Previously, the isc_ht hash table module was case-sensitive, but now
it supports case-insensitive mode. Use the case-insensitive mode
for the catalog zones' entry names.
(cherry picked from commit 6f4b5d6958)
Previously, the isc_ht hash table module was case-sensitive, but now
it supports case-insensitive mode. Use the case-insensitive mode
for catalog zone names.
(cherry picked from commit 0e0ba06dbf)
Rewrite ans servers in digdelv test to use AsyncDnsServer.
Backport of MR !11308
Merge branch 'backport-nicki/asyncdnsserver-digdelv-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11448
Since there was no 10.53.0.6 server in the test, renumber the remaining
ones so that there's no gap in the server names.
This commit simply moves the ans.py files without any changes and
renumbers the IP addresses in tests.
(cherry picked from commit 9b63187a99)
Previously, the ans8 server had different response modes that applied to
all queries. Replace it with AsyncDnsServer that has serves the different
response modes under different domains without the need to change the
server behaviour at runtime.
Add the new queries that require an ns3 fallback to the ns3/example.db
zone.
(cherry picked from commit 0b7a089c7f)
The server has three modes of operation - either no response, a partial
AXFR or a complete AXFR. To test the fallback behaviour of dig, these
actions are be combined in a specific sequences. To set up the desired
server behaviour, use the _control queries for the server.
(cherry picked from commit 575f0e3916)
The action can be used to close the connection even after some response
was sent, depending on the ordering of actions in the handler that uses
it. Rename it to CloseConnection to use a more fitting name.
(cherry picked from commit 20887ff80f)
Configure the AsyncDnsServer to ignore all queries to ensure the same
behaviour as with "//" command for ans.pl.
(cherry picked from commit 648f2534b1)
If at all possible, all the responses should be created by
AsyncDnsServer's internal methods. To ensure this, mark them with a
magic attribute and check it on send and crash the server if a manually
created response is detected.
Backport of MR !11420
Merge branch 'backport-stepan/avoid-using-hand-rolled-responses-in-asyncserver-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11445
If at all possible, all the responses should be created by
AsyncDnsServer's internal methods. To ensure this, mark them with a
magic attribute and check it on send and crash the server if a manually
created response is detected.
Fix the qmin test server which uses `make_response`.
(cherry picked from commit 1fc206556b)
When both input and output files are the same, it creates unnecesary
troubles in debugging issues with the JUnit files.
Keep the Pytest-generated file in the artifacts and output the checked
version as a new file.
Companion MR: https://gitlab.isc.org/isc-projects/bind9-qa/-/merge_requests/155
Backport of MR !11430
Merge branch 'backport-stepan/dont-overwrite-pytest-junit-xml-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11431
When both input and output files are the same, it creates unnecesary
troubles in debugging issues with the JUnit files.
Keep the Pytest-generated file in the artifacts and output the checked
version as a new file.
(cherry picked from commit 1a85a27f54)
~~Where applicable, use the more detailed CMocka generated JUnit
reports which include subtest results and timings instead of the
one generated by Meson.~~
Prerequisites:
- bind9-qa!137
~~Closes #5511~~
Partial backport of MR !11100
Merge branch 'backport-5511-cmocka-junit-ouput-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11433
The `assert_in_range()` function was deprecated in favor of
`assert_int_in_range()` and `assert_uint_in_range()`. Add compatibility
shims for cmocka<2.0.0 and use the new functions.
Closes#5699
Backport of MR !11412
Merge branch 'backport-5699-support-cmocka-2.0.0-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11437
The `assert_in_range()` function was deprecated in favor of
`assert_int_in_range()` and `assert_uint_in_range()`. Add compatibility
shims for cmocka<2.0.0 and use the new functions.
(cherry picked from commit 6843a4bd9a)
Although markup extraction to anchors makes FreeBSD jobs cleaner, it
prevents job customization, say, enabling or disabling a build option.
(cherry picked from commit 636a617f66)
On FreeBSD 15.0, sending requests to non-existent address produces
unexpected results. Add a blackhole server instead.
(cherry picked from commit b4c0408d81)
Create a signed zone file that contains malformed ZSKs with colliding
key tags. The ZSKs don't represent valid ECDSA keys and will cause a
crypto failure when attempting to use them. Sign the zone with KSK, with
the exception of one record which is "signed" with the invalid ZSKs.
Check that the resolver aborts the DNSSEC verification after
encountering the first crypto failure, indicating malformed DNSKEY.
Closes#5343
Backport of MR !11425
Merge branch 'backport-5343-count-invalid-keys-into-validation-fails-test-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11427
Ensure that named can handle a situation where the zone is signed with a
truncated, self-signed revoked DNSKEY. The signatures are inevitably
bogus and a SERVFAIL is expected. However, prior to CVE-2025-8677 fix,
this could trigger an assertion failure.
(cherry picked from commit 0ddfa108a7)
Create a signed zone file that contains malformed ZSKs with colliding
key tags. The ZSKs don't represent valid ECDSA keys and will cause a
crypto failure when attempting to use them. Sign the zone with KSK, with
the exception of one record which is "signed" with the invalid ZSKs.
