GitLab

The ns2 named instance in the "staticstub" system test is configured
with a single root hint commonly used in BIND system tests
(a.root-servers.nil with an address of 10.53.0.1), which is inconsistent
with authoritative data served by ns1.  This may cause intermittent
resolution failures, triggering false positives for the "staticstub"
system test.  Prevent this from happening by making ns1 serve data
corresponding to the contents of bin/tests/system/common/root.hint.

(cherry picked from commit 4b5e1da0)

[v9_14] Update GitLab CI to Fedora 30

See merge request !2213

Since Fedora 30 is the current Fedora release, replace Fedora 29 GitLab
CI jobs with their up-to-date counterparts.

(cherry picked from commit fac23cf9)

Resolve "Your problem or Cygwin's ?????"

See merge request !2211

(cherry picked from commit 12d96814)

(cherry picked from commit 91a0cb5d)

[v9_14] Alpine Linux tweaks

See merge request !2209

Ensure BIND is continuously tested on Alpine Linux as it is commonly
used as a base for Docker containers and employs a less popular libc
implementation, musl libc.

(cherry picked from commit 326a334b)

"PST8PDT" is a legacy time zone name whose use in modern code is
discouraged.  It so happens that using this time zone with musl libc
time functions results in different output than for other libc
implementations, which breaks the lib/isc/tests/time_test unit test.
Use the "America/Los_Angeles" time zone instead in order to get
consistent output across all tested libc implementations.

(cherry picked from commit f4daf6e0)

Appending output of a command to the same file as the one that command
is reading from is a dangerous practice.  It seems to have accidentally
worked with all the awk implementations we have tested against so far,
but for BusyBox awk, doing this may result in the input/output file
being written to in an infinite loop.  Prevent this from happening by
redirect awk output to a temporary file and appending its contents to
the original file in a separate shell pipeline.

(cherry picked from commit bb9c1654)

The Net::DNS Perl module needs the Digest::HMAC module to support TSIG.
However, since the latter is not a hard requirement for the former, some
packagers do not make Net::DNS depend on Digest::HMAC.  If Net::DNS is
installed on a host but Digest::HMAC is not, the "xfer" system test
breaks in a very hard-to-debug way (ans5 returns TSIG RRs with empty
RDATA, which prevents TSIG-signed SOA queries and transfers from
working).  Prevent this from happening by making the "xfer" system test
explicitly require Digest::HMAC apart from Net::DNS.

(cherry picked from commit b10d28d1)

The BusyBox version of sed treats leading '\+' in a regular expression
to be matched as a syntax error ("Repetition not preceded by valid
expression"), which triggers false positives for the "digdelv" system
test.  Make the relevant sed invocations work portably across all sed
implementations by removing the leading backslash.

(cherry picked from commit 266e3ed5)

The BusyBox version of awk treats some variables which other awk
implementations consider to be decimal values as octal values.  This
intermittently breaks key event interval calculations in the "autosign"
system test, trigger false positives for it.  Prevent the problem from
happening by stripping leading zeros from the affected awk variables.

(cherry picked from commit ad008f7d)

For some libc implementations, BUFSIZ is small enough (e.g. 1024 for
musl libc) to trigger compilation warnings about insufficient size of
certain buffers.  Since the relevant buffers are used for printing DNS
names, increase their size to '(n + 1) * DNS_NAME_FORMATSIZE', where 'n'
is the number of DNS names which are printed to a given buffer.  This
results in somewhat arbitrary, albeit nicely-aligned and large enough
buffer sizes.

(cherry picked from commit 33844556)

Including <sys/errno.h> instead of <errno.h> raises a compiler warning
when building against musl libc.  Always include <errno.h> instead of
<sys/errno.h> to prevent that compilation warning from being triggered
and to achieve consistency in this regard across the entire source tree.

(cherry picked from commit b5cd1460)

Make sure all unit tests include headers in a similar order:

 1. Three headers which must be included before <cmocka.h>.
 2. System headers.
 3. UNIT_TESTING definition, followed by the <cmocka.h> header.
 4. libisc headers.
 5. Headers from other BIND libraries.
 6. Local headers.

Also make sure header file names are sorted alphabetically within each
block of #include directives.

(cherry picked from commit 5381ac0f)

All unit tests define the UNIT_TESTING macro, which causes <cmocka.h> to
replace malloc(), calloc(), realloc(), and free() with its own functions
tracking memory allocations.  In order for this not to break
compilation, the system header declaring the prototypes for these
standard functions must be included before <cmocka.h>.

Normally, these prototypes are only present in <stdlib.h>, so we make
sure it is included before <cmocka.h>.  However, musl libc also defines
the prototypes for calloc() and free() in <sched.h>, which is included
by <pthread.h>, which is included e.g. by <isc/mutex.h>.  Thus, unit
tests including "dnstest.h" (which includes <isc/mem.h>, which includes
<isc/mutex.h>) after <cmocka.h> will not compile with musl libc as for
these programs, <sched.h> will be included after <cmocka.h>.

