daemon: mode(strict|normal|permissive)

the daemon has now three modes of strictness
checking from strict to permissive.
it reflects the tradeoff between resolving the
query in as few steps as possible and security
for insecure zones

diff --git a/daemon/README.rst b/daemon/README.rst
index 952d12ba6a6b6e0ee76b32e235bc7542cd3726d0..794e7f496c2197d754c7d297e17bd48158d32aef 100644 (file)
--- a/daemon/README.rst
+++ b/daemon/README.rst
@@ -335,6 +335,23 @@ Environment
 
    :return: Toggle verbose logging.
 
+.. function:: mode('strict' | 'normal' | 'permissive')
+
+   :return: Change resolver strictness checking level.
+
+   By default, resolver runs in *normal* mode. There are possibly many small adjustments
+   hidden behind the mode settings, but the main idea is that in *permissive* mode, the resolver
+   tries to resolve a name with as few lookups as possible, while in *strict* mode it spends much
+   more effort resolving and checking referral path. However, if majority of the traffic is covered
+   by DNSSEC, some of the strict checking actions are counter-productive.
+
+   .. csv-table::
+    :header: "Action", "Modes"
+
+    "Use mandatory glue", "strict, normal, permissive"
+    "Use in-bailiwick glue", "normal, permissive"
+    "Use any glue records", "permissive"
+
 .. function:: user(name, [group])
 
    :param string name: user name

diff --git a/daemon/engine.c b/daemon/engine.c
index 4c0e0c50cd8e4884606d225f47cb0172e0ac79fb..70fda115626bffe46c4f707d2343be22094b25c1 100644 (file)
--- a/daemon/engine.c
+++ b/daemon/engine.c
@@ -66,6 +66,7 @@ static int l_help(lua_State *L)
                "user(name[, group])\n    change process user (and group)\n"
                "verbose(true|false)\n    toggle verbose mode\n"
                "option(opt[, new_val])\n    get/set server option\n"
+               "mode(strict|normal|permissive)\n    set resolver strictness level\n"
                "resolve(name, type[, class, flags, callback])\n    resolve query, callback when it's finished\n"
                "todname(name)\n    convert name to wire format\n"
                "net\n    network configuration\n"

diff --git a/daemon/lua/kres.lua b/daemon/lua/kres.lua
index 0db2790da9885f8a63bb1448d249adc2f26eab83..f633d9b87eb1108677ef9dc72694c6394f51d30b 100644 (file)
--- a/daemon/lua/kres.lua
+++ b/daemon/lua/kres.lua
@@ -106,6 +106,8 @@ struct query_flag {
        static const int DNSSEC_INSECURE = 1 << 16;
        static const int STUB        = 1 << 17;
        static const int ALWAYS_CUT  = 1 << 18;
+       static const int PERMISSIVE  = 1 << 20;
+       static const int STRICT      = 1 << 21;
 };
 
 /*

diff --git a/daemon/lua/sandbox.lua b/daemon/lua/sandbox.lua
index 320e93f7fc7c33fc8960f3c8d9ee31f2d9fa76dc..d1ca36633b20cec57023a0c6bf8106d5a0a44e19 100644 (file)
--- a/daemon/lua/sandbox.lua
+++ b/daemon/lua/sandbox.lua
@@ -18,6 +18,19 @@ if rawget(kres, 'str2dname') ~= nil then
        todname = kres.str2dname
 end
 
+-- Resolver mode of operation
+local current_mode = 'normal'
+local mode_table = { normal=0, strict=1, permissive=2 }
+function mode(m)
+       if not m then return current_mode end
+       if not mode_table[m] then error('unsupported mode: '..m) end
+       -- Update current operation mode
+       current_mode = m
+       option('STRICT', current_mode == 'strict')
+       option('PERMISSIVE', current_mode == 'permissive')
+       return true
+end
+
 -- Function aliases
 -- `env.VAR returns os.getenv(VAR)`
 env = {}

diff --git a/lib/layer/iterate.c b/lib/layer/iterate.c
index 6a039326481e39ab554eb3cfd75aee5980ce2e93..d28184597ca9c9791ab6b1c15b46ae0bb9a4e9d9 100644 (file)
--- a/lib/layer/iterate.c
+++ b/lib/layer/iterate.c
@@ -173,17 +173,26 @@ static int update_answer(const knot_rrset_t *rr, unsigned hint, knot_pkt_t *answ
        return KNOT_STATE_DONE;
 }
 
-static void fetch_glue(knot_pkt_t *pkt, const knot_dname_t *ns, struct kr_query *qry)
+static void fetch_glue(knot_pkt_t *pkt, const knot_dname_t *ns, struct kr_request *req)
 {
+       bool used_glue = false;
        for (knot_section_t i = KNOT_ANSWER; i <= KNOT_ADDITIONAL; ++i) {
                const knot_pktsection_t *sec = knot_pkt_section(pkt, i);
                for (unsigned k = 0; k < sec->count; ++k) {
                        const knot_rrset_t *rr = knot_pkt_rr(sec, k);
                        if (knot_dname_is_equal(ns, rr->owner)) {
-                               (void) update_nsaddr(rr, qry);
+                               (void) update_nsaddr(rr, req->current_query);
+                               used_glue = true;
                        }
                }
        }
+       WITH_DEBUG {
+               char name_str[KNOT_DNAME_MAXLEN];
+               knot_dname_to_str(name_str, ns, sizeof(name_str));
+               if (used_glue) {
+                       DEBUG_MSG("<= using glue for '%s'\n", name_str);
+               }
+       }
 }
 
 /** Attempt to find glue for given nameserver name (best effort). */
@@ -252,9 +261,17 @@ static int update_cut(knot_pkt_t *pkt, const knot_rrset_t *rr, struct kr_request
                        continue;
                }
                kr_zonecut_add(cut, ns_name, NULL);
-               /* Use glue only in permissive mode or when in bailiwick. */
-               if ((qry->flags & QUERY_PERMISSIVE) || knot_dname_in(current_cut, ns_name)) {
-                       fetch_glue(pkt, ns_name, qry);
+               /* Choose when to use glue records. */
+               if (qry->flags & QUERY_PERMISSIVE) {
+                       fetch_glue(pkt, ns_name, req);
+               } else if (qry->flags & QUERY_STRICT) {
+                       /* Strict mode uses only mandatory glue. */
+                       if (knot_dname_in(cut->name, ns_name))
+                               fetch_glue(pkt, ns_name, req);
+               } else {
+                       /* Normal mode uses in-bailiwick glue. */
+                       if (knot_dname_in(current_cut, ns_name))
+                               fetch_glue(pkt, ns_name, req);
                }
        }
 

diff --git a/lib/rplan.h b/lib/rplan.h
index 69a58fa3b75a453ec48f693cf1a4a558656ea92d..a804658b18720b3ffbf56541f259c210a15ee9b3 100644 (file)
--- a/lib/rplan.h
+++ b/lib/rplan.h
@@ -45,7 +45,8 @@
        X(STUB,            1 << 17) /**< Stub resolution, accept received answer as solved. */ \
        X(ALWAYS_CUT,      1 << 18) /**< Always recover zone cut (even if cached). */ \
        X(DNSSEC_WEXPAND,  1 << 19) /**< Query response has wildcard expansion. */ \
-       X(PERMISSIVE,      1 << 20) /**< Permissive referral path resolution. */
+       X(PERMISSIVE,      1 << 20) /**< Permissive resolver mode. */ \
+       X(STRICT,          1 << 21) /**< Strict resolver mode. */
 
 /** Query flags */
 enum kr_query_flag {