rename kind="doh" to kind="doh_legacy"

The purpose of this change is to make it harder to accidentally use the
legacy DoH implementation and free up the "doh" kind which may be used
as an alias to a modern implementation in the future.

diff --git a/NEWS b/NEWS
index bfe94176b00a185efc5960bacb4d1076701f1aea..45b0103837b97a69d02fec9562985996f3568ff2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,11 @@ Bugfixes
 --------
 - trust_anchors.set_insecure: improve precision (#673, !1177)
 
+Incompatible changes
+--------------------
+- legacy DoH implementation configuration in net.listen() was renamed from
+  kind="doh" to kind="doh_legacy" (!1180)
+
 
 Knot Resolver 5.3.2 (2021-05-05)
 ================================

diff --git a/daemon/bindings/net.c b/daemon/bindings/net.c
index 8906f5e241bb665669240b7d67b6c4ac235e4c98..b5c9312f4ea98274a60b61a7c60be5d3a53ed363 100644 (file)
--- a/daemon/bindings/net.c
+++ b/daemon/bindings/net.c
@@ -247,8 +247,7 @@ static int net_listen(lua_State *L)
                } else if (k) {
                        flags.kind = k;
                        if (strcasecmp(k, "doh") == 0) {
-                               kr_log_deprecate(
-                                       "kind=\"doh\" is an obsolete DoH implementation, use kind=\"doh2\" instead\n");
+                               lua_error_p(L, "kind=\"doh\" was renamed to kind=\"doh_legacy\", switch to the new implementation with kind=\"doh2\" or update your config");
                        }
                }
 

diff --git a/daemon/bindings/net_server.rst b/daemon/bindings/net_server.rst
index 53e0efee9debdf7cfdbe19ea301f2b504104dc3e..b652f4eb16e8772410404c23f9a90af4eaf09a72 100644 (file)
--- a/daemon/bindings/net_server.rst
+++ b/daemon/bindings/net_server.rst
@@ -18,7 +18,7 @@ First you need to decide what service should be available on given IP address
   ":ref:`dns-over-https`","``doh2``"
   ":ref:`Web management <mod-http-built-in-services>`","``webmgmt``"
   ":ref:`Control socket <control-sockets>`","``control``"
-  ":ref:`mod-http-doh`","``doh``"
+  ":ref:`mod-http-doh`","``doh_legacy``"
 
 .. note:: By default, **unencrypted DNS and DNS-over-TLS** are configured to **listen
    on localhost**.

diff --git a/daemon/lua/postconfig.lua b/daemon/lua/postconfig.lua
index 818a3fc6efdba55dced3208f054424522facb97b..cafcd6e8f8cc8f4dc272700ad402c60e2905d13a 100644 (file)
--- a/daemon/lua/postconfig.lua
+++ b/daemon/lua/postconfig.lua
@@ -12,7 +12,7 @@ local function count_sockets()
                elseif (socket.kind == 'dns' or
                        socket.kind == 'xdp' or
                        socket.kind == 'tls' or
-                       socket.kind == 'doh' or
+                       socket.kind == 'doh_legacy' or
                        socket.kind == 'doh2') then
                        dns_socks = dns_socks + 1
                end

diff --git a/distro/tests/ansible-roles/knot_resolver/tasks/configure_doh.yaml b/distro/tests/ansible-roles/knot_resolver/tasks/configure_doh.yaml
index 1da17893dc544bc059ea9943f6d107bd3be57bc0..cd4e7492c5b637f76025c841c2aa230444148da5 100644 (file)
--- a/distro/tests/ansible-roles/knot_resolver/tasks/configure_doh.yaml
+++ b/distro/tests/ansible-roles/knot_resolver/tasks/configure_doh.yaml
@@ -4,7 +4,7 @@
   blockinfile:
     marker: -- {mark} ANSIBLE MANAGED BLOCK
     block: |
-      net.listen('127.0.0.1', 44353, { kind = 'doh' })
+      net.listen('127.0.0.1', 44353, { kind = 'doh_legacy' })
       modules.load('http')
     path: /etc/knot-resolver/kresd.conf
     insertbefore: BOF

