This prevents resolver timeouts for the reference (BIND 9.11) servers
used in respdiff tests run on Debian 11 "bullseye".
--with-randomdev=/dev/urandom is part of the "configure" template.
(cherry picked from commit 4d7e343813)
"buster" jobs are now only going to be run in scheduled pipelines.
"--without-gssapi" ./configure option of "bullseye" before it became the
base image is dropped from "bullseye"-the-base-image because it reduces
gcov coverage by 0.38 % (651 lines) and is used in Debian 9 "stretch".
"--enable-openssl-hash" is on purpose not being tested because it fails
linking when either of --with-ecdsa, --with-gost, --with-eddsa, or
--with-aes is used as well because it can't find f.e. HMAC_CTX_new() as
"-lcrypto" is missing:
/usr/bin/ld: ../../lib/isc/libisc.a(hmacmd5.o): in function `isc_hmacmd5_init':
/root/bind9/lib/isc/hmacmd5.c:49: undefined reference to `HMAC_CTX_new'
/usr/bin/ld: /root/bind9/lib/isc/hmacmd5.c:51: undefined reference to `EVP_md5'
/usr/bin/ld: /root/bind9/lib/isc/hmacmd5.c:51: undefined reference to `HMAC_Init_ex'
BIND 9.11 is in security-fixes-only-mode and configure.ac code should
not be fixed to include "-lcrypto" in this corner case; better eliminate
a pairwise hint.
(cherry picked from commit 910d595fbc)
Commit 9aa1c580 dropped dependency of "respdiff" and
"respdiff-third-party" jobs on "tarball-create" job because these jobs
don't need to depend on in (e.g., for its artifacts). This, however,
caused that respdiff jobs weren't started out-of-order and artifacts
from all the "Build" stage jobs plus "unit:gcc:buster:amd64" job were
downloaded to project directory and caused problems with compilation:
Originally, the dependency on "tarball-create" has been added in
45d59c50 to indicate that respdiff "is meant to operate on two different
BIND versions". It seems that the intent didn't work out, and we better
make it obvious that respdiff jobs don't depend on any other job and
should be run out-of-order.
(cherry picked from commit 87578efc71)
The order of directories with reference and test BIND 9 are now reversed
for respdiff.sh.
The data.mdb file has more than 10 GB and makes artifact download take
an unnecessarily long time.
(cherry picked from commit 2ececf2c02)
Alpine Linux image has OpenSSL 3.0.0 from the "edge" repository to test
OpenSSL 3.0.0 support in the BIND 9 "main" branch. However, this breaks
compilation of branches without OpenSSL 3.0.0 support and therefore
OpenSSL deprecated declarations need to be suppressed with
-DOPENSSL_SUPPRESS_DEPRECATED.
Support for FreeBSD 11.4, the last FreeBSD 11.x release, ended on
September 30, 2021.
Link: https://www.freebsd.org/security/unsupported/
Also drop $WITH_READLINE_LIBEDIT from clang:freebsd13:amd64, it should
not have been added in the first place.
(cherry picked from commit 981579f379)
Every cppcheck update brings the cost of addressing new false positives
in the BIND 9 source code while not reaping any benefits in case of
identified issues with the code.
(cherry picked from commit 654cc61bb9)
With switching the gcc:pkcs11 CI jobs from Debian Buster to Fedora, we
don't need two Fedora CI jobs, which differ only by leveraging PKCS#11
or OpenSSL.
SoftHSM v2.4 was dropped from the base image because it is being
upgraded to Debian Bullseye, which has SoftHSM v2.6, the same version we
already have in the Fedora image, and use it in the "main" branch for
PKCS#11 testing. However, on the "v9_11" branch, to sustain PKCS#11
testing, gcc:pkcs11 CI jobs need to be ported from the base image to the
Fedora image.
Gitlab feature
https://docs.gitlab.com/ee/ci/pipelines/settings.html#auto-cancel-redundant-pipelines
can automatically cancel jobs which operate on an outdated code, i.e. on
branches which received new commits while jobs with an older set of
commits are still running. For this feature to work jobs have to be
configured with boolean interruptible: true.
I think practically all of our current CI jobs can be cancelled,
so the option is now on by default for all jobs.
PyLint 2.11 reports a new warning, C0209 (consider-using-f-string).
Since f-strings are only available in Python 3.6+, existing scripts
cannot be updated to use this feature just yet because they would stop
working with older Python versions. Instead, disable PyLint warning
C0209 for the time being.
(cherry picked from commit 860ca4e0ef)
Previously, when lame cache would be disabled by setting lame-ttl to 0,
it would also disable lame answer detection. In this commit, we enable
the lame response detection even when the lame cache is disabled. This
enables stopping answer processing early rather than going through the
whole answer processing flow.
The lame-ttl cache is implemented in ADB as per-server locked
linked-list "indexed" with <qname,qtype>. This list has to be walked
every time there's a new query or new record added into the lame cache.
Determined attacker can use this to degrade performance of the resolver.
Resolver testing has shown that disabling the lame cache has little
impact on the resolver performance and it's a minimal viable defense
against this kind of attack.
Michal Nowak
Petr Špaček
Ondřej Surý
Ondřej SurýandOndřej Surý
Michał Kępień
Tinderbox UserandMichał Kępień