GitLab

Prevent TSAN being trigged when DNS_RBTFIND_EMPTYDATA is set

See merge request !2369

Protect globally accessed variables in rndc.c by making them atomic

See merge request !2370

Fix unprotected access to rbtnode in lib/dns/rbtdb.c:add32()

See merge request !2371

lib/isc/unix/socket.c: Convert couple isc__socket_t members to atomic to prevent data race

See merge request !2356

Move the lock from internal_{accept,connect,recv,send} to global level to protect more socket variables

Resolve "named crashes when setting nsec3param"

Closes #1205

See merge request !2300

Addresses the database changing w/o the changes being done under task lock.
Fix: build the database before assigning it to the zone.

Run FreeBSD jobs automatically for all pipelines

See merge request !2350

No problems have been observed on the FreeBSD GitLab CI runner during
the burn-in period, when FreeBSD jobs needed to be triggered manually.
Thus, make the FreeBSD jobs run automatically along other GitLab CI
jobs.

Find docbook-xsl and dblatex templates on Red Hat/Fedora

See merge request !2324

`/usr/share/sgml/docbook/xsl-stylesheets` and `/usr/share/dblatex` are
places where docbook-style-xsl and, respectively, dblatex packages on
Red Hat systems put their XSL templates. Unless we hint this place it
has to be added to `./configure` manually (`--with-docbook-xsl=...`):
https://src.fedoraproject.org/rpms/bind/blob/master/f/bind.spec#_691.

On Fedora 30:

Before
```
./configure
...
checking for Docbook-XSL path... auto
checking for html/docbook.xsl... "not found"
checking for xhtml/docbook.xsl... "not found"
checking for manpages/docbook.xsl... "not found"
checking for html/chunk.xsl... "not found"
checking for xhtml/chunk.xsl... "not found"
checking for html/chunktoc.xsl... "not found"
checking for xhtml/chunktoc.xsl... "not found"
checking for html/maketoc.xsl... "not found"
checking for xhtml/maketoc.xsl... "not found"
checking for xsl/docbook.xsl... "not found"
checking for xsl/latex_book_fast.xsl... "not found"
```

After:
```
./configure
...
checking for Docbook-XSL path... auto
checking for html/docbook.xsl... /usr/share/sgml/docbook/xsl-stylesheets/html/docbook.xsl
checking for xhtml/docbook.xsl... /usr/share/sgml/docbook/xsl-stylesheets/xhtml/docbook.xsl
checking for manpages/docbook.xsl... /usr/share/sgml/docbook/xsl-stylesheets/manpages/docbook.xsl
checking for html/chunk.xsl... /usr/share/sgml/docbook/xsl-stylesheets/html/chunk.xsl
checking for xhtml/chunk.xsl... /usr/share/sgml/docbook/xsl-stylesheets/xhtml/chunk.xsl
checking for html/chunktoc.xsl... /usr/share/sgml/docbook/xsl-stylesheets/html/chunktoc.xsl
checking for xhtml/chunktoc.xsl... /usr/share/sgml/docbook/xsl-stylesheets/xhtml/chunktoc.xsl
checking for html/maketoc.xsl... /usr/share/sgml/docbook/xsl-stylesheets/html/maketoc.xsl
checking for xhtml/maketoc.xsl... /usr/share/sgml/docbook/xsl-stylesheets/xhtml/maketoc.xsl
checking for xsl/docbook.xsl... /usr/share/dblatex/xsl/docbook.xsl
checking for xsl/latex_book_fast.xsl... /usr/share/dblatex/xsl/latex_book_fast.xsl
```

Remove the current directory from the flycheck configuration

See merge request !2347

Resolve "Legal issue with pkcs11 headers"

Closes #414

See merge request !2251

* CKR_CRYPTOKI_ALREADY_INITIALIZED: This value can only be returned by
  `C_Initialize`. It means that the Cryptoki library has already been
  initialized (by a previous call to `C_Initialize` which did not have a
  matching `C_Finalize` call).

* CKR_FUNCTION_NOT_SUPPORTED: The requested function is not supported by this
  Cryptoki library. Even unsupported functions in the Cryptoki API should have a
  “stub” in the library; this stub should simply return the value
  CKR_FUNCTION_NOT_SUPPORTED.

