The dns_rrl function's return type, dns_rrl_result_t, is an enumerated
type defined in file lib/dns/include/dns/rrl.h, before the result code
API update, the previous returning of ISC_R_SUCCESS within this function
was compatible with DNS_RRL_RESULT_OK, both had the same value of zero.
After the refactor of the result code API, this is no more true, these
result codes hold different values, besides, the correct result code to
use within this function is DNS_RRL_RESULT_OK and not ISC_R_SUCCESS.
- Result code descriptions and IDs (strings) are now defined in
lib/isc/result_<class>.c.in source files. See lib/isc/result_*.c.in
for examples.
- To create a new result class, check isc/resultclass.h and follow
documentation in there.
- Error codes are now defined in the following fashion:
ISC_RESULTCODE_<CLASS>(number), old style was
ISC_RESULTCLASS_<CLASS> + number.
Following is an example of the old style converted to the new one,
file lib/dns/result_dst.h.in:
;; Old style
#define DST_R_NOCRYPTO (ISC_RESULTCLASS_DST + 2)
;; New Style
#define DST_R_NOCRYPTO ISC_RESULTCODE_DST(2)
- To use error codes, same as before:
isc_result_t code = DST_R_NOCRYPTO;
isr_result_t rc = some_call(..)
if (rc == ISC_R_SUCCESS) ...
- isc_result_totext() does not lock anymore, since all result data from
all classes are available at compile time.
All relevant source files were updated to use the new result API
interface.
This commit automatically generates two files during compile time,
which will be used by the new result API implementation.
lib/isc/result_ext.c: result of combining lib/*/result_*.c.in files.
lib/isc/include/isc/result_ext.h: result of combining
lib/*/result_*.h.in files.
result_ext.c will be included by lib/isc/result.c to have all relevant
symbols available during compile time, this substitutes the old method
of having each library calling <libname>_result_register() functions.
result_ext.h will be included by lib/isc/include/isc/result.h, so source
files can now include only <isc/result.h> to have all the ISC result
codes available.
With the new result API, source files only need to include
<isc/result.h> to have isc_result_(totext|toid) functions available and
able to handle different library results, isc, isccc, dst and so on...
To allow for that, a new structure for defining result codes per library
was employed, it is implemented as follow:
- Suppose a new library called "foo" is being added to BIND.
- Two source files must be added to <BIND_ROOT>/lib/foo/:
result_foo.h.in: The header file defines result codes that may be
returned by functions within the library.
result_foo.c.in: The source file define two string arrays, used for
conversion between library result codes and their string
representation, the array <libname>_result_descriptions define a
comphreensive description of a given result code, while
<libname>_result_ids is a 1:1 result code to string.
On top of this structure, during the build phase all
lib/*/result_<libname>.c.in files will be concatenated to a file named
lib/isc/result_ext.c, which will be included by lib/isc/result.c, so
all the symbols will be available during compile time, thus making the
use of locking to manage the table of result codes not necessary
anymore.
In the same fashion, during the build phase all
lib/*/result_<libname>.h.in files will be concatenated to a file named
lib/isc/include/isc/result_ext.h, which will be included by
lib/isc/include/isc/result.h, thus exporting all error codes of all
libraries in a unified way.
The code for automatically generating such files will be added in the
subsequent commit.
Note: result codes from lib/dns/include/dns/result.h were moved to a new
file: lib/dns/result_dns.h.in, the dns/result.h file was kept since it
defines an extra function 'dns_result_torcode' that is implemented in
lib/dns/result.c, similary, string tables with dns result codes were
moved from lib/dns/result.c to lib/dns/result_dns.c.in to follow the new
result code API structure.
Use semantic patch from the previous commit, which also describes in
details why these includes are being removed.
The wrapping directives around #include <pk11/result.h> were manually
removed: #if USE_PKCS11 / #endif
The internal implementation of isc_result API is being updated, before
the update each internal library had to register their error results
using a respective <lib>_result_register() call during runtime, these
operations required locking to manage an internal data structure.
In the same fashion, locking was required when calling
isc_result_totext and isc_result_toid functions.
