Commit graph

10841 commits

Author SHA1 Message Date
Ondřej Surý
b35861f1eb Increase the BUFSIZ-long buffers
The BUFSIZ value varies between platforms, it could be 8K on Linux and
512 bytes on mingw.  Make sure the buffers are always big enough for the
output data to prevent truncation of the output by appropriately
enlarging or sizing the buffers.
2022-07-15 10:33:46 +00:00
Michał Kępień
fc8e6a4cb2 Update documentation for named's -M option
Remove "external" from the list of legal values for the -M command-line
option as it has not been allowed since the internal memory allocator
was removed by commit 55ace5d3aa.

Make the style of the relevant paragraph more in line with the next one
and split its contents up into an unordered list of options for improved
readability.
2022-07-15 10:23:03 +02:00
Ondřej Surý
d1433da524 Wait for TCP connection refused in the statistics system test
The statistics system test makes a query to foo.info to check for the
pending connections because the ans4 doesn't respond to the query.

This might or might not (depending on exact timing) increment the failed
TCP connection counter when the query is retried over TCP because ans4
doesn't listen on the TCP.

Wait for the 'connection refused' in the ns3 log file to be able to
count the exactly 1 failed TCP connection.
2022-07-14 13:08:29 -07:00
Mark Andrews
ee9ec0052e Remove redundant assignment of 'clistenon = NULL' 2022-07-14 00:24:37 +00:00
Evan Hunt
9372baac27 check putstr return values
The calls to putstr() in named_server_fetchlimit() were not checked
for failure.
2022-07-14 00:04:39 +00:00
Mark Andrews
eb5e5edf82 kasp: add missing logging during setup
Some zones where not being logged when just DNSSEC keys where being
generated in system test setup phase.  Add logging for these zones.
2022-07-13 23:19:39 +00:00
Ondřej Surý
deae974366 Directly cause assertion failure on pthreads primitives failure
Instead of returning error values from isc_rwlock_*(), isc_mutex_*(),
and isc_condition_*() macros/functions and subsequently carrying out
runtime assertion checks on the return values in the calling code,
trigger assertion failures directly in those macros/functions whenever
any pthread function returns an error, as there is no point in
continuing execution in such a case anyway.
2022-07-13 13:19:32 +02:00
Mark Andrews
513cb24b55 Make "checking revoked key with duplicate key ID" work
There should be 2 keys with the same key id after the numerically
lower one is revoked (serial space arithmetic).  The DS points
at the non-revoked key so validation should still succeed.
2022-07-13 00:47:49 +00:00
Matthijs Mekking
576b21b168 Inherit dnssec-policy in check for inline-signing
When dnssec-policy is used, and the zone is not dynamic, BIND will
assume that the zone is inline-signed. But the function responsible
for this did not inherit the dnssec-policy option from the view or
options level, and thus never enabled inline-signing, while the zone
should have been.

This is fixed by this commit.
2022-07-12 11:29:03 +02:00
Matthijs Mekking
efa8a4e88d Test setting of inline-signing with dnssec-policy
When dnssec-policy is used, and the zone is not dynamic, BIND will
assume that the zone is inline-signed. Add test cases to verify this.
2022-07-12 11:29:03 +02:00
Matthijs Mekking
ff65f07779 Fix kasp system test bugs
Fix a comment, ensuring the right parameters are used (zone is
parameter $3, not $2) and add view and policy parameters to the comment.

Fix the view tests and test the correct view (example3 instead of
example2).

Fix placement of "n=$((n+1)" for two test cases.
2022-07-12 11:29:03 +02:00
Mark Andrews
459e6980e5 zonechecks: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
3f65c9cf85 wildcard: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
86b29606c3 views: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
93f7c7cdcd verify: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
5585909904 upforwd: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
9970d4317d unknown: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
73fd49f8bb synthfromdnssec: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
32337b9dbf staticstub: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
941b95edb0 smartsign: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
1861c3e503 rpz: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
b0e1d9b1b3 rootkeysentinel: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews
05ef8c81dd resolver: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews
e0e03602ba redirect: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews
6fd50b9fda pending: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews
c2d18567fc nsupdate: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews
78fa082999 mkeys: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews
ff95bafa39 mirror: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews
3f1dc83bfb metadata: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews
e3acddefd1 inline: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews
49de14cb9e dsdigest: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews
d0b0139c90 dnssec: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews
5cbf1e1598 dns64: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews
3419178bd2 chain: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews
6cf0b73ede cds: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews
bb810b0ac9 autosign: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Evan Hunt
549cf0f3e6 "rndc fetchlimit" now also lists rate-limited domains
"rndc fetchlimit" now also prints a list of domain names that are
currently rate-limited by "fetches-per-zone".

