Logging from a pytest hook looks better.
Reorder the check for presence of `featuretest` before `init_vars` to
produce more sensible errors.
(cherry picked from commit b31f058ad0)
When a resolver was configured with both `nxdomain-redirect` and `dns64`
in the same view, an AAAA query for a nonexistent name could abort
`named`. The combination failed whenever the redirect zone held A
records but no AAAA records. The server now serves the empty AAAA
response from the redirect zone as-is, instead of attempting DNS64
synthesis on top of it.
Closes#5789
Backport of MR !12059
Merge branch 'backport-5789-fix-nxdomain-redirect-dns64-assert-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12123
redirect2() swaps qctx->db to the redirect zone before
query_nodata() runs. The DNS64 fallback there issues an A lookup
for the original query name, which is out of zone for the
redirect db, and the resulting query_notfound() trips
INSIST(!is_zone). The cached NCACHENXRRSET variant trips a
REQUIRE in dns_rdataset_first() on a disassociated rdataset.
The synth-from-dnssec entry reaches the same fallback via
query_coveringnsec(). Guarding the fallback with
!qctx->redirected leaves the nxdomain-redirect NXRRSET answer to
be served as-is.
(cherry picked from commit 4bfd18d08d)
An AAAA query for a non-existent name into a view that combines
nxdomain-redirect with dns64 used to abort named via the DNS64
fallback in query_nodata(). The new module exercises all three
documented entry paths into query_redirect(): the authoritative
NXDOMAIN path (ns7, tripping INSIST(!is_zone) in
query_notfound()), the recursive NCACHENXRRSET path (ns8,
tripping REQUIRE in dns_rdataset_first() on a disassociated
rdataset), and the synth-from-dnssec path (ns10 validating
against ns9's signed root, with a primer A query so the second
AAAA reaches query_redirect() via query_coveringnsec()). ns9
serves as a neutral upstream so the cached and synthesized
negatives land real NXRRSETs.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 739a067de8)
The test framework already requires Python 3.10+ (conftest.py raises
RuntimeError if version < 3.10), so skipif(sys.version_info < (3, 7))
can never trigger. Remove the dead markers and now-unused sys imports.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit c41f63c82d)
named_server_sync() logged isc_result_totext(result) but returns
tresult. The loop accumulates errors into tresult, so result only
holds the last iteration's value. If the last view succeeded but an
earlier one failed, the log would incorrectly say "success".
Backport of MR !12090
Merge branch 'backport-mnowak/fix-server-sync-log-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12156
named_server_sync() logged isc_result_totext(result) but returns
tresult. The loop accumulates errors into tresult, so result only
holds the last iteration's value. If the last view succeeded but an
earlier one failed, the log would incorrectly say "success".
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 1b984b1f11)
```
______________________________ test_kasp_default _______________________________
[gw0] freebsd15 -- Python 3.11.15 /usr/local/bin/python3.11
/home/ec2-user/builds/isc-private/bind9/bin/tests/system/kasp/tests_kasp.py:910: in test_kasp_default
isctest.run.retry_with_timeout(update_is_signed, timeout=5)
/home/ec2-user/builds/isc-private/bind9/bin/tests/system/isctest/run.py:164: in retry_with_timeout
assert False, msg
E AssertionError: tests_kasp.test_kasp_default.<locals>.update_is_signed() timed out after 5 s
E assert False
```
Backport of MR !12151
Merge branch 'backport-mnowak/kasp-default-update-is-signed-timeout-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12155
After reloading an inline-signed zone from file, named must re-read it,
detect the deltas and generate RRSIGs before the answer is signed, which
can take longer than 5 seconds on a loaded CI host and cause spurious
update_is_signed() timeouts. Bump these reload-based checks to 10
seconds, matching cb_ixfr_is_signed.
Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit a2ccc04ae3)
Rarely, RNDC fails to refresh the zone on FreeBSD in the default 10
seconds, causing test_edns_expire_refresh to fail with a TimeoutExpired
on the "rndc refresh edns-expire." call. Give it more time, the same
way the reconfigure timeout was bumped in
test_reconfiguration_when_zone_transfer_is_in_the_middle_of_soa_query.
Assisted-by: Claude:claude-opus-4-8
Backport of MR !12152
Merge branch 'backport-mnowak/bump-edns-expire-refresh-rndc-timeout-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12153
Rarely, RNDC fails to refresh the zone on FreeBSD in the default 10
seconds, causing test_edns_expire_refresh to fail with a TimeoutExpired
on the "rndc refresh edns-expire." call. Give it more time, the same
way the reconfigure timeout was bumped in
test_reconfiguration_when_zone_transfer_is_in_the_middle_of_soa_query.
Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit c93d68a36b)
Address a `checkds` test race condition.
Example failure:
```
________________ test_checkds[incomplete.yes.dspublish.ns2-4-5] ________________
[gw3] linux -- Python 3.13.5 /usr/bin/python3
/builds/isc-projects/bind9/bin/tests/system/checkds/tests_checkds.py:451: in test_checkds
keystate_check(ns2, params.zone, params.expected_parent_state)
/builds/isc-projects/bind9/bin/tests/system/checkds/tests_checkds.py:183: in keystate_check
assert val == 0
E AssertionError: assert '20260528103555 (Thu May 28 10:35:55 2026)' == 0
```
https://gitlab.isc.org/isc-projects/bind9/-/jobs/7497509
Backport of MR !12138
Merge branch 'backport-nicki/fix-checkds-loadkeys-race-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12150
The wait loop in test_checkds() called "rndc loadkeys" once per
second while polling ns9.log for expected parental-agent response
lines. Under load (notably the rbt CI job), responses to one query
batch could land after a subsequent loadkeys had already reset the
per-key DSPUBCOUNT counter in lib/dns/zone.c without cancelling the
in-flight requests. Stragglers from the earlier round then bumped the
new round's counter to parentalscnt and BIND finalized DSPublish for
zones where one parental-agent legitimately serves no DS, spuriously
failing the !DSPublish keystate assertion.
Trigger at most one loadkeys per test case and wait passively via
watch_log_from_start() / wait_for_all(). Watching from the start
of the log preserves the original implicit semantics for zones
whose DS state was already finalized by BIND's automatic checkds
polling at zone-load time -- the expected lines are already
present and the watcher returns immediately.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 02b6239489)
During an incoming zone transfer, an optimization could let
the batch of pending records grow without bound for a large
zone, raising memory usage. It gave no measurable performance
benefit, so it has been removed.
Closes#5958
Backport of MR !12141
Merge branch 'backport-5958-no-name-boundary-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12142
In MR !9740, we introduced an optimization that reduces memory usage
by processing rdatas in batches during AXFR.
The maximum batch size is 128, but the batch size was allowed to grow
beyond that limit if all rdatas in a batch were for the same name, as
that allows a more efficient optimization.
This optimization could theoretically allow the batch size arbitrarily
for a sufficient large zone transfer. Since synthetic tests don't show
any performance improvement from the optimization, this MR removes it.
(cherry picked from commit 7502e73333)
A validating resolver could stall for about twelve seconds and then return
SERVFAIL when an authoritative server answered a DS query with a CNAME. Such
responses are now rejected promptly, so the query fails fast instead of
hanging.
Closes#5878
Backport of MR !11867
Merge branch 'backport-5878-reject-cname-at-dnssec-types-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12147
Two authoritative zones drive the cases. 'example.' answers DNSKEY,
NSEC, NSEC3 and RRSIG queries with a CNAME: a direct recursive query for
one of these must not crash the resolver, and the validator's own DNSKEY
fetch for a signed name must fail as a broken trust chain and return
SERVFAIL promptly.
'secure.' is served faithfully but answers DS queries with an unsigned
CNAME -- the input that drove the validator's insecurity proof into a
self-join. The resolver must return SERVFAIL within a couple of seconds
instead of stalling for twelve.
Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit 358c55ffa2)
A query for an RRSIG is handled as a subset of ANY, so rctx_answer_any()
filters out records that do not match the queried type. When every
record was filtered out (an answer carrying only unrelated types), the
function still returned success with nothing cached, and the fetch then
waited for a validator that was never started until the backstop fetch
timer fired ~12s later. Treat an all-filtered answer as a broken
response, matching how non-meta types already reject a reply with no
usable record.
(cherry picked from commit 938b58a809)
The resolver turned a CNAME response to an RRSIG or NSEC query into
FORMERR inside rctx_answer_cname(). That is redundant -- every caller
already copes with a DNS_R_CNAME or DNS_R_DNAME result -- and it is the
wrong layer, because the resolver cannot tell a legitimate alias from a
broken one. Drop it; a CNAME for one of these types now flows back as
an ordinary alias.
The case that must be stopped lives in the validator. While proving an
unsigned CNAME insecure, proveunsecure() fetches the DS for the CNAME's
own name; because fetches are shared, that fetch re-enters and stalls on
the in-flight fetch the validator is waiting for, deadlocking for about
twelve seconds (GL#5878). Unlike the resolver, the validator knows it
is validating an alias, so check_chaining() now aborts a fetch whose
name matches the chaining rdataset's owner: it cannot advance the chain
and would only self-join.