To avoid locking, the table of error codes will now be statically
created during compile time, also the result API is now unified and
can be accessed through isc/result.h only header, with dns/result.h
being an exception, it should still be included separately as
dns_result_torcode() function depends on a type defined in the dns
library.
- dns_result_register()
- dst_result_register()
- isccc_result_register()
- pk11_result_register()
Use the semantic patch from the previous commit to remove all function
calls listed above.
This commit also removes the above listed functions from
lib/*/win32/lib*.def.in files.
It also manually removes the preprocessor directives surrounding
pk11_result_register():
- #if USE_PKCS11
pk11_result_register();
- #endif /* if USE_PKCS11 */
Added a semantic patch to remove the following calls:
- dns_result_register()
- dst_result_register()
- isccc_result_register()
- pk11_result_register()
Code in this branch will change error/result codes API to make them
static (defined at compile/link time), thus it won't be necessary to
dynamically register them with <class>_result_register() calls anymore.
The gcc:tarball CI job may identify problems with tarballs created by
"make dist" of the tarball-create CI job. Enabling the gcc:tarball CI
job in web-triggered pipelines provides developers with a test vector.
Some man pages (e.g. dnstap-read.1, named-nzd2nzf.1) should only be
installed conditionally (when the relevant features are enabled in a
given BIND 9 build). This is achieved using Automake conditionals.
However, while all source reStructuredText files are included in
tarballs produced by "make dist" (distribution tarballs) as they should
be, the list of pre-generated man pages included in distribution
tarballs incorrectly depends on the ./configure switches used for the
build for which "make dist" is run. Meanwhile, distribution tarballs
should always contain all the files necessary to build any flavor of
BIND 9.
Here is an example scenario which fails to work as intended:
autoreconf -i
./configure --disable-maintainer-mode
make dist
tar --extract --file bind-9.17.11.tar.xz
cd bind-9.17.11
./configure --disable-maintainer-mode --enable-dnstap
make
Fix by always including pre-generated versions of all conditionally
installed man pages in EXTRA_DIST. While this may cause some of them to
appear in EXTRA_DIST more than once (depending on the ./configure
switches used for the build for which "make dist" is run), it seems to
not be a problem for Automake.
add matching macros to pass arguments from called methods
to generic methods. This will reduce the amount of work
required when extending methods.
Also cleanup unnecessary UNUSED declarations.
util.h requires ISC_CONSTRUCTOR definition, which depends on config.h
inclusion. It does not include it from isc/util.h (or any other header).
Using isc/util.h fails hard when isc/util.h is used without including
bind's config.h.
Move the check to c file, where ISC_CONSTRUCTOR is used. Ensure config.h
is included there.
Added tests to ensure that dig won't retry sending a query over tcp
(+tcp) when a TCP connection is closed prematurely (EOF is read) if
either +tries=1 or retry=0 is specified on the command line.
Now that premature EOF on tcp connections take +tries and +retry into
account, the dig system tests handling TCP EOF with +tries=1 were
expecting dig to do a second attempt in handling the tcp query, which
doesn't happen anymore.
To make the test work as expected +tries value was adjusted to 2, to
make it behave as before after the new update on dig.
Before this commit, a premature EOF (connection closed) on tcp queries
was causing dig to automatically attempt to send the query again, even
if +tries=1 or +retries=0 was provided on command line.
This commit fix the problem by taking into account the no. of retries
specified by the user when processing a premature EOF on tcp
connections.
Add kasp.sh to the list of scripts copied from the source directory to
the build directory before any test is run. This will fix
the out-of-tree test failures introduced in commit
ecb073bdd6 on the 'main' branch.
When calling "rndc dnssec -checkds", it may take some milliseconds
before the appropriate changes have been written to the state file.
Add retry_quiet mechanisms to allow the write operation to finish.
Also retry_quiet the check for the next key event. A "rndc dnssec"
command may trigger a zone_rekey event and this will write out
a new "next key event" log line, but it may take a bit longer than
than expected in the tests.