* CKR_LIBRARY_LOAD_FAILED: The Cryptoki library could not load a dependent
  shared library.

The OASIS pkcs11.h header has a restrictive license.  Replace the
pkcs11.h pkcs11f.h and pkcs11t.h headers with pkcs11.h from p11-kit.

For source distribution, the license for the OASIS headers itself
doesn't pose any licensing problem when combined with MPL license, but
it possibly creates problem for downstream distributors of BIND 9.

Check isc_mutex_{lock,unlock}() return values in mutexatomic.h shim

See merge request !2343

Resolve "Invalid reference counting"

Closes #1184

See merge request !2266

The isc_refcount_decrement() was either used as:

    if (isc_refcount_decrement() == 1) { destroy(); }

or

    if (isc_refcount_decrement() != 1) { return; } destroy();

This commits eradicates the last usage of the later, so the code is unified to
use the former.

Various README.md and README fixes

See merge request !2323

Fixing typos, typographical glitches. Added backticks around binaries,
modules, and libraries so it's more consistent. Added a paragraph with
ISC Security Policy.

Add FreeBSD to CI

See merge request !2242

Ensure BIND can be tested on FreeBSD in GitLab to more quickly catch
build and test errors on that operating system.  Make the relevant jobs
optional until the CI environment supporting them is deemed stable
enough for continuous use.

FreeBSD jobs are run using the Custom executor feature of GitLab Runner.
Unlike the Docker executor, the Custom executor does not support the
"image" option and thus some way of informing the runner about the OS
version to use for a given job is necessary.  Arguably the simplest way
of doing that without a lot of code duplication in .gitlab-ci.yml would
be to use a YAML template with a "variables" block specifying the
desired FreeBSD release to use, but including such a template in a job
definition would cause issues in case other variables also needed to be
set for that job (e.g. CFLAGS or EXTRA_CONFIGURE for build jobs).  Thus,
only one FreeBSD YAML template is defined instead and the Custom
executor scripts on FreeBSD runners extract the OS version to use from
the CI job name.  This allows .gitlab-ci.yml variables to be defined for
FreeBSD jobs in the same way as for Docker-based jobs.

Currently, the lib/dns/tests/tkey_test unit test is only run when the
linker supports the --wrap option.  However, linker support for that
option is only needed for static builds.  As a result, the unit test
mentioned before is not being run everywhere it can be run as even for
builds done using --with-libtool, the test is not run unless the linker
supports the --wrap option.

Tweak preprocessor directives in lib/dns/tests/tkey_test.c so that this
test is run:

  - for all builds using --with-libtool,
  - for static builds done using a linker supporting the --wrap option.

Weak symbols are handled differently by different dynamic linkers.  With
glibc, lib/dns/tests/tkey_test works as expected no matter whether
--with-libtool is used or not: __attribute__((weak)) prevents a static
build from failing and it just so happens that the desired symbols are
picked at runtime for dynamic builds.  However, with BSD libc, the
libdns functions called from lib/dns/tests/tkey_test.c use the "real"
memory allocation functions from libisc, thus breaking that unit test.
(Note: similar behavior can be reproduced with glibc by setting the
LD_DYNAMIC_WEAK environment variable.)

The simplest way to make lib/dns/tests/tkey_test work reliably is to
drop all uses of __attribute__((weak)) in it - this way, the memory
functions inside lib/dns/tests/tkey_test.c will always be used instead
of the "real" libisc ones for dynamic builds.  However, this would not
work with static builds as it would result in multiple strong symbols
with the same name being present in a single binary.

Work around the problem by only compiling in the overriding definitions
of memory functions when building using --with-libtool.  For static
builds, keep relying on the --wrap linker option for replacing calls to
the functions we are interested in.

When kyua is called without the --logfile command line option, the log
file is created at a default location which is derived from the HOME
environment variable.  On FreeBSD GitLab CI runners, /home is a
read-only directory and thus kyua invocations not using the --logfile
option fail when HOME is set to something beneath /home.  Set --logfile
to /dev/null for all kyua invocations whose logs are irrelevant in order
to prevent kyua failures caused by HOME being non-writable.

Miscellaneous documentation fixes

See merge request !2329