Add IXFR out support.

integration-tests/scripts/manage-test-environment.sh

@@ -298,8 +298,7 @@ pattern:
   name: secondary
   zonefile: "%s.secondary-zone"
   allow-notify: 127.0.0.1 NOKEY
-  # Until Cascade supports IXFR we always use AXFR
-  request-xfr: AXFR 127.0.0.1@${_cascade_port} NOKEY
+  request-xfr: 127.0.0.1@${_cascade_port} NOKEY
   provide-xfr: 127.0.0.1 NOKEY
 
 zone:

integration-tests/system-tests.yml

@@ -166,6 +166,21 @@ jobs:
         with:
           log-level: ${{ inputs.log-level }}
 
+  ixfr-out:
+    name: Serve a zone via IXFR to the NSD secondary.
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rust: [stable]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/set-build-profile
+        with:
+          build-profile: ${{ inputs.build-profile }}
+      - uses: ./integration-tests/tests/ixfr-out
+        with:
+          log-level: ${{ inputs.log-level }}
+
   incremental-signing:
     name: Test incremental signing.
     runs-on: ubuntu-latest

integration-tests/tests/ixfr-out/action.yml

@@ -0,0 +1,183 @@
+# Making reusable composite actions documented at
+# https://docs.github.com/en/actions/tutorials/create-actions/create-a-composite-action#creating-a-composite-action-within-the-same-repository
+name: 'Serve a zone via IXFR to the NSD secondary.'
+description: 'Serve a zone via IXFR to the NSD secondary.'
+defaults:
+  # see: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defaultsrunshell
+  run:
+    shell: bash --noprofile --norc -eo pipefail -x {0}
+inputs:
+  log-level:
+    description: The level of logging that Cascade should output.
+    required: false
+    default: debug
+    type: choice
+    options:
+      - error
+      - warning
+      - info
+      - debug
+      - trace
+runs:
+  using: "composite"
+  steps:
+    - uses: ./.github/actions/prepare-systest-env
+    - uses: ./.github/actions/setup-and-start-cascade
+      with:
+        log-level: ${{ inputs.log-level }}
+
+    - name: Add a NOTIFY with TSIG outbound policy
+      run: |
+        POLICY_DIR=$(integration-tests/scripts/get-default-path.sh policy-dir)
+        cascade template policy | grep -Ev '(send-notify-to|accept-xfr-from)' > "${POLICY_DIR}/custom.toml"
+
+        sed -i -e 's/serial-policy = "date-counter"/serial-policy = "keep"/' "${POLICY_DIR}/custom.toml"
+        echo 'send-notify-to = ["127.0.0.1:1054"]' >> "${POLICY_DIR}/custom.toml"
+
+        # TODO: Extend the test to use TSIG (driven by inputs ala the tsig-downstream test)
+        # once PRs #564 and #587 have been merged.
+        # echo 'send-notify-to = ["127.0.0.1:1054^tsig-key"]' >> "${POLICY_DIR}/custom.toml"
+        # cascade tsig add tsig-key hmac-sha256 "COzoVsYQmXeXiyq1Quhp0bbVnMyxjPxsaGSoIWR98i0="
+        cascade policy reload
+
+    - name: Make an initial zone based on RFC 1995 section 7
+      run: |
+        tee example.test.zone <<'EOF'
+        EXAMPLE.TEST.       IN SOA NS.EXAMPLE.TEST. mail.example.test. (
+                                     1 60 60 3600 5)
+                            IN NS  NS.EXAMPLE.TEST.
+        NS.EXAMPLE.TEST.    IN A   133.69.136.1
+        NEZU.EXAMPLE.TEST.  IN A   133.69.136.5
+        EOF
+
+    - name: Add the zone using the custom policy
+      run: |
+        cascade zone add --policy custom --source $PWD/example.test.zone example.test
+
+    - name: Check zone status
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until cascade zone status example.test | grep -q "Published zone available"; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade zone status example.test
+            echo "timeout: zone status did not report published zone available" >&2
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Check the SOA SERIAL at the NSD secondary
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until dig +short @127.0.0.1 -p 1054 example.test SOA | grep -q 'ns.example.test. mail.example.test. 1 60 60 3600 5'; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade zone status example.test
+            dig +short @127.0.0.1 -p 1054 example.test SOA
+            echo "::error:: timeout: NSD did not acquire the zone changes"
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Edit the source zone and tell Cascade to reload it.
+      run: |
+        tee example.test.zone <<'EOF'
+        example.test.          IN SOA ns.example.test. mail.example.test. (
+                                     2 60 60 3600 5)
+                               IN NS  NS.EXAMPLE.TEST.
+        NS.EXAMPLE.TEST.       IN A   133.69.136.1
+        JAIN-BB.EXAMPLE.TEST.  IN A   133.69.136.4