Call 'dns_zone_rekey' after a 'rndc dnssec -checkds' or 'rndc dnssec
-rollover' command is received, because such a command may influence
the next key event. Updating the keys immediately avoids unnecessary
rollover delays.
The kasp system test no longer needs to call 'rndc loadkeys' after
a 'rndc dnssec -checkds' or 'rndc dnssec -rollover' command.
CDS/CDNSKEY DELETE records are only useful if they are signed,
otherwise the parent cannot verify these RRsets anyway. So once the DS
has been removed (and signaled to BIND), we can remove the DNSKEY and
RRSIG records, and at this point we can also remove the CDS/CDNSKEY
records.
Change the 'check_keys' function to try three times. Some intermittent
kasp test failures are because we are inspecting the key files
before the actual change has happen. The 'retry_quiet' approach allows
for a bit more time to let the write operation finish.
This MR introduces a new system test 'keymgr2kasp' to test
migration to 'dnssec-policy'. It moves some existing tests from
the 'kasp' system test to here.
Also a common script 'kasp.sh', to be used in kasp specific tests,
is introduced.
The 'keymgr_key_init()' function initializes key states if they have
not been set previously. It looks at the key timing metadata and
determines using the given times whether a state should be set to
RUMOURED or OMNIPRESENT.
However, the DNSKEY and ZRRSIG states were mixed up: When looking
at the Activate timing metadata we should set the ZRRSIG state, and
when looking at the Published timing metadata we should set the
DNSKEY state.
Add two test zones that migrate to dnssec-policy. Test if the key
states are set accordingly given the timing metadata.
The rumoured.kasp zone has its Publish/Active/SyncPublish times set
not too long ago so the key states should be set to RUMOURED. The
omnipresent.kasp zone has its Publish/Active/SyncPublish times set
long enough to set the key states to OMNIPRESENT.
Slightly change the init_migration_keys function to set the
key lifetime to "none" (legacy keys don't have lifetime). Then in the
test case set the expected key lifetime explicitly.
This commit is somewhat editorial as it does not introduce something
new nor fixes anything.
The layout in keymgr2kasp/tests.sh has been changed, with the
intention to make more clear where a test scenario ends and begins.
The publication time of some ZSKs has been changed. It makes a more
clear distinction between publication time and activation time.
The kasp system test was getting pretty large, and more tests are on
the way. Time to split up. Move tests that are related to migrating
to dnssec-policy to a separate directory 'keymgr2kasp'.
The named-checkzone tool can also be invoked as named-compilezone. Make
sure a man page is installed for that alias. Move and rename the
"man_named-checkzone" label to prevent a Sphinx duplicate label warning
from being raised (see commit 84862e96c1
for more information).
The named-nzd2nzf utility is only built and installed for LMDB-enabled
builds. Adjust the relevant Makefile.am file to make sure the
named-nzd2nzf.1 man page is also only built and installed for
LMDB-enabled builds.
The dnstap-read utility is only built and installed for dnstap-enabled
builds. Adjust the relevant Makefile.am file to make sure the
dnstap-read.1 man page is also only built and installed for
dnstap-enabled builds.
Issue #2575 was merged to 9.16 only as change 5603, but a placeholder
was not added to CHANGES in the main branch. This commit adds the
placeholder and renumbers the two subsequent changes.
Resolve "dig -u is extremely inaccurate, especially on machines with the kernel timer tick set at 100Hz"
Closes#2592
See merge request isc-projects/bind9!4826
The TIME_NOW macro calls isc_time_now which uses CLOCK_REALTIME_COARSE
for getting the current time. This is perfectly fine for millisecond,
however when the user request microsecond resolutiuon, they are going
to get very inaccurate results. This is especially true on a server
class machine where the clock ticks may be set to 100HZ.
This changes dig to use the new TIME_NOW_HIRES macro that uses the
CLOCK_MONOTONIC_RAW that is more expensive, but gets the *actual*
current time rather than the at the last kernel time tick.
Diego Fronza
Michal Nowak
Michał Kępień
Mark Andrews
Ondřej Surý
Petr Mensik
Matthijs MekkingandMichał Kępień
Evan Hunt
Patrick McLeanandEvan Hunt