Mark Andrews authored Oct 24, 2019 and Ondřej Surý committed Oct 31, 2019

(cherry picked from commit d8abf4f5)

[v9_11] Prevent TCP failures from affecting EDNS stats

See merge request !2512

5310.	[bug]		TCP failures were affecting EDNS statistics. [GL #1059]

(cherry picked from commit 36d3c66e)

EDNS mechanisms only apply to DNS over UDP.  Thus, errors encountered
while sending DNS queries over TCP must not influence EDNS timeout
statistics.

(cherry picked from commit fce3c93e)

[v9_11] Fix copyrights

See merge request !2510

[v9_11] Prevent query loops for misbehaving servers

See merge request !2509

If a TCP connection fails while attempting to send a query to a server,
the fetch context will be restarted without marking the target server as
a bad one.  If this happens for a server which:

  - was already marked with the DNS_FETCHOPT_EDNS512 flag,
  - responds to EDNS queries with the UDP payload size set to 512 bytes,
  - does not send response packets larger than 512 bytes,

and the response for the query being sent is larger than 512 byes, then
named will pointlessly alternate between sending UDP queries with EDNS
UDP payload size set to 512 bytes (which are responded to with truncated
answers) and TCP connections until the fetch context retry limit is
reached.  Prevent such query loops by marking the server as bad for a
given fetch context if the advertised EDNS UDP payload size for that
server gets reduced to 512 bytes and it is impossible to reach it using
TCP.

(cherry picked from commit 6cd11599)

Make "geoip-use-ecs yes;" work for GeoIP2

See merge request !2476

5309.	[bug]		"geoip-use-ecs yes;" was not working for GeoIP2.
			[GL #1275]

Add a missing preprocessor condition to make "geoip-use-ecs yes;" work
for GeoIP2.

Merge branch '1288-log-dns_r_unchanged-from-sync_secure_journal-at-info-level-in-receive_secure_serial-v9_11' into 'v9_11'

Resolve "Log DNS_R_UNCHANGED from sync_secure_journal at info level in receive_secure_serial."

See merge request !2499

(cherry picked from commit e6ef7858)

(cherry picked from commit 8eb09f32)

Fix hang in `named-compilezone | head`

See merge request !2497

Tony Finch authored Oct 22, 2019 and Mark Andrews committed Oct 30, 2019

(cherry picked from commit 548f29a4)

Tony Finch authored Oct 22, 2019 and Mark Andrews committed Oct 30, 2019

I was truncating zone files for experimental purposes when I found
that `named-compilezone | head` got stuck. The full command line that
exhibited the problem was:

	dig axfr dotat.at |
	named-compilezone -o /dev/stdout dotat.at /dev/stdin |
	head

This requires a large enough zone to exhibit the problem, more than
about 70000 bytes of plain text output from named-compilezone.
I was running the command on Debian Stretch amd64.

This was puzzling since it looked like something was suppressing the
SIGPIPE. I used `strace` to examine what was happening at the hang.
The program was just calling write() a lot to print the zone file, and
the last write() hanged until I sent it a SIGINT.

During some discussion with friends, Ian Jackson guessed that opening
/dev/stdout O_RDRW might be the problem, and after some tests we found
that this does in fact suppress SIGPIPE.

Since `named-compilezone` only needs to write to its output file, the
fix is to omit the stdio "+" update flag.

(cherry picked from commit a87ccea0)

[v9_11] Add CentOS 8 to GitLab CI

See merge request !2493

Ensure BIND can be tested on CentOS 8 in GitLab CI to more quickly catch
build and test errors on that operating system.

(cherry picked from commit dce1c050)

Resolve "dnstap per view configuration"

See merge request !2480

(cherry picked from commit 6ce1e2e7)

(cherry picked from commit c2fcc9f1)

(cherry picked from commit f3d53630)

Fix GitLab CI for v9_11

See merge request !2475

This reverts commit 26e80285.

