take 20 minutes.
Assisted-by: Claude:claude-opus-4-7
Backport of MR !12127
Merge branch 'backport-mnowak/drop-ccache-support-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12128
The population of the compile cache is so slow, that a BIND 9 build can
take 20 minutes.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit cbc8664567)
Tests that exercise instrumentation, log output, or other behaviour
that only exists in developer builds (the gcc:almalinux9:amd64 CI job
sets -Ddeveloper=disabled to guard against such accidental coupling)
can now decorate themselves with isctest.mark.with_developer to skip on
non-developer builds.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit f957b63010)
System tests can check FEATURE_DEVELOPER in the environment, but the
recommended pattern is the with_developer pytest marker added next.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 950dc9945c)
System tests that depend on log output, instrumentation, or other
behaviour only present in developer builds can use this probe to detect
the build configuration at runtime.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 113980d4b0)
So that build-time consumers (e.g. feature-test) can detect developer
mode through a single dedicated symbol rather than proxying through
implementation-detail defines like ISC_MEM_TRACKLINES.
9.20 has no meson build; add the define alongside the other developer
defines on the existing STD_CPPFLAGS line in configure.ac. Originally
landed on main in commit d9aeee7901 ("Define DEVELOPER_MODE in
developer-mode builds").
Assisted-by: Claude:claude-opus-4-7
- Enable rendering ns-specific data in jinja2 templates using the `ns` varible.
- Add common zone/config snippets an `_common` templates.
- Allow jinja2 imports from `_common`.
- Improve the `_common/controls.conf.j2` snippet to render ns-specific IP rather than hardocded one.
Backport of MR !11805
Merge branch 'backport-nicki/pytest-template-improvements-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12116
The previous loader was a FileSystemLoader rooted at $srcdir, which
allowed any system test to include any other test's templates -- a
wider scope than intended. Every existing cross-test include already
targets _common/, so make that the only path.
ChoiceLoader + PrefixLoader keeps the existing '_common/foo.j2' path
convention working without changes to call sites. The '_common/'
prefix is deliberately kept rather than dropping it by rooting the
FileSystemLoader at _common/ directly:
- It signals at the include site that the file is a shared
template, not a sibling of the current test; readers don't need
to know the loader configuration to understand where the file
lives.
- It prevents shadowing: a test-local 'controls.conf.j2' would
not collide with the shared one, and the unqualified name keeps
its test-local meaning.
- It makes the dependency greppable: 'grep -rl _common/'
identifies every test that consumes shared snippets.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit c2c2be9be0)
Add commonly used zone-related data (config snippet and zone file
snippets) as templates which can be reused by filling in different data.
Adjust the isctest.template.Zone to use filepath argument rather than
filename for clarity.
(cherry picked from commit 317cd12779)
Rather than using named.conf include, render the controls directly into
the config using jinja2 template include.
(cherry picked from commit f4ca352bc8)
Omit extra newlines when combining and including templates.
Adjust the xfer/ns8/small.db.j2 so it doesn't trim the endline twice
(as that would join the two subsequent records on the same line).
(cherry picked from commit 4f8e3774bb)
In some cases, the template data might need to be set directly in the
jinja2 templates using `{% set %}`. Expose the template dataclasses to
the templates so we can use these existing classes, rather than creating
ad-hoc data containers.
(cherry picked from commit dddb067351)
If a template is being rendered into a directory that represents a
nameserver (e.g. "ns1"), include a nameserver-specific information in
the data - variable called "ns" which has information about the
nameserver this file belongs to.
Ensure the "ns" variable is only exposed to the template when rendered,
without affecting the environment variables (always work with a copy of
the env_vars).
(cherry picked from commit aa435b2e03)
Extend the Nameserver to generate the default IPv4/IPv6 values, add NSX
values for the predefined nameservers (there are 11 of them, as per
bin/tests/system/ifconfig.sh.in max value). Add the missing ns11
fixture.