(cherry picked from commit d0c6219d66)
The resolver's fetch loop detection now triggers only when a new
fetch would join an already in-flight fetch that is also one of
its own ancestors, which is the actual loop condition. Previously
the check ran against the original request before the fetch was
set up.
Backport of MR !12145
Merge branch 'backport-ondrej/improve-resolver-loop-detection-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12146
dns_resolver_createfetch() guarded against fetch loops by comparing the
raw request name/type/domain before any fetch context existed. Move the
check after the context is obtained and run it against the context
itself, and only when we joined an already in-flight context
(!new_fctx) that is also an ancestor in the parent chain. That is the
real loop condition: the new fetch would block waiting on a fetch that
is itself waiting on us. A newly created context waits on nothing, so it
proceeds, bounded by the fetch depth limit and the complementary ADB
loop detection.
(cherry picked from commit 0e04671b65)
LoadScopeScheduling._split_scope() uses rsplit("::", 1) to
extract the test file scope from a node ID. When parametrized
test values contain "::" (IPv6 addresses like "cafe:cafe::cafe"
or "::1"), the split lands inside the parameter instead of at
the .py:: boundary. This creates spurious scopes that get
assigned to different workers, each triggering a full fixture
setup (starting named instances).
Override _split_scope() in conftest.py to split on ".py::"
which is unambiguous.
Six tests in synthrecord/tests_synthrecord.py are affected.
A verification script is included in util/.
Assisted-by: Claude:claude-opus-4-7
Backport of MR !12103
Merge branch 'backport-mnowak/fix-xdist-loadscope-split-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12137
LoadScopeScheduling._split_scope() uses rsplit("::", 1) to
extract the test file scope from a node ID. When parametrized
test values contain "::" (IPv6 addresses like "cafe:cafe::cafe"
or "::1"), the split lands inside the parameter instead of at
the .py:: boundary. This creates spurious scopes that get
assigned to different workers, each triggering a full fixture
setup (starting named instances).
Override _split_scope() in conftest.py to split on ".py::"
which is unambiguous.
Six tests in synthrecord/tests_synthrecord.py are affected.
A verification script is included in util/.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 4eb893020e)
Update PRIORITY_TESTS with the 10 longest-running test
scopes measured from CI (job 7468217). These get scheduled
first so that with --dist=loadscope they land on separate
workers instead of piling up at the end.
Also fix "serve-stale/" to "serve_stale/" to match the
actual directory name, and add a startup check that fails
if any PRIORITY_TESTS entry does not match an existing
directory.
Assisted-by: Claude:claude-opus-4-7
Backport of MR !12104
Merge branch 'backport-mnowak/prioritize-slow-system-tests-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12134
Update PRIORITY_TESTS with the 10 longest-running test
scopes measured from CI (job 7468217). These get scheduled
first so that with --dist=loadscope they land on separate
workers instead of piling up at the end.
Also fix "serve-stale/" to "serve_stale/" to match the
actual directory name, and add a startup check that fails
if any PRIORITY_TESTS entry does not match an existing
directory.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 5e3c0b8463)
The population of the compile cache is so slow, that a BIND 9 build can
take 20 minutes.
Assisted-by: Claude:claude-opus-4-7
Backport of MR !12127
Merge branch 'backport-mnowak/drop-ccache-support-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12128
The population of the compile cache is so slow, that a BIND 9 build can
take 20 minutes.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit cbc8664567)
Tests that exercise instrumentation, log output, or other behaviour
that only exists in developer builds (the gcc:almalinux9:amd64 CI job
sets -Ddeveloper=disabled to guard against such accidental coupling)
can now decorate themselves with isctest.mark.with_developer to skip on
non-developer builds.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit f957b63010)
System tests can check FEATURE_DEVELOPER in the environment, but the
recommended pattern is the with_developer pytest marker added next.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 950dc9945c)
System tests that depend on log output, instrumentation, or other
behaviour only present in developer builds can use this probe to detect
the build configuration at runtime.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 113980d4b0)
So that build-time consumers (e.g. feature-test) can detect developer
mode through a single dedicated symbol rather than proxying through
implementation-detail defines like ISC_MEM_TRACKLINES.
9.20 has no meson build; add the define alongside the other developer
defines on the existing STD_CPPFLAGS line in configure.ac. Originally
landed on main in commit d9aeee7901 ("Define DEVELOPER_MODE in
developer-mode builds").