Ondřej Surý authored Oct 01, 2019 and Michał Kępień committed Oct 17, 2019

(cherry picked from commit 3b339eb4)

Ondřej Surý authored Oct 01, 2019 and Michał Kępień committed Oct 17, 2019

(cherry picked from commit cc4c5482)

[v9_11] Address cppcheck 1.89 warnings

See merge request !2474

cppcheck 1.89 emits a false positive for lib/isc/sha1.c:

    lib/isc/sha1.c:273:16: error: Uninitialized variable: block [uninitvar]
     (void)memmove(block, buffer, 64);
                   ^
    lib/isc/sha1.c:272:10: note: Assignment 'block=&workspace', assigned value is <Uninit>
     block = &workspace;
             ^
    lib/isc/sha1.c:273:16: note: Uninitialized variable: block
     (void)memmove(block, buffer, 64);
                   ^

This message started appearing with cppcheck 1.89 [1], but it will be
gone in the next release [2], so just suppress it for the time being.

[1] https://github.com/danmar/cppcheck/commit/af214e8212efa303e664920a468de00ee0b1fe3d

[2] https://github.com/danmar/cppcheck/commit/2595b826349a7ffbe1c958b806498b6e336bea33

[v9_11] Remove remnants of the --with-cc-alg option

See merge request !2470

Commit afa81ee4 omitted some spots in
the source tree which are still referencing the removed --with-cc-alg
"configure" option.  Make sure the latter is removed completely.

(cherry picked from commit 428dcf3b)

[v9_11] Limit triggers for OpenBSD system test jobs

See merge request !2466

When a GitLab CI runner is not under load, a single OpenBSD system test
job completes in about 12 minutes, which is considered decent.  However,
such jobs are usually multiplexed with other system test jobs on the
same host, which causes each of them to take even 40 minutes to
complete.  Taking retries into account, this is completely unacceptable
for everyday use, so only start OpenBSD system test jobs for pipelines
created through GitLab's web interface and for pipelines created for Git
tags.

(cherry picked from commit 603e0456)

[v9_11] Minor GitLab CI tweaks

See merge request !2465

Since the Windows build job does not use the files created as a result
of running "autoreconf -fi" in the "autoreconf:sid:amd64" job, set its
dependencies to an empty list.

Since it is currently not possible to use "needs: []" for jobs which do
not belong to the first stage of a pipeline, set the "needs" key for the
Windows build job to the "autoreconf:sid:amd64" job so that all build
jobs are started at the same time (without this change, the Windows
build job does not start until all jobs in the "precheck" stage are
finished).

As a side note, these changes also attempt to eliminate intermittent,
bogus GitLab error messages ("There has been a missing dependency
failure").

(cherry picked from commit dd97dfdc)

The intended purpose of the "autoreconf:sid:amd64" GitLab CI job is to
run "autoreconf -fi" and then pass the updated files on to subsequent
non-Windows build jobs.  However, the artifacts currently created by
that job only include files which are not tracked by Git.  Since we
currently do track e.g. "configure" with Git, the aforementioned job is
essentially a no-op.  Fix by manually specifying the files generated by
the "autoreconf:sid:amd64" job that should be passed on to subsequent
build jobs.

(cherry picked from commit e83b322f)

[v9_11] Add OpenBSD to GitLab CI

See merge request !2460

Ensure BIND can be tested on OpenBSD in GitLab CI to more quickly catch
build and test errors on that operating system.

Some notes:

  - While GCC is packaged for OpenBSD, only old versions (4.2.1, 4.9.4)
    are readily available and none of them is the default system
    compiler, so we are only doing Clang builds in GitLab CI.

  - Unit tests are currently not run on OpenBSD because it ships with an
    old version of kyua which does not handle skipped tests properly.
    These jobs will be added when we move away from using kyua in the
    future as the test code itself works fine.

  - All OpenBSD jobs are run inside QEMU virtual machines, using GitLab
    Runner Custom executor.

(cherry picked from commit 07d2fcb5)

Consider the following Makefile:

    foo:
    	false

On OpenBSD, the following happens for this Makefile:

  - "make foo" returns 1,
  - "make -k foo" returns 0,
  - "make -k -j6 foo" returns 1.

However, if the .NOTPARALLEL pseudo-target is added to this Makefile,
"make -k -j6 foo" will return 0 as well.

Since bin/tests/Makefile contains the .NOTPARALLEL pseudo-target,
running "make -k -j6 test" from bin/tests/ on OpenBSD prevents any
errors from being reported through that command's exit code.

Work around the issue by running "make -k -j6 test" in the
bin/tests/system/ directory instead as bin/tests/system/Makefile does
not contain the .NOTPARALLEL pseudo-target and thus things work as
expected there.

(cherry picked from commit 6b5426e1)