Extend the Zone to derive the zone filename by default, unless
specified.
Adjust the existing uses of these classes to utilize the simplified
defaults.
(cherry picked from commit fa3a59e70c)
The experiment was a failure, the PR-Agent doesn't send a full context
to the AI Agents and the results are abysmal because of that.
Backport of MR !12119
Merge branch 'backport-ondrej/remove-useless-pr-agent-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12120
The experiment was a failure, the PR-Agent doesn't send a full context
to the AI Agents and the results are abysmal because of that.
(cherry picked from commit d3dbcd21df)
On a server configured with tkey-gssapi-keytab (or tkey-gssapi-credential),
an authenticated peer could crash named by sending two TKEY DELETE requests
for the same dynamic key in rapid succession. This has been fixed.
Closes#6001
Backport of MR !12041
Merge branch 'backport-6001-tsig-tkey-delete-uaf-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12042
Two TSIG-authenticated TKEY DELETE queries for the same dynamic key,
arriving on different worker loops, could each enter
dns_tsigkey_delete() and cause over-decrementing the key refcount.
This has been fixed by making dns_tsigkey_delete() idempotent.
(cherry picked from commit 5c8dcd4419)
When an RRset is in stale cache, and the authoritative server changes the record type to CNAME, the resolver fails to refresh the stale cache. This has been fixed.
Closes#5302
Backport of MR !11758
Merge branch 'backport-5302-serve-stale-cname-to-a-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12040
Matthijs Mekking authored 2 months ago
CNAME and other record types cannot coexist. DNSSEC records are the
exceptions to this rule.
If the answer contains a name with a CNAME, remove existing RRsets at
the same name from the cache.
If the answer contains a name without a CNAME, remove the CNAME RRset
at the same name from the cache.
(manually picked from commit 69a560fff1)
Add a serve-stale system test case where the authority changes a
CNAME RRset to A (at cname2.stale.test). The CNAME that is in the
cache is stale and should be refreshed. The target A record (at
a2.stale.test) has a longer TTL and is also still in the cache. The
next query should return the refreshed A RRset to the client.
Then the authority changes back the A RRset to CNAME. The A RRset
has become stale and should be refreshed. The next query should
return the refreshed CNAME RRset plus the already cached
a2.stale.test A record.
This test requires ns1 to allow dynamic updates to stale.test, and
prefetch to be disabled. The latter is to ensure the record is not
prefetched, but only refreshed when stale (and logs the expected
"an attempt to refresh the RRset" messages).
(cherry picked from commit 4ee526cb6d)
A recursive resolver could accept and cache an RRSIG record whose
Type-Covered field names a meta-type (ANY, AXFR, IXFR, MAILA, MAILB),
even though no real RRset of those types ever exists. Such records
are now rejected by the DNS message parser.
Closes#6002
Backport of MR !12048
Merge branch 'backport-6002-reject-rrsig-covering-meta-types-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12051
A signature cannot cover a meta-type (NONE, ANY, AXFR, IXFR, MAILB,
MAILA, OPT, TSIG, TKEY); previously such records were cached by the
recursive resolver and collided with negative-cache entries on the
same owner name, corrupting the QP-trie cache.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit c28ba9c3c6)
A badly configured secondary signer that was missing the 'file' entry caused the server to crash, rather than to reject the configuration. This has been fixed.
Closes#5993
Backport of MR !12045
Merge branch 'backport-5993-fix-bump-in-the-wire-crash-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12112
A secondary server that is configured as a bump in the wire signer
with inline-signing implicitly enabled via dnssec-policy requires
a 'file' entry.
(cherry picked from commit 77649ea8e2)
Add a variant of checking configuration where inline-signing is
enabled on the secondary, requiring the 'file' entry. This time,
inline-signing is implicitly enabled via dnssec-policy.
(cherry picked from commit 43bbfbeb3c)
GNOME GitLab returns HTTP 406 to Sphinx's linkcheck requests, the
same behavior already worked around for gitlab.isc.org.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 2850dc9d71)
Add a rule to match open source stable tags in CI and apply it to the
update-stable-tag job.