Assisted-by: Claude:claude-opus-4-7
- Enable rendering ns-specific data in jinja2 templates using the `ns` varible.
- Add common zone/config snippets an `_common` templates.
- Allow jinja2 imports from `_common`.
- Improve the `_common/controls.conf.j2` snippet to render ns-specific IP rather than hardocded one.
Backport of MR !11805
Merge branch 'backport-nicki/pytest-template-improvements-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12116
The previous loader was a FileSystemLoader rooted at $srcdir, which
allowed any system test to include any other test's templates -- a
wider scope than intended. Every existing cross-test include already
targets _common/, so make that the only path.
ChoiceLoader + PrefixLoader keeps the existing '_common/foo.j2' path
convention working without changes to call sites. The '_common/'
prefix is deliberately kept rather than dropping it by rooting the
FileSystemLoader at _common/ directly:
- It signals at the include site that the file is a shared
template, not a sibling of the current test; readers don't need
to know the loader configuration to understand where the file
lives.
- It prevents shadowing: a test-local 'controls.conf.j2' would
not collide with the shared one, and the unqualified name keeps
its test-local meaning.
- It makes the dependency greppable: 'grep -rl _common/'
identifies every test that consumes shared snippets.
Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit c2c2be9be0)
Add commonly used zone-related data (config snippet and zone file
snippets) as templates which can be reused by filling in different data.
Adjust the isctest.template.Zone to use filepath argument rather than
filename for clarity.
(cherry picked from commit 317cd12779)
Rather than using named.conf include, render the controls directly into
the config using jinja2 template include.
(cherry picked from commit f4ca352bc8)
Omit extra newlines when combining and including templates.
Adjust the xfer/ns8/small.db.j2 so it doesn't trim the endline twice
(as that would join the two subsequent records on the same line).
(cherry picked from commit 4f8e3774bb)
In some cases, the template data might need to be set directly in the
jinja2 templates using `{% set %}`. Expose the template dataclasses to
the templates so we can use these existing classes, rather than creating
ad-hoc data containers.
(cherry picked from commit dddb067351)
If a template is being rendered into a directory that represents a
nameserver (e.g. "ns1"), include a nameserver-specific information in
the data - variable called "ns" which has information about the
nameserver this file belongs to.
Ensure the "ns" variable is only exposed to the template when rendered,
without affecting the environment variables (always work with a copy of
the env_vars).
(cherry picked from commit aa435b2e03)
Extend the Nameserver to generate the default IPv4/IPv6 values, add NSX
values for the predefined nameservers (there are 11 of them, as per
bin/tests/system/ifconfig.sh.in max value). Add the missing ns11
fixture.
Extend the Zone to derive the zone filename by default, unless
specified.
Adjust the existing uses of these classes to utilize the simplified
defaults.
(cherry picked from commit fa3a59e70c)
The experiment was a failure, the PR-Agent doesn't send a full context
to the AI Agents and the results are abysmal because of that.
Backport of MR !12119
Merge branch 'backport-ondrej/remove-useless-pr-agent-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12120
The experiment was a failure, the PR-Agent doesn't send a full context
to the AI Agents and the results are abysmal because of that.
(cherry picked from commit d3dbcd21df)
On a server configured with tkey-gssapi-keytab (or tkey-gssapi-credential),
an authenticated peer could crash named by sending two TKEY DELETE requests
for the same dynamic key in rapid succession. This has been fixed.
Closes#6001
Backport of MR !12041
Merge branch 'backport-6001-tsig-tkey-delete-uaf-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12042
Two TSIG-authenticated TKEY DELETE queries for the same dynamic key,
arriving on different worker loops, could each enter
dns_tsigkey_delete() and cause over-decrementing the key refcount.
This has been fixed by making dns_tsigkey_delete() idempotent.
(cherry picked from commit 5c8dcd4419)
When an RRset is in stale cache, and the authoritative server changes the record type to CNAME, the resolver fails to refresh the stale cache. This has been fixed.
Closes#5302
Backport of MR !11758
Merge branch 'backport-5302-serve-stale-cname-to-a-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!12040
Matthijs Mekking authored 2 months ago
CNAME and other record types cannot coexist. DNSSEC records are the
exceptions to this rule.
If the answer contains a name with a CNAME, remove existing RRsets at
the same name from the cache.
If the answer contains a name without a CNAME, remove the CNAME RRset
at the same name from the cache.
(manually picked from commit 69a560fff1)
