Compound literals are not used in BIND 9.11, in order to ensure backward
compatibility with ancient compilers. Rework the relevant parts of the
BIND 9.11 backport of the CVE-2021-25220 fix so that compound literals
are not used.
When caching glue, we need to ensure that there is no closer
source of truth for the name. If the owner name for the glue
record would be answered by a locally configured zone, do not
cache.
When caching additional and glue data *not* from a forwarder, we must
check that there is no "forward only" clause covering the owner name
that would take precedence. Such names would normally be allowed by
baliwick rules, but a "forward only" zone introduces a new baliwick
scope.
If we are using a fowarder, in addition to checking that names to
be cached are subdomains of the forwarded namespace, we must also
check that there are no subsidiary forwarded namespaces which would
take precedence. To be safe, we don't cache any responses if the
forwarding configuration has changed since the query was sent.
Also make the script more verbose to identify which patch is being
processed and check for failures in spatch standard error output.
(cherry picked from commit 48c44fe6d4)
This prevents resolver timeouts for the reference (BIND 9.11) servers
used in respdiff tests run on Debian 11 "bullseye".
--with-randomdev=/dev/urandom is part of the "configure" template.
(cherry picked from commit 4d7e343813)
"buster" jobs are now only going to be run in scheduled pipelines.
"--without-gssapi" ./configure option of "bullseye" before it became the
base image is dropped from "bullseye"-the-base-image because it reduces
gcov coverage by 0.38 % (651 lines) and is used in Debian 9 "stretch".
"--enable-openssl-hash" is on purpose not being tested because it fails
linking when either of --with-ecdsa, --with-gost, --with-eddsa, or
--with-aes is used as well because it can't find f.e. HMAC_CTX_new() as
"-lcrypto" is missing:
/usr/bin/ld: ../../lib/isc/libisc.a(hmacmd5.o): in function `isc_hmacmd5_init':
/root/bind9/lib/isc/hmacmd5.c:49: undefined reference to `HMAC_CTX_new'
/usr/bin/ld: /root/bind9/lib/isc/hmacmd5.c:51: undefined reference to `EVP_md5'
/usr/bin/ld: /root/bind9/lib/isc/hmacmd5.c:51: undefined reference to `HMAC_Init_ex'
BIND 9.11 is in security-fixes-only-mode and configure.ac code should
not be fixed to include "-lcrypto" in this corner case; better eliminate
a pairwise hint.
(cherry picked from commit 910d595fbc)
Commit 9aa1c580 dropped dependency of "respdiff" and
"respdiff-third-party" jobs on "tarball-create" job because these jobs
don't need to depend on in (e.g., for its artifacts). This, however,
caused that respdiff jobs weren't started out-of-order and artifacts
from all the "Build" stage jobs plus "unit:gcc:buster:amd64" job were
downloaded to project directory and caused problems with compilation:
Originally, the dependency on "tarball-create" has been added in
45d59c50 to indicate that respdiff "is meant to operate on two different
BIND versions". It seems that the intent didn't work out, and we better
make it obvious that respdiff jobs don't depend on any other job and
should be run out-of-order.
(cherry picked from commit 87578efc71)
The order of directories with reference and test BIND 9 are now reversed
for respdiff.sh.
The data.mdb file has more than 10 GB and makes artifact download take
an unnecessarily long time.
(cherry picked from commit 2ececf2c02)
Alpine Linux image has OpenSSL 3.0.0 from the "edge" repository to test
OpenSSL 3.0.0 support in the BIND 9 "main" branch. However, this breaks
compilation of branches without OpenSSL 3.0.0 support and therefore
OpenSSL deprecated declarations need to be suppressed with
-DOPENSSL_SUPPRESS_DEPRECATED.
Support for FreeBSD 11.4, the last FreeBSD 11.x release, ended on
September 30, 2021.
Link: https://www.freebsd.org/security/unsupported/
Also drop $WITH_READLINE_LIBEDIT from clang:freebsd13:amd64, it should
not have been added in the first place.
(cherry picked from commit 981579f379)
Every cppcheck update brings the cost of addressing new false positives
in the BIND 9 source code while not reaping any benefits in case of
identified issues with the code.
(cherry picked from commit 654cc61bb9)
With switching the gcc:pkcs11 CI jobs from Debian Buster to Fedora, we
don't need two Fedora CI jobs, which differ only by leveraging PKCS#11
or OpenSSL.
SoftHSM v2.4 was dropped from the base image because it is being
upgraded to Debian Bullseye, which has SoftHSM v2.6, the same version we
already have in the Fedora image, and use it in the "main" branch for
PKCS#11 testing. However, on the "v9_11" branch, to sustain PKCS#11
testing, gcc:pkcs11 CI jobs need to be ported from the base image to the
Fedora image.
Gitlab feature
https://docs.gitlab.com/ee/ci/pipelines/settings.html#auto-cancel-redundant-pipelines
can automatically cancel jobs which operate on an outdated code, i.e. on
branches which received new commits while jobs with an older set of
commits are still running. For this feature to work jobs have to be
configured with boolean interruptible: true.
I think practically all of our current CI jobs can be cancelled,
so the option is now on by default for all jobs.
PyLint 2.11 reports a new warning, C0209 (consider-using-f-string).
Since f-strings are only available in Python 3.6+, existing scripts
cannot be updated to use this feature just yet because they would stop
working with older Python versions. Instead, disable PyLint warning
C0209 for the time being.
(cherry picked from commit 860ca4e0ef)
Michał Kępień
Petr ŠpačekandMichał Kępień
Mark AndrewsandMichał Kępień
Michal Nowak
Ondřej Surý
Ondřej SurýandOndřej Surý
Tinderbox UserandMichał Kępień