Print optionally a bit more details not passed to event in case
dns_view_findzonecut returns unexpected result. Result would be
visible later in foundevent, but found fname would be lost. Print it
into the log.
(cherry picked from commit d2c6966232)
When authoritative zone is loaded when query minimization query for the
same zone is already pending, it might receive unexpected result codes.
Normally DNS_R_CNAME would follow to query_cname after processing sent
events, but dns_view_findzonecut does not fill CNAME target into
event->foundevent. Usual lookup via query_lookup would always have that
filled.
Ideally we would restart the query with unmodified search name, if
unexpected change from recursing to local zone cut were detected. Until
dns_view_findzonecut is modified to export zone/cache source of the cut,
at least fail queries which went into unexpected state.
(cherry picked from commit 2fd3da54f9)
System tests' after_script missed the PYTHON environmental variable
setup.
Backport of MR !10683
Merge branch 'backport-mnowak/fix-parse_tsan-invocation-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10710
Tweak various system test which have been unstable in the past weeks.
Closes#5406
Backport of MR !10690
Merge branch 'backport-nicki/improve-system-test-stability-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10703
The code which checks for both IPv4 and IPv6 mixed usage is inherently
unstable, since the address family is chosen randomly for each
connection.
Closes#5406
(cherry picked from commit b98660e93e)
It's possible to use pytest.mark.flaky, which achieves the exact same
thing as our custom-defined isctest.mark.flaky -- attempts to rerun the
test on failure, but only is flaky package is available.
(cherry picked from commit 4c487c811d)
The test_kasp_case[secondary.kasp] can sometimes fail on freebsd13. It
appears the test gets stuck on some operation which should be very
quick, but for some reason takes at least a few seconds, causing the
cb_ixfr_is_signed() function to time out.
In one of the cases I investigated, it wasn't a query/response that
caused a timeout, but rather some operation in between. The test
attempts to read from a keyfile/statefile, but I see no reason why that
should block.
In any case, try to increase the timeout for the verification, as that
shouldn't hurt. Also allow the test to be re-run on freebsd13, as it's
likely to be caused by some odd behaviour on that platform -- the issue
doesn't appear anywhere else.
(cherry picked from commit 126a59cef2)
The check "unix socket message counts" sometimes fails with "dnstap
output file smaller than expected". This only happens on freebsd13 and
can't be reproduced easily. There was an attempt to decrease the
required file size in the past, but apparently, the issue can still
occur.
(cherry picked from commit 34867e1693)
The serve_stale test has some inherent instabilities affecting many
different checks. While the failure rate isn't too high (about four
failures in past three weeks of nightlies), it gets ignored, because the
test has been unstable for a very long time.
(cherry picked from commit 1e0df480c7)
This removes a leftover check which should've been removed in a prior
change (see #5244). The softhsm2 failures when attempting to delete the
token should be ignored.
(cherry picked from commit 6755d741e4)
The enginepkcs11 test has been chronically unstable for quite a while.
With no fix in sight, increase the number of allowed re-runs to reduce
the number of failures we see in the CI.
(cherry picked from commit 87ab198b73)
These tests have been unstable under TSAN in the past, but it appears
that the same failure mode can happen outside of TSAN tests as well.
These tests have produced 12 failures combined in the past three weeks
in nightlies.
(cherry picked from commit 66f6f4bba9)
The fetchlimit test has failed 8 times in the nightly CI over the past
three weeks. That makes the overall failure rate somewhere around 1 %,
which isn't a lot, but is still annoying when lots of testing is going
on.
(cherry picked from commit ae932eefc5)
Rndc test "test 'rndc reconfig' with a broken config" was failing
intermittently.
Wait for 'running' to be logged rather than just using 'sleep 1' before
calling 'rndc reconfig' a second time to get the expected error message
rather than 'reconfig request ignored: already running'.
Closes#5408
Backport of MR !10687
Merge branch 'backport-5408-rndc-test-second-rndc-reconfig-happens-too-soon-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10700
Rndc test "test 'rndc reconfig' with a broken config" was failing
intermittently.
Wait for 'running' to be logged rather than just using 'sleep 1' before
calling 'rndc reconfig' a second time to get the expected error message
rather than 'reconfig request ignored: already running'.
(cherry picked from commit 8b7bbda2f1)
There are three adbname flags that are used to identify different
types of adbname lookups when hashing rather than using multiple
hash tables. Separate these to their own structure element as these
need to be able to be read without locking the adbname structure.
Closes#5404
Backport of MR !10677
Merge branch 'backport-5404-seperate-out-adbname-type-flags-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10695
There are three adbname flags that are used to identify different
types of adbname lookups when hashing rather than using multiple
hash tables. Separate these to their own structure element as these
need to be able to be read without locking the adbname structure.
(cherry picked from commit 9158e63218)
There are many system tests where we set `dnssec-validation yes;` only
to also set `trust-anchors { };` which effectively disables the
validation.
This MR replaces this convoluted setup with just `dnssec-validation no;`.
Backport of MR !10684
Merge branch 'backport-stepan/empty-trust-anchors-in-system-tests-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10698
There are many system tests where we set `dnssec-validation yes;` only
to also set `trust-anchors { };` which effectively disables the
validation.
This commit replaces this convoluted setup with just
`dnssec-validation no;`.