+                               IN A   192.41.197.2
+        EOF
+        cascade zone reload example.test
+
+    - name: Check zone status
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until cascade zone status example.test | grep -q "Published zone available"; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade zone status example.test
+            echo "timeout: zone status did not report published zone available" >&2
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Check the SOA SERIAL at the NSD secondary
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until dig +short @127.0.0.1 -p 1054 example.test SOA | grep -q 'ns.example.test. mail.example.test. 2 60 60 3600 5'; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade zone status example.test
+            dig +short @127.0.0.1 -p 1054 example.test SOA
+            echo "::error:: timeout: NSD did not acquire the zone changes"
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Edit the source zone and tell Cascade to reload it.
+      run: |
+        tee example.test.zone <<'EOF'
+        EXAMPLE.TEST.          IN SOA ns.example.test. mail.example.test. (
+                                     3 60 60 3600 5)
+                               IN NS  NS.EXAMPLE.TEST.
+        NS.EXAMPLE.TEST.       IN A   133.69.136.1
+        JAIN-BB.EXAMPLE.TEST.  IN A   133.69.136.3
+                               IN A   192.41.197.2
+        EOF
+        cascade zone reload example.test
+
+    - name: Check zone status
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until cascade zone status example.test | grep -q "Published zone available"; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade zone status example.test
+            echo "timeout: zone status did not report published zone available" >&2
+            exit 1
+          fi
+          sleep 1
+        done
+
+    - name: Check the SOA SERIAL at the NSD secondary
+      run: |
+        timeout=10 # seconds
+        start=$(date +%s)
+        until dig +short @127.0.0.1 -p 1054 example.test SOA | grep -q 'ns.example.test. mail.example.test. 3 60 60 3600 5'; do
+          if (($(date +%s) > (start + timeout))); then
+            cascade zone status example.test
+            dig +short @127.0.0.1 -p 1054 example.test SOA
+            echo "::error:: timeout: NSD did not acquire the zone changes"
+            exit 1
+          fi
+          sleep 1
+        done
+
+    # Note: There is no NSD metric that I am aware of that we can use to
+    # verify that it received IXFR from Cascade instead of AXFR, nor is there
+    # any Cascade Prometheus metric or CLI command that we can use to check
+    # this either. Increasing the NSD log level to 9 doesn't cause it to
+    # report whether it received IXFR or AXFR either.
+
+    # TODO: Verify the AXFR and IXFR response content is as expected /
+    # matching that of NSD.
+
+    - run: dig +onesoa +noall +answer @127.0.0.1 -p 4542 example.test AXFR > cascade-axfr.log
+
+    - run: dig +onesoa +noall +answer @127.0.0.1 -p 4542 example.test -t IXFR=1 >cascade-ixfr-1.log
+
+    - run: dig +onesoa +noall +answer @127.0.0.1 -p 4542 example.test -t IXFR=2 >cascade-ixfr-2.log
+
+    - run: dig +onesoa +noall +answer @127.0.0.1 -p 4542 example.test -t IXFR=3 >cascade-ixfr-3.log
+
+    - run: dig +onesoa +noall +answer @127.0.0.1 -p 1054 example.test AXFR >nsd-axfr.log
+
+    - name: Print log files on any failure in this job
+      uses: ./.github/actions/print-logfiles
+      if: failure()

src/persistence/persist.rs

@@ -36,6 +36,18 @@ pub fn persist_signed(
     persister: SignedZonePersister,
 ) -> SignedZonePersisted {
     // TODO
-    let _ = (zone, center);
+    let _ = center;
+
+    // Store the signed diff in-memory for serving IXFR.
+    // Only push a diff if a SOA was removed, otherwise this is not a diff to
+    // a previous version of the zone but actually the entire new zone content
+    // compared to an empty zone. Also don't store a diff to the same serial.
+    let signed_diff = persister.signed_diff();
+
+    if signed_diff.removed_soa.is_some() && signed_diff.removed_soa != signed_diff.added_soa {
+        let mut state = zone.state.lock().unwrap();
+        state.storage.diffs.push(signed_diff.clone());
+    }
+
     persister.mark_complete()
 }

src/server/request.rs

@@ -139,7 +139,6 @@ pub enum ZoneRequestKind {
     Axfr,
 
     /// An IXFR request.
-    #[expect(dead_code)]
     Ixfr {
         /// The SOA record known to the client.
         known_soa: Record<(), Soa<Box<Name>>>,