GitLab

Merge branch '804-large-nsec3-responses-cause-failure-in-adding-records-to-ncache-and-eventually-formerr-instead-of-nxdomain' into 'master'

Resolve "Large NSEC3 responses cause failure in adding records to ncache and, eventually, FORMERR (instead of NXDOMAIN)"

Closes #804

See merge request !1295

Merge branch '804-large-nsec3-responses-cause-failure-in-adding-records-to-ncache-and-eventually-formerr-instead-of-nxdomain-2' into 'master'

Resolve "Large NSEC3 responses cause failure in adding records to ncache and, eventually, FORMERR (instead of NXDOMAIN)"

Closes #804

See merge request !1298

explictly convert ISC_R_NOSPACE from dns_message_parse to DNS_R_FORMERR and remove from dns_result_torcode

Resolve "cookie test failed."

Closes #812

See merge request !1300

Run the regular pipelines only for merge requests, and run only the Debian sid...

See merge request !1309

Run the regular pipelines only for merge requests, and run only the Debian sid build for release branches

Fix cleanup upon an error before TCP socket creation

Closes #692

See merge request !1100

5123.	[bug]		dig could hang indefinitely after encountering an error
			before creating a TCP socket. [GL #692]

When a query times out after a socket is created and associated with a
given dig_query_t structure, calling isc_socket_cancel() causes
connect_done() to be run, which in turn takes care of all necessary
cleanups.  However, certain errors (e.g. get_address() returning
ISC_R_FAMILYNOSUPPORT) may prevent a TCP socket from being created in
the first place.  Since force_timeout() may be used in code handling
such errors, connect_timeout() needs to properly clean up a TCP query
which is not associated with any socket.  Call clear_query() from
connect_timeout() after attempting to send a TCP query to the next
available server if the timed out query does not have a socket
associated with it, in order to prevent dig from hanging indefinitely
due to the dig_query_t structure not being detached from its parent
dig_lookup_t structure.

When a query times out and another server is available for querying
within the same lookup, the timeout handler - connect_timeout() - is
responsible for sending the query to the next server.  Extract the
relevant part of connect_timeout() to a separate function in order to
improve code readability.

Before commit c2ec022f, using the "-b"
command line switch for dig did not disable use of the other address
family than the one to which the address supplied to that option
belonged to.  Thus, bind9_getaddresses() could e.g. prepare an
isc_sockaddr_t structure for an IPv6 address when an IPv4 address has
been passed to the "-b" command line option.  To avoid attempting the
impossible (e.g. querying an IPv6 address from a socket bound to an IPv4
address), a certain code block in send_tcp_connect() checked whether the
address family of the server to be queried was the same as the address
family of the socket set up for sending that query; if there was a
mismatch, that particular server address was skipped.

Commit c2ec022f made
bind9_getaddresses() fail upon an address family mismatch between the
address the hostname passed to it resolved to and the address supplied
to the "-b" command line option.  Such failures were fatal to dig back
then.

Commit 7f658603 made
bind9_getaddresses() failures non-fatal, but also ensured that a
get_address() failure in send_tcp_connect() still causes the given query
address to be skipped (and also made such failures trigger an early
return from send_tcp_connect()).

Summing up, the code block handling address family mismatches in
send_tcp_connect() has been redundant since commit
c2ec022f.  Remove it.

Track forwarder timeouts in fetch contexts

Closes #315

See merge request !826

5122.	[bug]		In a "forward first;" configuration, a forwarder
			timeout did not prevent that forwarder from being
			queried again after falling back to full recursive
			resolution. [GL #315]

Since following a delegation resets most fetch context state, address
marks (FCTX_ADDRINFO_MARK) set inside lib/dns/resolver.c are not
preserved when a delegation is followed.  This is fine for full
recursive resolution but when named is configured with "forward first;"
and one of the specified forwarders times out, triggering a fallback to
full recursive resolution, that forwarder should no longer be consulted
at each delegation point subsequently reached within a given fetch
context.

Add a new badnstype_t enum value, badns_forwarder, and use it to mark a
forwarder as bad when it times out in a "forward first;" configuration.
Since the bad server list is not cleaned when a fetch context follows a
delegation, this prevents a forwarder from being queried again after
falling back to full recursive resolution.  Yet, as each fetch context
maintains its own list of bad servers, this change does not cause a
forwarder timeout to prevent that forwarder from being used by other
fetch contexts.

return ISC_R_NOTFOUND when name does not match the zone name

See merge request !1299

placeholder

See merge request !1297

placeholder

See merge request !1294

indenting

See merge request !1286

update copyrights

See merge request !1287

fix typo in readme

See merge request !1282

placeholder

See merge request !1277

placeholder

See merge request !1276

Update git-replay-merge.sh script

See merge request !1275

Add optional description field to LDAP schema

Closes #768

See merge request !1267