deSEC

Recent Commits

• Peter Thomassen(13 Oct 26)

  fix(api): use RFC 2308 TTL inheritance for zonefile import Records without a TTL inherit the most recently stated TTL (RFC 1035 Section 5.1), and the SOA MINIMUM field serves as the default TTL only when no TTL has been stated at all (RFC 2308 Section 4). dnspython 2.9.0 made this its default behavior. The `rfc2308_ttl` parameter of `dns.zone.from_text()` is set explicitly nonetheless, and a test covers the behavior, as protection against regressions. Fixes #1262

• Peter Thomassen(28 Jul 26)

  fix(api): handle OPTION requests on DomainViewSet correctly

• Peter Thomassen(13 Oct 26)

  chore(e2e2): pin test dependencies Pin the e2e2 requirements to the versions in use, and bump dnspython to 2.9.0, matching api/requirements.txt.

• Peter Thomassen(13 Oct 26)

  fix(www): serve HTTP/3 on every server name Alt-Svc advertises h3 for all names, but only the website server had a QUIC listener, so every other name was answered with the website's certificate over HTTP/3 and failed verification. Give the remaining servers, including the catch-all, a `listen ... quic` of their own, and request every name over HTTP/3 in the e2e2 tests.

• Peter Thomassen(13 Oct 26)

  test(e2e2): cover HSTS and Alt-Svc headers Assert the Strict-Transport-Security value on every HTTPS server name, its absence on the plaintext redirects, and that it reaches the proxied /api/ and /prometheus/ locations; the Alt-Svc advertisement is checked on all names over both protocols, by equality, so that a duplicate header fails as well. Closes #1290

• Peter Thomassen(13 Oct 26)

  fix(api): improve error message when rejecting relative name The error raised for dns.name.NeedAbsoluteNameOrOrigin now names the record type and talks about names instead of hostnames, like the neighboring syntax error.

• Peter Thomassen(01 Sept 26)

  feat(api): remove PCH integration Drop `desecapi/pch.py` and the `pch_do` hook that `PDNSChangeTracker` called on domain creation and deletion, along with `PCHException`, the two PCH metrics, the `DESECSTACK_API_PCH_API` and `DESECSTACK_API_PCH_API_TOKEN` variables, and the PCH request expectations in the test base class. `ExternalAPIException` is folded into `PDNSException`, which was its only remaining subclass. The now unused `assertZoneCreation()` and `assertZoneDeletion()` helpers go with it.

• Peter Thomassen(01 Sept 26)

  chore(api): lint Python code with ruff Enable ruff's pyflakes, pyupgrade, isort, bugbear and the non-formatting pycodestyle rules in api/ruff.toml, run `ruff check api/` in CI next to the formatting check, and pin the ruff version in requirements-dev.txt so that a new release does not turn an unrelated pull request red. Suppressions are attached to the sites they apply to. Closes #1251

• Peter Thomassen(13 Oct 26)

  chore(api): keep test dependencies out of the image The api image is also what runs in production, so it no longer installs requirements-dev.txt at build time; the test overlay's entrypoint installs it before running whatever command the container is given.

• Peter Thomassen(01 Sept 26)

  fix(api): address bugbear and pycodestyle findings Catch `Exception` instead of using a bare `except`, pass an explicit `strict` to `zip()` and `itertools.batched()`, use `isinstance()` for a type check, and rename loop and argument names that shadow their iterable or are hard to tell apart from digits.

• Peter Thomassen(01 Sept 26)

  style(api): remove unused imports and dead code Drop imports that are not referenced, stray `f` prefixes on strings without placeholders, and `BASE_DIR`, which Django does not use by itself and which no setting refers to.

• Peter Thomassen(01 Sept 26)

  style(api): sort imports Apply isort ordering (standard library, third party, first party, local), which also removes a duplicate import of `RR_SET_TYPES_UNSUPPORTED`.

• Peter Thomassen(01 Sept 26)

  style(api): modernize string formatting Replace printf-style formatting and `str.format()` calls with f-strings where the result is equivalent, drop the deprecated `typing.Tuple`/`typing.Callable` imports, and use `datetime.UTC`.

• Peter Thomassen(01 Sept 26)

  fix(api): account for subname when validating RRset length on update The RRsetDetail endpoint takes the subname from the URL, so it is absent from the serializer's validated data on PATCH, and the length estimate was computed against the apex qname. Fall back to the instance's subname.

• Peter Thomassen(01 Sept 26)

  docs: state that API endpoint URLs end with a slash, closes #1185 The API basics now say that every endpoint URL carries a trailing slash, placed immediately before the query string where one is given.

