Frantisek Tobias [Tue, 23 Jun 2026 13:05:26 +0000 (15:05 +0200)]
daemon/quic: various smaller changes, improvements and fixes aggregated into a single commit
list of changes:
- lower default concurrent stream limit 1024 to 16
- rename quic_idle_timeout to quic_handle_timeout
- use PTO for closing/draining state timeouts
- move kr_quic_table_rem2 to quic_common.c
- set_tls_error for tls alerts (in conn close messages with error type
TRANSPORT)
- add some function documentation to quic_*.h
- improve/fix error messages in conn close packets
- fix and simplify tls alert transport when conn close is sent
- fix cid handling
- call uv_close on the timers in sub-sessions
- add QUIC_SEND_NONE for read errors which forbid/do not need a reply
- quic_bye for closing conns which are in states <= CLOSING (i.e. conn
that can still send)
- unite handshake timer with ngtcp2 driver timer loop
- add a custom state for failed handshake - QUIC_STATE_HS_ABORT
- handle cid removal from the table for conns which fail before their
ngtcp2_conn is created
- kr_quic_table_sweep is no longer used, termination handled complately
by timers
- failed attempt to create ngtcp2_conn now causes the conn session to be
destroyed immediately
daemon/quic: move ngtcp2_conn_extend_max_streams_bidi to session data deinit
This prevents superfluous resource consumption since the concurent stream limits are raised once the stream is actually terminated and all it's memory is freed.
daemon/session2: pass events to parent sessions and create convenience function for parent session retrieval
for transport.type = SESSION2_TRANSPORT_PARENT sessions pass events along to parent sessions. This is useful for DoQ (which is the only protolayer group using sub-sessions) as it allows us to cleanup references to sub-sessions that are about to be closed
daemon/quic: rewrite timer system, let terminal tasks traverse the entire DoQ group to assure gracefull termination
the timer system was incorrectly oblivious to some ngtcp2 states, this revrite amends missing functionality improving performance stability and correctness. Terminal events now reach all layers, this most importantly solves issues with dangling qr_tasks.
daemon/quic: remove assert and handle partial query data with FIN safely
receiving only part of the data that is promised by the size prefix before receiving stream FIN is an DoQ application error, handle it as such and terminate the connection
Vladimír Čunát [Thu, 4 Jun 2026 12:21:43 +0000 (14:21 +0200)]
update IANA's certificate for root trust anchor bootstrapping
The file now contains both old and new certificate, as downloaded from:
https://data.iana.org/root-anchors/icannbundle.pem
The switch of signatures themselves is planned for 2028.
Vladimír Čunát [Mon, 25 May 2026 09:55:36 +0000 (11:55 +0200)]
dns64 tests: also test CNAMEs
Unfortunately, the test still isn't able to catch the issue
which we have there now, so this addition might be pointless.
The problem is that the code answers correctly when satisfied locally
(from local-data or cache).
Michael Tremer [Wed, 27 May 2026 11:41:27 +0000 (11:41 +0000)]
policy: Add flag to force TCP as transport
This is already implemented in the backend, but the flag has not been
exposed. This patch adds the flag so that any forwarders will be
connected to using TCP.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Vladimír Čunát [Thu, 14 May 2026 09:06:24 +0000 (11:06 +0200)]
.gitlab-ci.yml: switch to kres-gen-35 only
As the CI is now, it's not possible to satisfy 3.3 and 3.5 simultanously.
The diff has no practical impact for us, which is why libknot added it.
As 3.3 and 3.5 are still compatible in practice, it's OK to only check 3.5.
Vladimír Čunát [Mon, 16 Mar 2026 10:00:22 +0000 (11:00 +0100)]
lib/cache: trim TTL of failing stashed packets
In particular, in STUB mode
(i.e. forwarding with dnssec:false + authoritative:false)
if a SERVFAIL packet from upstream contained also records,
this packet could be cached with long TTL.
This issue was reported by Qifan Zhang from Palo Alto Networks.
Additionally, let's apply our TTL limits for caching also
to the `cache-control: max-age=` HTTP header sent in DoH replies.
Vladimír Čunát [Tue, 21 Apr 2026 08:32:15 +0000 (10:32 +0200)]
daemon/quic: fix a minor undefined behavior
Perhaps a bit surprisingly, using a pointer after free()
results in undefined behavior, even if it is not dereferenced.
https://stackoverflow.com/a/69486412
Personally I wouldn't expect a practical problem here,
but fixing this non-compliance is trivial.
Vladimír Čunát [Wed, 4 Mar 2026 09:27:19 +0000 (10:27 +0100)]
distro/pkg/deb: apply most differences from downstream Debian
I looked through the differences and sometimes checked
relevant docs or commits which introduced the differences.
Keeping on debhelper-compat 12, so that we don't have to
drop Ubuntu 20.04 which only ended the standard support phase
less than one year ago (and gets security support for 5-10 more).
Vladimír Čunát [Thu, 26 Mar 2026 11:56:44 +0000 (12:56 +0100)]
daemon/http.c nit: fix const-warnings with C23
Interestingly, with C23, functions like strstr()
return a const-qualified pointer iff one was passed to them.
Right now we ran into this in Arch CI (unreleased gcc 15 version):
https://gitlab.nic.cz/knot/knot-resolver/-/jobs/1713767
projects / thirdparty / knot-resolver.git / log
