GitLab

(cherry picked from commit 5e8b772a)

Merge branch '804-large-nsec3-responses-cause-failure-in-adding-records-to-ncache-and-eventually-formerr-instead-of-nxdomain-v9_11' into 'v9_11'

Resolve "Large NSEC3 responses cause failure in adding records to ncache and, eventually, FORMERR (instead of NXDOMAIN)"

See merge request !1316

(cherry picked from commit 3328116b)

(cherry picked from commit 604889e6)

Merge branch '804-large-nsec3-responses-cause-failure-in-adding-records-to-ncache-and-eventually-formerr-instead-of-nxdomain-2-v9_11' into 'v9_11'

Resolve "Large NSEC3 responses cause failure in adding records to ncache and, eventually, FORMERR (instead of NXDOMAIN)"

See merge request !1315

(cherry picked from commit 188c1843)

explictly convert ISC_R_NOSPACE from dns_message_parse to DNS_R_FORMERR and remove from dns_result_torcode

(cherry picked from commit 0c42a9c0)

Resolve "cookie test failed."

See merge request !1313

(cherry picked from commit 8a8d378d)

(v9_11) Run the regular pipelines only for merge requests, and run only the Debian sid...

See merge request !1311

Run the regular pipelines only for merge requests, and run only the Debian sid build for release branches

(cherry picked from commit 24961f60)

[v9_11] Fix cleanup upon an error before TCP socket creation

See merge request !1308

5123.	[bug]		dig could hang indefinitely after encountering an error
			before creating a TCP socket. [GL #692]

(cherry picked from commit 3242cb53)

When a query times out after a socket is created and associated with a
given dig_query_t structure, calling isc_socket_cancel() causes
connect_done() to be run, which in turn takes care of all necessary
cleanups.  However, certain errors (e.g. get_address() returning
ISC_R_FAMILYNOSUPPORT) may prevent a TCP socket from being created in
the first place.  Since force_timeout() may be used in code handling
such errors, connect_timeout() needs to properly clean up a TCP query
which is not associated with any socket.  Call clear_query() from
connect_timeout() after attempting to send a TCP query to the next
available server if the timed out query does not have a socket
associated with it, in order to prevent dig from hanging indefinitely
due to the dig_query_t structure not being detached from its parent
dig_lookup_t structure.

(cherry picked from commit 13975b32)

When a query times out and another server is available for querying
within the same lookup, the timeout handler - connect_timeout() - is
responsible for sending the query to the next server.  Extract the
relevant part of connect_timeout() to a separate function in order to
improve code readability.

(cherry picked from commit c108fc5c)

Before commit c2ec022f, using the "-b"
command line switch for dig did not disable use of the other address
family than the one to which the address supplied to that option
belonged to.  Thus, bind9_getaddresses() could e.g. prepare an
isc_sockaddr_t structure for an IPv6 address when an IPv4 address has
been passed to the "-b" command line option.  To avoid attempting the
impossible (e.g. querying an IPv6 address from a socket bound to an IPv4
address), a certain code block in send_tcp_connect() checked whether the
address family of the server to be queried was the same as the address
family of the socket set up for sending that query; if there was a
mismatch, that particular server address was skipped.

Commit c2ec022f made
bind9_getaddresses() fail upon an address family mismatch between the
address the hostname passed to it resolved to and the address supplied
to the "-b" command line option.  Such failures were fatal to dig back
then.

Commit 7f658603 made
bind9_getaddresses() failures non-fatal, but also ensured that a
get_address() failure in send_tcp_connect() still causes the given query
address to be skipped (and also made such failures trigger an early
return from send_tcp_connect()).

Summing up, the code block handling address family mismatches in
send_tcp_connect() has been redundant since commit
c2ec022f.  Remove it.

(cherry picked from commit ef1da873)

[v9_11] Track forwarder timeouts in fetch contexts

See merge request !1306

5122.	[bug]		In a "forward first;" configuration, a forwarder
			timeout did not prevent that forwarder from being
			queried again after falling back to full recursive
			resolution. [GL #315]

(cherry picked from commit 1df9ca9e)

Since following a delegation resets most fetch context state, address
marks (FCTX_ADDRINFO_MARK) set inside lib/dns/resolver.c are not
preserved when a delegation is followed.  This is fine for full
recursive resolution but when named is configured with "forward first;"
and one of the specified forwarders times out, triggering a fallback to
full recursive resolution, that forwarder should no longer be consulted
at each delegation point subsequently reached within a given fetch
context.

Add a new badnstype_t enum value, badns_forwarder, and use it to mark a
forwarder as bad when it times out in a "forward first;" configuration.
Since the bad server list is not cleaned when a fetch context follows a
delegation, this prevents a forwarder from being queried again after
falling back to full recursive resolution.  Yet, as each fetch context
maintains its own list of bad servers, this change does not cause a
forwarder timeout to prevent that forwarder from being used by other
fetch contexts.

(cherry picked from commit 33350626)

return ISC_R_NOTFOUND when name does not match the zone name

See merge request !1302

(cherry picked from commit bb57c7f7)

(cherry picked from commit 402190df)

indenting

See merge request !1291

(cherry picked from commit c69ad952)

update copyrights

See merge request !1289

[v9_11] Sync GitLab CI jobs with master

See merge request !1222

Resolve "Abort when memory allocation or other mandatory resource allocation fails"

See merge request !1278

(v9_11) Resolve "abort when memory allocation fails"

See merge request !1274

(cherry picked from commit 37ff7f63)

(cherry picked from commit c22241ae)