diff --git a/doc/upgrading.rst b/doc/upgrading.rst
index ff739f7a14c9252f21a747f42d5b462b91727ba3..497b22255e297b96b0be1fd3cf47dbb683efd69a 100644 (file)
--- a/doc/upgrading.rst
+++ b/doc/upgrading.rst
@@ -18,9 +18,6 @@ Following section provides information about selected changes in not-yet-release
 We advise users to prepare for these changes sooner rather than later to make it easier to upgrade to
 newer versions when they are released.
 
-* Going forward DNS-over-HTTP (DoH) will be supported only over HTTP/2 with TLS.
-  This limitation allows us to provide a new :ref:`more reliable and scalable implementation
-  of DoH <dns-over-https>` (``kind='doh2'``).
 * Command line option ``--forks`` (``-f``) `is deprecated and will be eventually removed
   <https://gitlab.nic.cz/knot/knot-resolver/-/issues/631>`_.
   Preferred way to manage :ref:`systemd-multiple-instances` is to use a process manager,
@@ -29,6 +26,13 @@ newer versions when they are released.
 .. _`systemd`: https://systemd.io/
 .. _`supervisord`: http://supervisord.org/
 
+5.3 to 5.4
+==========
+
+Configuration file
+------------------
+
+* ``kind='doh'`` in :func:`net.listen` was renamed to ``kind='doh_legacy'``. It is recommended to switch to the new DoH implementation with ``kind='doh2'``.
 
 5.2 to 5.3
 ==========

diff --git a/modules/http/README.rst b/modules/http/README.rst
index e2d1b991cdc87e66174c0b12b4f4abe1ebcfa564..9cfad1f91a170baa9908c02c98394571bf636588 100644 (file)
--- a/modules/http/README.rst
+++ b/modules/http/README.rst
@@ -24,7 +24,7 @@ and unlimited number of "used-defined kinds" can be added in configuration.
 +--------------+---------------------------------------------------------------------------------+
 | webmgmt      | :ref:`built-in web management <mod-http-built-in-services>` APIs (includes DoH) |
 +--------------+---------------------------------------------------------------------------------+
-| doh          | :ref:`mod-http-doh`                                                             |
+| doh_legacy   | :ref:`mod-http-doh`                                                             |
 +--------------+---------------------------------------------------------------------------------+
 
 Each network address and port combination can be configured to expose
@@ -100,7 +100,7 @@ kind of endpoint, e.g. to enforce TLS and use custom certificate only for DoH:
                tls = true,
                cert = '/etc/knot-resolver/mycert.crt',
                key  = '/etc/knot-resolver/mykey.key',
-       }, 'doh')
+       }, 'doh_legacy')
 
 The format of both certificate and key is expected to be PEM, e.g. equivalent to
 the outputs of following:
@@ -129,13 +129,13 @@ Major drawback is that current browsers won't do HTTP/2 over insecure connection
 Legacy DNS-over-HTTPS (DoH)
 ---------------------------
 
-.. warning:: The legacy DoH implementation using ``http`` module (``kind='doh'``)
+.. warning:: The legacy DoH implementation using ``http`` module (``kind='doh_legacy'``)
    is deprecated. It has known performance and stability issues that won't be fixed.
    Use new :ref:`dns-over-https` implementation instead.
 
-This was an experimental implementation of :rfc:`8484`. It was configured using
-``doh`` kind in :func:`net.listen`. Its configuration (such as certificates)
-took place in ``http.config()``.
+This was an experimental implementation of :rfc:`8484`. It can be configured using
+``doh_legacy`` kind in :func:`net.listen`. Its configuration (such as certificates)
+takes place in ``http.config()``.
 