Always including <cmocka.h> after all other header files is not a
feasible solution as that causes the mock assertion macros defined in
<isc/util.h> to mangle the contents of <cmocka.h>, thus breaking
compilation.  We cannot really use the __noreturn__ or analyzer_noreturn
attributes with cmocka assertion functions because they do return if the
tested condition is true.  The problem is that what BIND unit tests do
is incompatible with Clang Static Analyzer's assumptions: since we use
cmocka, our custom assertion handlers are present in a shared library
(i.e. it is the cmocka library that checks the assertion condition, not
a macro in unit test code).  Redefining cmocka's assertion macros in
<isc/util.h> is an ugly hack to overcome that problem - unfortunately,
this is the only way we can think of to make Clang Static Analyzer
properly process unit test code.  Giving up on Clang Static Analyzer
being able to properly process unit test code is not a satisfactory
solution.

Undefining _GNU_SOURCE for unit test code could work around the problem
(musl libc's <sched.h> only defines the prototypes for calloc() and
free() when _GNU_SOURCE is defined), but doing that could introduce
discrepancies for unit tests including entire *.c files, so it is also
not a good solution.

All in all, including <sched.h> before <cmocka.h> for all affected unit
tests seems to be the most benign way of working around this musl libc
quirk.  While quite an ugly solution, it achieves our goals here, which
are to keep the benefit of proper static analysis of unit test code and
to fix compilation against musl libc.

(cherry picked from commit 59528d0e)

Merge branch 'michal/filter-aaaa-system-test-make-root-hints-consistent-with-authoritative-data-v9_14' into 'v9_14'

[v9_14] "filter-aaaa" system test: make root hints consistent with authoritative data

See merge request !2205

Resolvers in the "filter-aaaa" system test are configured with a single
root hint: "ns.rootservers.net", pointing to 10.53.0.1.  However,
querying ns1 for "ns.rootservers.net" results in NXDOMAIN answers.
Since the TTL for the root hint is set to 0, it may happen that a
resolver's ADB will be asked to return any known addresses for
"ns.rootservers.net", but it will only have access to a cached NXDOMAIN
answer for that name and an expired root hint, which will result in a
resolution failure, triggering a false positive for the "filter-aaaa"
system test.  Prevent this from happening by making all the root hints
consistent with authoritative data served by ns1.

(cherry picked from commit c19ebde1)

fix a bug that could cause an assert when configuring "geoip continent"

See merge request !2200

- incidentally fixed some typos in log messages

Fix the lib/dns/tests/Makefile.in to work without LD_WRAP

See merge request !2189

(cherry picked from commit b5583464)

Merge branch '1136-named-checkconf-should-report-missing-dnstap-output-option-when-dnstap-option-is-set-v9_14' into 'v9_14'

Resolve "named-checkconf should report missing dnstap-output option when dnstap option is set"

See merge request !2185

from named.conf when dnstap was specified

(cherry picked from commit a4f38bec)

doc/arm: correct default for rrset-order

See merge request !2183

Tony Finch authored Jul 10, 2019 and Ondřej Surý committed Jul 22, 2019

(cherry picked from commit bded8af7)

Add dnstap builds to CI

See merge request !2181

Michał Kępień authored Jul 19, 2019 and Ondřej Surý committed Jul 22, 2019

Ensure BIND with dnstap support enabled is being continuously tested by
adding --enable-dnstap to the ./configure invocation used for CentOS 7
and Debian sid builds in GitLab CI.

(cherry picked from commit 2bf44c6c)

Fix LD_WRAP test [v9_14]

See merge request !2180

Evan Hunt authored Apr 15, 2019 and Ondřej Surý committed Jul 22, 2019

When the unit test is linked with dynamic libraries, the wrapping
doesn't occur, probably because it's different translation unit.

To workaround the issue, we provide thin wrappers with *real* symbol
names that just call the mocked functions.

(cherry picked from commit 839ed789)

(cherry picked from commit 135519e5)

Merge branch '1106-interaction-between-dns64-and-rpz-can-cause-unexpected-results-v9_14' into 'v9_14'

Resolve "Interaction between dns64 and RPZ can cause unexpected results"

See merge request !2179

(cherry picked from commit b9a1c31d)

(cherry picked from commit 1eb64004)

(cherry picked from commit b9dc9b68)

Add Debian buster to CI

See merge request !2176

Michał Kępień authored Jul 19, 2019 and Ondřej Surý committed Jul 22, 2019

Ensure BIND is continuously tested on Debian 10 (buster) as it is the
current stable Debian release.

(cherry picked from commit 5f71d9c6)