(cherry picked from commit 01d1ad7988)
On MRs it uses the merge target as the reference.
In schedules it uses the latest released version for this branch as the reference.
This MR lays the ground work for using respdiff on non-standard configurations (like ECS) in the public repo, see https://gitlab.isc.org/isc-private/bind9/-/merge_requests/807#note_573140.
To reduce the future hassle when maintaining the -S version, most of the work (including an added job, so we know that it actually works) is done here.
Backport of MR !10664
Merge branch 'backport-stepan/respdiff-against-merge-target-or-last-release-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10696
On MRs it uses the merge target as the reference.
In schedules it uses the latest released version for this branch as the
reference.
(cherry picked from commit 9a6e8b9190)
When the interface-interval parser was changed from uint32 parser to
duration parser, the default value stayed at plain number `60` which
now means 60 seconds instead of 60 minutes. The documentation also
incorrectly states that the value is in minutes. That has been fixed.
Closes#5246
Backport of MR !10281
Merge branch 'backport-5246-fix-default-interface-interval-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10679
When the interface-interval parser was changed from uint32 parser to
duration parser, the default value stayed at plain 60 which now means 60
seconds instead of 60 minutes. Fix the default value and the
documentation to match the reality.
(cherry picked from commit de08c0088d)
Root trust anchors are automatically updated as described in RFC5011.
Add a system test which ensures the root DNSKEYs are always queried by
named during startup.
Because this test uses real internet DNS root servers, it is enabled
only when `CI_ENABLE_LIVE_INTERNET_TESTS` is set.
Backport of MR !10615
Merge branch 'backport-colin/updaterootdnskey-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10674
Root trust anchors are automatically updated as described in RFC5011.
Add a system test which ensures the root DNSKEYs are always queried by
named during startup.
Because this test uses real internet DNS root servers, it is enabled
only when `CI_ENABLE_LIVE_INTERNET_TESTS` is set.
(cherry picked from commit b0a33f77dc)
Now, it is also run in schedules and most annoyingly on push which means
that it is run twice on a push to a branch where a MR exists and `.gitlab-ci.yml` is changed.
This was an oversight in https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10654
Backport of MR !10668
Merge branch 'backport-stepan/remove-additional-pipeline-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10669
Now, it is also run in schedules and most annoyingly on push which means
that it is run twice on a push to a branch where a MR exists.
(cherry picked from commit 7ca18df58a)
- increase clarity of multiline messages
- support `isc.query.*()` query&response logging
- replace use of `print()` statement with proper logging
- omit empty lines from test result output
Backport of MR !10590
Merge branch 'backport-nicki/improve-pytest-logging-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10660
The extra messages are typically traceback from assertion failures.
Previously, they'd be printed only after all individual test case
results have been printed. That made it difficult to pair the traceback
to the failing test in some cases, as the node information (aka test
name) might not always be present.
Instead, log any extra messages related to a particular test failure
directly after reporting its result, making the failure details more
readily available and easy to connect with a particular test case.
(cherry picked from commit fcf31417dd)
The command's stdout may provide useful debug info, so make sure we log
it by default. It doesn't seem to have a significant impact on the log
size.
(cherry picked from commit 9f3f6ec38e)
Make sure the queries and responses are logged at the DEBUG level, which
may provide useful information in case of failing tests.
This doesn't seem to significantly increase the overall artifacts size.
Previously, pytest.log.txt files from all system tests would take around
3 MB, with this change, it's around 8 MB).
(cherry picked from commit 56fec9ba04)
In some cases, it's useful to log the sent and received DNS messages.
Add options to enable this on demand. Query is only logged the first
time it's sent, since it doesn't change. If response logging is turned
on, then each response is logged, since it might be different every
time.
(cherry picked from commit 1e87b5ffc6)
When multiline message is logged, indent all but the first line (which
will be preceeded by the LOG_FORMAT). This improves the clarity of logs,
as it's immediately clear which lines are regular log output, and which
ones are multiline debug output.
Adjust the isctest.run.cmd() stdout/stderr logging to this new format.
(cherry picked from commit 23e6b49cc5)
The messages obtained from test results may contain stuff like detailed
failure/error information, tracebacks etc. In many cases, the message
will be empty, in which case it doesn't need to be logged.
For an example, run test with many test cases, e.g.
verify/test_verify.py, and inspect the tail of the pytest.log.txt before
and after this commit.
(cherry picked from commit 0a6b0cf68c)
Use isctest.log logging facility for consistent and predictable logging
output rather than using print(). Remove writes of stderr, as that
output will be logged in the debug log in case the commands called with
isctest.run.cmd() fails.
(cherry picked from commit 4b8998e4ad)
If an new orphan anchor is (`.anchor: &anchor` with no corresponding `*anchor` elsewhere in the file) is introduced the CI job will.
Depends on https://gitlab.isc.org/isc-projects/bind9-qa/-/merge_requests/101 (merge that first and then drop the `--branch` commit).
Backport of MR !10654
Merge branch 'backport-stepan/ci-orphaned-anchors-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10666
This test doesn't require artifact checking but when bundled in the same
directory with the shell based tests, the `system:clang:tsan` job was
failing non-deterministically.
(cherry picked from commit d5874d5df9)
This is a test for #5380.
Backport of MR !10596
Merge branch 'backport-stepan/mirror-root-zone-from-the-internet-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!10657