 Queries were served on ``/doh`` and ``/dns-query`` endpoints.
 

diff --git a/modules/http/custom_services.rst b/modules/http/custom_services.rst
index 095935742d9025dab96e30a3adf3dd34b77c60a7..4e60b03025896b711790f0712f22e7b576e71beb 100644 (file)
--- a/modules/http/custom_services.rst
+++ b/modules/http/custom_services.rst
@@ -9,7 +9,7 @@ This chapter describes how to create custom HTTP services inside Knot Resolver.
 Please read HTTP module basics in chapter :ref:`mod-http` before continuing.
 
 Each network address+protocol+port combination configured using :func:`net.listen`
-is associated with *kind* of endpoint, e.g. ``doh`` or ``webmgmt``.
+is associated with *kind* of endpoint, e.g. ``doh_legacy`` or ``webmgmt``.
 
 Each of these *kind* names is associated with table of HTTP endpoints,
 and the default table can be replaced using ``http.config()`` configuration call

diff --git a/modules/http/http.lua.in b/modules/http/http.lua.in
index 521ddb2855650682b7cf81f6070333e21db7bf12..b5354c68384a8097624dce9a471b6764c993afc8 100644 (file)
--- a/modules/http/http.lua.in
+++ b/modules/http/http.lua.in
@@ -52,7 +52,7 @@ end
 M.configs._all = {}
 
 -- DoH
-M.configs._builtin.doh = {}
+M.configs._builtin.doh_legacy = {}
 
 -- management endpoint
 M.configs._builtin.webmgmt = {}
@@ -121,7 +121,7 @@ local function serve_root()
 end
 
 -- Export HTTP service endpoints
-M.configs._builtin.doh.endpoints = {}
+M.configs._builtin.doh_legacy.endpoints = {}
 M.configs._builtin.webmgmt.endpoints = {}
 local mgmt_endpoints = M.configs._builtin.webmgmt.endpoints
 
@@ -146,11 +146,11 @@ for k, v in pairs(http_trace.endpoints) do
 end
 M.trace = http_trace
 
-M.configs._builtin.doh.endpoints = {}
+M.configs._builtin.doh_legacy.endpoints = {}
 local http_doh = require('kres_modules.http_doh')
 for k, v in pairs(http_doh.endpoints) do
        mgmt_endpoints[k] = v
-       M.configs._builtin.doh.endpoints[k] = v
+       M.configs._builtin.doh_legacy.endpoints[k] = v
 end
 M.doh = http_doh
 
@@ -347,7 +347,7 @@ end
 
 -- @function Init module
 function M.init()
-       net.register_endpoint_kind('doh', cb_socket)
+       net.register_endpoint_kind('doh_legacy', cb_socket)
        net.register_endpoint_kind('webmgmt', cb_socket)
 end
 
@@ -357,12 +357,12 @@ function M.deinit()
                remove_socket(fd)
        end
        tls_cert.ephemeral_state_destroy(M.ephem_state)
-       net.register_endpoint_kind('doh')
+       net.register_endpoint_kind('doh_legacy')
        net.register_endpoint_kind('webmgmt')
 end
 
 -- @function Configure module, i.e. store new configuration template
--- kind = socket type (doh/webmgmt)
+-- kind = socket type (doh_legacy/webmgmt)
 function M.config(conf, kind)
        if conf == nil and kind == nil then
                -- default module config, nothing to do

diff --git a/modules/http/http_doh.test.lua b/modules/http/http_doh.test.lua
index 194d08a8edac3cf491b336bdc3797329cbd6f460..d30833e4f62780f48b96f8495e4b416900a13d51 100644 (file)
--- a/modules/http/http_doh.test.lua
+++ b/modules/http/http_doh.test.lua
@@ -85,11 +85,11 @@ else
        modules.load('http')
        http.config({
                tls = false,
-       }, 'doh')
+       }, 'doh_legacy')
 
        local bound
        for _ = 1,1000 do
-               bound, _err = pcall(net.listen, '127.0.0.1', math.random(30000, 39999), { kind = 'doh' })
+               bound, _err = pcall(net.listen, '127.0.0.1', math.random(30000, 39999), { kind = 'doh_legacy' })
                if bound then
                        break
                end