The "fetchlimit" system test has been updated to use this feature
to check that domain limits are applied correctly.
2022-07-06 19:46:23 -07:00
Evan Hunt
6175897478 add "rndc fetchlimit" to show fetchlimited servers
this command runs dns_adb_dumpquota() to display all servers
in the ADB that are being actively fetchlimited by the
fetches-per-server controls (i.e, servers with a nonzero average
timeout ratio or with the quota having been reduced from the
default value).

the "fetchlimit" system test has been updated to use the
new command to check quota values instead of "rndc dumpdb".
2022-07-06 19:46:20 -07:00
Mark Andrews
9366ed58b4 Upgrade uses of hmac-md5 to DEFAULT_HMAC
where the test is not hmac-md5 specific
2022-07-07 10:11:42 +10:00
Mark Andrews
c533e8bc5b Upgrade uses of hmac-sha1 to DEFAULT_HMAC
where the test is not hmac-sha1 specific
2022-07-07 10:11:42 +10:00
Mark Andrews
19a7a1e557 Convert hmac-sha256 references in system tests to DEFAULT_HMAC
where a future change from hmac-sha256 would be applicable.  This
change involves dnssec, nsupdate and rndc system tests.
2022-07-07 10:11:42 +10:00
Mark Andrews
ce324ae8ba Use DEFAULT_HMAC for rndc 2022-07-07 10:11:42 +10:00
Mark Andrews
972d7fd682 Add DEFAULT_HMAC to conf.sh.common 2022-07-07 10:11:42 +10:00
Mark Andrews
abfb5b1173 update ifconfig.sh
* make it harder to get the interface numbers wrong by using 'max'
to specify the upper bound of the sequence of interfaces and use 'max'
when calculating the interface number
* extract the platform specific instruction into 'up' and 'down'
and call them from the inner loop so that the interface number is
calculated in one place.
* calculate the A and AAAA address in a single place rather than
in each command
* use /sbin/ipadm on Solaris 2.11 and greater
2022-07-07 09:54:48 +10:00
Evan Hunt
f6abb80746 try other servers when receiving FORMERR
previously, when an iterative query returned FORMERR, resolution
would be stopped under the assumption that other servers for
the same domain would likely have the same capabilities. this
assumption is not correct; some domains have been reported for
which some but not all servers will return FORMERR to a given
query; retrying allows recursion to succeed.
2022-07-06 14:15:32 -07:00
Mark Andrews
7be64c0e94 Tighten $GENERATE directive parsing
The original sscanf processing allowed for a number of syntax errors
to be accepted.  This included missing the closing brace in
${modifiers}

Look for both comma and right brace as intermediate seperators as
well as consuming the final right brace in the sscanf processing
for ${modifiers}.  Check when we got right brace to determine if
the sscanf consumed more input than expected and if so behave as
if it had stopped at the first right brace.
2022-07-05 09:41:33 -07:00
Mark Andrews
5327b9708f Check for overflow in $GENERATE computations
$GENERATE uses 'int' for its computations and some constructions
can overflow values that can be represented by an 'int' resulting
in undefined behaviour.  Detect these conditions and return a
range error.
2022-07-05 09:41:29 -07:00
Mark Andrews
4db847e80e Increase the amount of time allowed for signing to occur in
On slow systems we have seen this take 9 seconds.  Increased the
allowance from 3 seconds to 10 seconds to reduce the probabilty of
a false negative from the system test.
2022-07-05 12:36:36 +00:00
Mark Andrews
304d33fb32 Only report not matching stderr content when we look for it
The previous test code could emit "D:cds:stderr did not match ''" rather
that just showing the contents of stderr.  Moved the debug line inside
the if/else block.

Replaced backquotes with $() and $(()) as approriate.
2022-07-05 12:36:36 +00:00
Mark Andrews
33454fb0e9 Test grafting and synth-from-dnssec using primary zone 2022-07-05 12:29:01 +10:00