Backport of MR !11646
Merge branch 'backport-andoni/show-update-stable-tag-job-in-stable-versions-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12107
The update-stable-tag job should only be run for the stable tag, which
is used by Read the Docs to build the docs for the "stable" version.
A new rule called rule_tag_open_source_stable is introduced, in order to
prevent the job from appearing in the pipeline for non-stable versions.
Having this rule in YAML is necessary, because if it were in the script
itself, the job would show up in the pipeline.
Besides, the new rule allows other jobs to be run only for the stable
tag in the future, without modifying their internal logic.
The CI variable STABLE_VERSION contains a regular expression in
Gitlab CI sense[1]: it uses the RE2 syntax[2] and must be enclosed by
slashes (i.e. /.../). It must be updated every time the minor version
is changed: releasing v9.22 will require changing STABLE_VERSION from
"/v9.20/" to "/v9.22/".
The variable is imported from common Gitlab CI YAML in the project
isc-projects/bind9-qa, so as to maintain it in a central place.
[1]: https://docs.gitlab.com/ci/jobs/job_rules/#compare-a-variable-to-a-regular-expression
[2]: https://github.com/google/re2/wiki/Syntax
(cherry picked from commit 38e80f542e)
The template file .gitlab-ci-common.yml is to be used across ISC
projects, while it is maintained in the isc-projects/bind9-qa project.
(cherry picked from commit 1c31e6fea9)
POSIX does not require localtime_r() to behave as if tzset() was called,
so the TZ environment change isn't picked up if some library has already
primed libc's tz cache. Loading pkcs11-provider during OpenSSL init
does exactly that, causing the time and dnstap cmocka tests to format
timestamps in UTC instead of the requested zone.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit c14f7881f2)
Previously, the server would crash if it received a query with an ID
close to 65535 in the badmessageid case, as adding 50 to it would not
fit in uint16.
This was an oversight in porting it from Perl to Python in
f9ed3650ac.
Fixes#6025.
Backport of MR !12097
Merge branch 'backport-stepan/fix-xfer-large-qid-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12098
Previously, the server would crash if it received a query with an ID
close to 65535 in the badmessageid case, as adding 50 to it would not
fit in uint16.
This was an oversight in porting it from Perl to Python in
f9ed3650ac.
(cherry picked from commit e0ef63532f)
Mypy reports 'Need type annotation for "FEATURE_VARS"'; init_features()
populates it with str->str entries.
Assisted-by: Claude:claude-opus-4-7
Backport of MR !12086
Merge branch 'backport-nicki/fix-isctest-vars-mypy-annotation-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12088
Mypy reports 'Need type annotation for "FEATURE_VARS"'; init_features()
populates it with str->str entries.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 81c1105125)
dnspython's RRSIG.to_text() converts the signature inception/expiration
fields by calling time.gmtime(), which on 32-bit platforms raises
OverflowError for values past 2038-01-19 (INT32_MAX). Several DNSSEC
test fixtures use far-future expirations: the precomputed RRSIGs in
the dnssec test's rsasha1.example.db.in zone expire in 2093, ans4 of
the chain test hardcodes 2090, and ans10 of the dnssec test uses
2**32-1 (year 2106). Whenever a response carrying such an RRSIG is
formatted with str()/to_text() the overflow propagates out and either
fails the test (when triggered in isctest.query's debug logging) or
kills the asyncserver-based ans* server (when triggered in its
response logger), which in turn cascades into "Failed to stop
servers" teardown errors and SERVFAIL responses for subsequent tests.
Wrap the to_text() calls in isctest/query.py and the str(response)
call in asyncserver's _log_response() with try/except OverflowError,
falling back to a placeholder message. The conversions are only used
for debug logging, so losing the human-readable form there does not
affect what the tests actually validate.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 968ccdeeda)