Check that the resolver aborts the DNSSEC verification after
encountering the first crypto failure, indicating malformed DNSKEY.
(cherry picked from commit 1a2e46d364)
In !11179 I mistakenly set the default for `default_aa` for
`AsyncDnsServer()` to `True` and then explicitly set it to True in
cases where all the `ResponseHandlers` said
`yield DnsResponseSend(..., authoritative=True)` as if the default was
`False`.
Also the rest of `AsyncDnsServer` code (namely `_prepare_responses`)
reads like `default_aa` is `False` by default.
This accidentally changed the behavior of servers which don't set the
`default_aa` and where AA is not set from the zone data
(e.g. `dispatch/ans3`).
Backport of MR !11419
Merge branch 'backport-stepan/set-asyncdnsserver-dafault-aa-to-false-by-default-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11426
In 6e684d44 I mistakenly set the default for `default_aa` for
`AsyncDnsServer()` to `True` and then explicitly set it to True in
cases where all the `ResponseHandlers` said
`yield DnsResponseSend(..., authoritative=True)` as if the default was
`False`.
Also the rest of `AsyncDnsServer` code (namely `_prepare_responses`)
reads like `default_aa` is `False` by default.
This accidentally changed the behavior of servers which don't set the
`default_aa` and where AA is not set from the zone data
(e.g. `dispatch/ans3`).
(cherry picked from commit dc58c73264)
While building on uclibc this error is thrown:
In file included from ./include/dns/log.h:20,
from callbacks.c:19:
../../lib/isc/include/isc/log.h:141:9: error: unknown type name ‘off_t’
141 | off_t maximum_size;
| ^~~~~
This is due to missing include unistd.h, so let's add it on top of
isc/log.h
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Backport of MR !11422
Merge branch 'backport-fix/uclibc-off_t-main-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11423
While building on uclibc this error is thrown:
In file included from ./include/dns/log.h:20,
from callbacks.c:19:
../../lib/isc/include/isc/log.h:141:9: error: unknown type name ‘off_t’
141 | off_t maximum_size;
| ^~~~~
This is due to missing include unistd.h, so let's add it on top of
isc/log.h
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
(cherry picked from commit 0e43f62c12)
Revert the wait for log change for the rollover-zsk-prepub test.
Closes#5692
Backport of MR !11413
Merge branch 'backport-5692-rollover-zsk-prepub-step3-intermittent-test-fail-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11416
Commit c17ac42608 changed some tests to
wait for "zone_needdump" messages instead of "sending notifies", because
notifies are rate limited and "zone_needdump" happen on every change.
However, inspecting the logs, the "zone_needdump" changes happen more
than once (likely because the re-signing is done in batches):
received control channel command 'sign step3.zsk-prepub.manual'
zone_journal: zone step3.zsk-prepub.manual/IN (signed): enter
zone_needdump: zone step3.zsk-prepub.manual/IN (signed): enter
zone_journal: zone step3.zsk-prepub.manual/IN (signed): enter
zone_needdump: zone step3.zsk-prepub.manual/IN (signed): enter
zone_journal: zone step3.zsk-prepub.manual/IN (signed): enter
zone_needdump: zone step3.zsk-prepub.manual/IN (signed): enter
zone step3.zsk-prepub.manual/IN (signed): sending notifies
This means we are running the rollover step checks too fast in some
test runs.
Revert the wait for log change for the rollover-zsk-prepub test.
(cherry picked from commit 22c02a4df9)
Backport of MR !11309
Merge branch 'backport-matthijs-trust-chain-rollover-system-tests-9.20' into 'bind-9.20'
See merge request isc-projects/bind9!11399
A generic helper that calls environment-specified binaries has been added,
drop and replace the introduced CmdHelper for the more generic method.
(cherry picked from commit 594ff0816a)
Symlink ns1 and ns2 to rollover/ns1 and rollover/ns2.
Symlink ns3/template.db.j2.manual to rollover/ns3/template.db.j2.manual.
Since the bootstrapping is done before the templates are rendered
automatically, replace @DEFAULT_ALGORITHM@ in ns3/kasp.conf.j2 to
ecdsa256 and rename to ns3/kasp.conf.
(cherry picked from commit e172b4ff1a)
This test does not require a trust chain. Merely update the template
zone files to not point to the common template.
(cherry picked from commit 0016791c91)
This test does not require a trust chain. However, it does have a setup
script. Rewrite the setup shell script to a pytest bootstrap method.
(cherry picked from commit b6c091d113)
Symlink ns1 and ns2 to rollover/ns1 and rollover/ns2.
Symlink ns3/template.db.j2.manual to rollover/ns3/template.db.j2.manual.
Since the bootstrapping is done before the templates are rendered
automatically, replace @DEFAULT_ALGORITHM@ in ns3/kasp.conf.j2 to
ecdsa256 and rename to ns3/kasp.conf.
(cherry picked from commit 08236f4bd6)