• Peter Thomassen(01 Sept 26)

  fix(api): answer dynDNS updates from accounts without a domain DynDNS12UpdateView.qnames() treats an account that owns no domain like one that owns several: when the request does not name a domain and none can be inferred, it raises the "domain-unspecified" ValidationError instead of letting Domain.DoesNotExist escape.

• Peter Thomassen(13 Oct 26)

  test(api): cover HTTPS content with an empty parameter value Add `1 . key1=""` to the invalid HTTPS record contents; dnspython rejects it with a syntax error as of 2.9.0, so the API answers it with 400.

• dependabot[bot](12 Oct 26)

  chore(deps): update dnspython requirement in /api in the pip-api group Updates the requirements on [dnspython](https://github.com/rthalley/dnspython) to permit the latest version. Updates `dnspython` to 2.9.0 - [Release notes](https://github.com/rthalley/dnspython/releases) - [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst) - [Commits](https://github.com/rthalley/dnspython/compare/v2.8.0...v2.9.0) dnspython 2.9.0 rejects uppercase SVCB/HTTPS parameter keys and validates the ech parameter as an ECHConfigList, so the affected test records are updated. --- updated-dependencies: - dependency-name: dnspython dependency-version: 2.9.0 dependency-type: direct:production dependency-group: pip-api ... Signed-off-by: dependabot[bot] <[email protected]>

• Peter Thomassen(01 Sept 26)

  test(api): cover mixed A/AAAA records in subnet updates test_subnet now gives foo both an A and an AAAA RRset and replaces each with its own subnet, so that replace_ip_subnet()'s address family filter is exercised with input holding records of both families.

• Peter Thomassen(01 Sept 26)

  fix(api): keep the address family when replacing an IP subnet replace_ip_subnet() builds the result on top of the subnet's network address instead of round-tripping it through ip_address(int(...)), which returned an IPv4Address for every IPv6 subnet whose network address fits in 32 bits (such as ::/0, ::/56 and ::/64) and then raised AddressValueError when the host bits of an AAAA record were added to it.

• Peter Thomassen(01 Sept 26)

  fix(api): make logout idempotent when the token is already gone AccountLogoutView.get_object() returns the token that authenticated the request instead of looking it up by key a second time. Concurrent logouts of the same token now delete an already-deleted row and answer 204, rather than raising Token.DoesNotExist after the first one wins.

• Peter Thomassen(01 Sept 26)

  fix(api): don't fail on bulk RRset items without subname or type PermissionValidator no longer assumes that the view has a `subname` URL kwarg or that the serializer has an instance. On the `rrsets/` bulk endpoint, an item with `records: []` that omits `subname` or `type` is validated as partial, so neither field reaches the validator; the validator now rejects such items, reporting the missing field as required. The docs are updated to match: `subname` is required in bulk requests since a34b963d (2023) and does not default to the zone apex.

• Peter Thomassen(01 Sept 26)

  fix(api): handle concurrent RR set deletion in the change tracker When another request deletes an RR set between the replacement of its RRs and the subsequent save(), Django re-inserts the row instead of updating it, and the tracker sees a creation for an RR set already recorded as modified. Raise ConcurrencyException there instead of failing an assertion, so that the transaction is rolled back, no changes are sent to pdns, and the client gets a 429 instead of a 500.

• Peter Thomassen(09 Oct 26)

  fix(nslord,nsmaster): improve large zone replication tolerance

• Peter Thomassen(09 Oct 26)

  fix(www): move HSTS headers to server, due to add_header_inherit

• Peter Thomassen(27 Aug 26)

  fix(www): correctly advertise HTTP/3, everywhere 4c2f23b8ccb745e055630b4be4f76d4133d5f14d had it in the wrong place.

• Peter Thomassen(04 Sept 26)

  fix(webapp): don't mistake every 403 for an MFA challenge Report the error code alongside the detail, and redirect to the 2FA dialog only when the API asks for a second factor.

• Peter Thomassen(16 May 26)

  feat(webapp): add USDT (TRON/TRC20) donation address

• Peter Thomassen(20 Aug 26)

  chore(deps): bump actions/checkout to v7 in build action

• Peter Thomassen(20 Aug 26)

  test(api): run Django tests with --parallel auto Cuts the API test suite runtime considerably by distributing tests over per-CPU worker processes with cloned test databases. Coverage needs a config file for this: the multiprocessing concurrency setting is what makes the worker processes record data, and it is passed on to them via the rcfile (command line options are not). The resulting per-process data files are merged by `coverage combine`.