From: Petr Špaček Date: Thu, 9 Jan 2020 17:37:50 +0000 (+0100) Subject: doc: split networking into two parts, add picture with terminology X-Git-Tag: v5.0.0~8^2~9 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1480d70d9c568cc995e0541007f5ce3ae40334b0;p=thirdparty%2Fknot-resolver.git doc: split networking into two parts, add picture with terminology --- diff --git a/daemon/bindings/net_client.rst b/daemon/bindings/net_client.rst index c29874bed..2dcbf3dda 100644 --- a/daemon/bindings/net_client.rst +++ b/daemon/bindings/net_client.rst @@ -1,3 +1,6 @@ +IPv4 and IPv6 usage +------------------- + Following settings affect client part of the resolver, i.e. communication between the resolver itself and other DNS servers. diff --git a/daemon/bindings/net_dns_tweaks.rst b/daemon/bindings/net_dns_tweaks.rst index 017ad52c3..2deaddc0d 100644 --- a/daemon/bindings/net_dns_tweaks.rst +++ b/daemon/bindings/net_dns_tweaks.rst @@ -1,5 +1,5 @@ DNS protocol tweaks -=================== +------------------- Following settings change low-level details of DNS protocol implementation. Default values should not be changed except for very special cases. diff --git a/daemon/bindings/net_server.rst b/daemon/bindings/net_server.rst index 34b9bb23a..25273b4e5 100644 --- a/daemon/bindings/net_server.rst +++ b/daemon/bindings/net_server.rst @@ -1,181 +1,30 @@ -.. _network-configuration: +Addresses and services +---------------------- -Server addresses -================ +Addresses, ports, protocols, and API calls available for clients communicating +with resolver are configured using :func:`net.listen`. -Modern Linux distributions use so-called *Systemd socket activation*, which -effectively means that IP addresses and ports to listen on are configured -in Systemd configuration files. - -Older Linux systems and all non-Linux systems do not support this modern method -and have to resort to old fashioned way of configuring network interfaces using -``net.listen()`` configuration call. -Most notable examples of such systems are CentOS 7 and macOS. - -.. warning:: On machines with multiple IP addresses avoid listening on wildcards - ``0.0.0.0`` or ``::``. Knot Resolver could answer from different IP - addresses if the network address ranges overlap, - and clients would probably refuse such a response. - -Network configuration using systemd ------------------------------------ - -If you're using our packages with systemd with sockets support (not supported -on CentOS 7), network interfaces are configured using systemd drop-in files. - -Each protocol has its own configuration file. *By default, these are configured -to listen on localhost.* +First you need to decide what service should be available on given IP address ++ port combination. .. csv-table:: - :header: "**Network protocol**", "**Socket file name**" - - "DNS (UDP+TCP, :rfc:`1034`)","``kresd.socket``" - ":ref:`DNS-over-TLS (DoT) `","``kresd-tls.socket``" - ":ref:`mod-http-doh`","``kresd-doh.socket``" - ":ref:`Web management `","``kresd-webmgmt.socket``" - -.. warning:: You MUST NOT repeat the localhost defaults in the following - drop-in overrides, otherwise the socket will fail to start with "Address in - use" error. To view the entire socket configuration, including any drop-ins, - use systemctl cat. - -To configure kresd to listen on a **public interface** using the original DNS protocol, -create a drop-in file: - -.. code-block:: bash - - $ systemctl edit kresd.socket - -.. code-block:: none - - # /etc/systemd/system/kresd.socket.d/override.conf - # always listen on UDP (datagram) and TCP (stream) as well - [Socket] - ListenDatagram=192.0.2.115:53 - ListenStream=192.0.2.115:53 - -.. note:: If you change network interfaces of systemd sockets for already running - kresd instance, make sure to call ``systemctl restart system-kresd.slice`` for - these changes to take effect. - -Configuration you provide is automatically merged with defaults from your -distribution. It is also possible to check resulting configuration using -``systemctl cat``: - -.. code-block:: bash - - $ systemctl cat kresd.socket - -.. code-block:: none - - # merged result: user configuration + distro defaults - [Socket] - FileDescriptorName=dns - FreeBind=true - BindIPv6Only=both - ListenDatagram=[::1]:53 - ListenStream=[::1]:53 - ListenDatagram=127.0.0.1:53 - ListenStream=127.0.0.1:53 - ListenDatagram=192.0.2.115:53 - ListenStream=192.0.2.115:53 - - -.. _kresd-socket-override-port: - -The default localhost interface/port can also be removed/overriden by using an -empty ``ListenDatagram=`` or ``ListenStream=`` directive. This can be used when -you want to configure kresd to listen on all IPv4/IPv6 network interfaces (if -you've disabled IPv6 support in kernel, use ``0.0.0.0:port`` instead`` ). - -.. code-block:: none - - # /etc/systemd/system/kresd.socket.d/override.conf - [Socket] - ListenDatagram= - ListenStream= - ListenDatagram=53 - ListenStream=53 + :header: "Protocol/service", "net.listen *kind*" -.. note:: Using IPv6 to bind to IPv4 interfaces is currently not compatible - with IPv4 syntax in ``view:addr()`` when using the ``view`` module. For - possible workarounds, see - https://gitlab.labs.nic.cz/knot/knot-resolver/issues/445 + "DNS (unencrypted UDP+TCP, :rfc:`1034`)","``dns``" + ":ref:`DNS-over-TLS (DoT) `","``tls``" + ":ref:`mod-http-doh`","``doh``" + ":ref:`Web management `","``webmgmt``" -It can also be useful if you want to use the Knot DNS authoritative server -with the `dnsproxy module`_ to have both resolver and authoritative server -running on the same machine. This is not recommended configuration but it can -be done like this: -.. code-block:: none - # /etc/systemd/system/kresd.socket.d/override.conf - [Socket] - ListenDatagram= - ListenStream= - ListenDatagram=127.0.0.1:53000 - ListenStream=127.0.0.1:53000 - ListenDatagram=[::1]:53000 - ListenStream=[::1]:53000 - -.. _kresd-tls-socket-override-port: - -The ``kresd-tls.socket`` can also be configured in the same way to listen for -DNS-over-TLS connections (:rfc:`7858`). - -.. code-block:: bash - - $ systemctl edit kresd-tls.socket - -.. code-block:: none - - # /etc/systemd/system/kresd-tls.socket.d/override.conf - # specify only TCP (stream), DTLS is not supported - [Socket] - ListenStream=192.0.2.115:853 - -When configuring sockets for :ref:`mod-http-doh`, make sure you have -``kresd-doh.socket`` installed, it might be part of a separate -``knot-resolver-module-http`` package. - -.. warning:: Make sure you read section :ref:`mod-http-doh` before exposing - the DoH protocol to outside. - -For example, to remove the default localhost:44353 and listen on all interfaces -on port 443, create the following drop-in file for ``kresd-doh.socket``: - -.. code-block:: bash - - $ systemctl edit kresd-doh.socket - -.. code-block:: bash - - # /etc/systemd/system/kresd-doh.socket.d/override.conf - [Socket] - ListenStream= - ListenStream=443 - -Make sure no other service is using port 443, as that will result in -unpredictable behaviour. Alternately, you can use port 44353 where a collision -is unlikely. - -Also, don't forget to :ref:`load http module in configuration ` -file, otherwise the socket won't work. - -Legacy network configuration using configuration file ------------------------------------------------------ - -If you don't use systemd with sockets to run kresd, addresses and ports to listen -on are configured in the config file. +*By default, these are configured to listen on localhost.* .. function:: net.listen(addresses, [port = 53, { kind = 'dns', freebind = false }]) - :return: boolean + :return: ``true`` if port is bound, an error otherwise Listen on addresses; port and flags are optional. The addresses can be specified as a string or device. - The command can be given multiple times, - but repeating an address-port combination is an error. Port 853 implies ``kind = 'tls'`` but it is always better to be explicit. Freebind allows binding to a non-local or not yet available address. @@ -203,6 +52,16 @@ Examples: .. warning:: Make sure you read section :ref:`mod-http-doh` before exposing the DNS-over-HTTP protocol to outside. +.. warning:: On machines with multiple IP addresses avoid listening on wildcards + ``0.0.0.0`` or ``::``. Knot Resolver could answer from different IP + addresses if the network address ranges overlap, + and clients would probably refuse such a response. + + +Features for scripting +^^^^^^^^^^^^^^^^^^^^^^ +Following configuration functions are useful mainly for scripting or :ref:`runtime-cfg`. + .. function:: net.close(address, [port]) :return: boolean (at least one endpoint closed) @@ -210,11 +69,6 @@ Examples: Close all endpoints listening on the specified address, optionally restricted by port as well. -Additional network configuration options ----------------------------------------- - -Following commands are useful in special situations and can be usef with and without systemd socket activation: - .. function:: net.list() :return: Table of bound interfaces. diff --git a/daemon/bindings/net_tlssrv.rst b/daemon/bindings/net_tlssrv.rst index b59c26ce5..ce5a1a301 100644 --- a/daemon/bindings/net_tlssrv.rst +++ b/daemon/bindings/net_tlssrv.rst @@ -1,7 +1,7 @@ .. _tls-server-config: DNS-over-TLS server (DoT) -========================= +------------------------- DNS-over-TLS server (:rfc:`7858`) is enabled by default on loopback interface port 853. Information how to configure listening on specific IP addresses is in previous sections diff --git a/doc/config-network-forwarding.rst b/doc/config-network-forwarding.rst new file mode 100644 index 000000000..9a11175f2 --- /dev/null +++ b/doc/config-network-forwarding.rst @@ -0,0 +1,36 @@ +Forwarding +---------- + +*Forwarding* configuration instructs resolver to forward cache-miss queries from clients to a manually specified DNS resolvers *(upstream servers)*. In other words the *forwarding* mode does exact opposite of the default *recursive* mode because resolver in *recursive* mode automatically selects which servers to ask. + +Main use-cases are: + + - Building a tree structure of DNS resolvers to improve performance (by improving cache hit rate). + - Accessing domains which are not available using recursion (e.g. if internal company servers return different anusers than public ones). + - Forwarding through a central DNS traffic filter. + +Forwarding implementation in Knot Resolver has following properties: + + - Answers from *upstream* servers are cached. + - Answers from *upstream* servers are locally DNSSEC-validated. + - Resolver automatically selects which IP address from given set of IP addresses will be used (based on performance characteristics). + - Forwarding can use either unencrypted DNS protocol, or :ref:`tls-forwarding`. + +.. warning:: + + We strongly discourage use of "fake top-level domains" like ``corp.`` because these made-up domains are indistinguishable from an attack, so DNSSEC validation will prevent such domains from working. If you *really* need a variant of forwarding which does not DNSSEC-validate received data please see chapter :ref:`dns-graft`. In long-term it is better to migrate data into a legitimate, properly delegated domains which do not suffer from these security problems. + + +Simple examples for **unencrypted** forwarding: + +.. code-block:: lua + + -- forward all traffic to specified IP addresses (selected automatically) + policy.add(policy.all(policy.FORWARD({'2001:db8::1', '192.0.2.1'}))) + + -- forward only queries for names under domain example.com to a single IP address + policy.add(policy.suffix(policy.FORWARD('192.0.2.1'), {todname('example.com.')})) + +To configure encrypted version please see chapter :ref:`tls-forwarding`. + +Forwarding is documented in depth together with rest of :ref:`mod-policy`. diff --git a/doc/config-network.rst b/doc/config-network.rst index 6b5201a19..05629d7cd 100644 --- a/doc/config-network.rst +++ b/doc/config-network.rst @@ -1,15 +1,61 @@ +.. _network-configuration: + ************************ Networking and protocols ************************ -This section describes configuration of network interfaces and protocols. +This section describes configuration of network interfaces +and protocols. Please keep in mind that DNS resolvers act +as *DNS server* and *DNS client* at the same time, +and that these roles require different configuration. + +This picture ilustrates different actors involved DNS resolution process, +supported protocols, and clarifies what we call *server configuration* +and *client configuration*. + +.. image:: server_terminology.svg + +For *resolver's clients* the resolver itself acts as a DNS server. + +After receiving a query the resolver will attempt to find +answer in its cache. If the data requested by resolver's +client is not available in resolver's cache (so-called *cache-miss*) +the resolver will attempt to obtain the data from servers *upstream* +(closer to the source of information), so at this point the resolver +itself acts like a DNS client and will send DNS query to other servers. + +By default the Knot Resolver works in recursive mode, i.e. +the resolver will contact authoritative servers on the Internet. +Optionally it can be configured in forwarding mode, +where cache-miss queries are *forwarded to another DNS resolver* +for processing. + +Server (communication with clients) +=================================== .. toctree:: :maxdepth: 2 daemon-bindings-net_server - daemon-bindings-net_client daemon-bindings-net_tlssrv modules-http modules-http-doh + +Client (retrieving answers from servers) +======================================== + +Following chapters describe basic configuration of how resolver retrieves data from other *(upstream)* servers. Data processing is also affected by configured policies, see chapter :ref:`policies` for more advanced usage. + +.. toctree:: + :maxdepth: 2 + + daemon-bindings-net_client + config-network-forwarding + +DNS protocol tweaks +=================== + +.. toctree:: + :maxdepth: 2 + daemon-bindings-net_dns_tweaks diff --git a/doc/config-policy.rst b/doc/config-policy.rst index 6c7afbb15..0c1da6343 100644 --- a/doc/config-policy.rst +++ b/doc/config-policy.rst @@ -1,3 +1,5 @@ +.. _policies: + ***************************************** Policy, access control, data manipulation ***************************************** diff --git a/doc/server_terminology.fodg b/doc/server_terminology.fodg new file mode 100644 index 000000000..6305edc5b --- /dev/null +++ b/doc/server_terminology.fodg @@ -0,0 +1,869 @@ + + + + Petr Å paček2020-01-09T14:38:06.40621582517PT26M51S2020-01-09T16:17:39.160036580Petr Å pačekLibreOffice/6.3.4.2.0$Linux_X86_64 LibreOffice_project/30$Build-2Basic DNS terminology + + + 2884 + -318 + 23019 + 23865 + + + view1 + false + false + true + true + false + false + false + false + true + 1500 + false + Hw== + Hw== + + false + true + true + 0 + 0 + true + true + true + 4 + 0 + 2884 + -318 + 23020 + 23866 + 1000 + 1000 + 100 + 100 + 100 + 1 + 100 + 1 + false + 1500 + false + false + + + + + true + $(brandbaseurl)/share/palette%3B$(user)/config/standard.sob + 0 + $(brandbaseurl)/share/palette%3B$(user)/config/standard.soc + $(brandbaseurl)/share/palette%3B$(user)/config/standard.sod + 1250 + true + true + false + true + false + + + cs + CZ + + + + + + $(brandbaseurl)/share/palette%3B$(user)/config/standard.sog + $(brandbaseurl)/share/palette%3B$(user)/config/standard.soh + false + false + true + true + false + false + true + false + false + false + $(brandbaseurl)/share/palette%3B$(user)/config/standard.soe + false + 3 + 4 + false + 0 + low-resolution + HP_LaserJet_M2727nf_MFP + false + 1wH+/0hQX0xhc2VySmV0X00yNzI3bmZfTUZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ1VQUzpIUF9MYXNlckpldF9NMjcyN25mX01GUAAAAAAWAAMA8wAAAAAAAAAEAAhSAAAEdAAASm9iRGF0YSAxCnByaW50ZXI9SFBfTGFzZXJKZXRfTTI3MjduZl9NRlAKb3JpZW50YXRpb249UG9ydHJhaXQKY29waWVzPTEKY29sbGF0ZT1mYWxzZQptYXJnaW5kYWp1c3RtZW50PTAsMCwwLDAKY29sb3JkZXB0aD0yNApwc2xldmVsPTAKcGRmZGV2aWNlPTEKY29sb3JkZXZpY2U9MApQUERDb250ZXhEYXRhClBhZ2VTaXplOkE0AER1cGxleDpEdXBsZXhOb1R1bWJsZQBIUEVjb25vTW9kZTpGYWxzZQBJbnB1dFNsb3Q6QXV0bwAAEgBDT01QQVRfRFVQTEVYX01PREUUAER1cGxleE1vZGU6OkxvbmdFZGdl + true + false + 1 + 1 + true + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+ + CjxzdmcKICAgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIgog + ICB4bWxuczpjYz0iaHR0cDovL2NyZWF0aXZlY29tbW9ucy5vcmcvbnMjIgogICB4bWxuczpy + ZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiCiAgIHht + bG5zOnN2Zz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciCiAgIHhtbG5zPSJodHRwOi8v + d3d3LnczLm9yZy8yMDAwL3N2ZyIKICAgeG1sbnM6c29kaXBvZGk9Imh0dHA6Ly9zb2RpcG9k + aS5zb3VyY2Vmb3JnZS5uZXQvRFREL3NvZGlwb2RpLTAuZHRkIgogICB4bWxuczppbmtzY2Fw + ZT0iaHR0cDovL3d3dy5pbmtzY2FwZS5vcmcvbmFtZXNwYWNlcy9pbmtzY2FwZSIKICAgZGF0 + YS1uYW1lPSJMYXllciAxIgogICB2aWV3Qm94PSIwIDAgNjAgODUiCiAgIHg9IjBweCIKICAg + eT0iMHB4IgogICB2ZXJzaW9uPSIxLjEiCiAgIGlkPSJzdmc0MCIKICAgc29kaXBvZGk6ZG9j + bmFtZT0ibm91bl9TZXJ2ZXJfMTY1MzA2NC5zdmciCiAgIHdpZHRoPSI2MCIKICAgaGVpZ2h0 + PSI4NSIKICAgaW5rc2NhcGU6dmVyc2lvbj0iMC45Mi40IDVkYTY4OWMzMTMsIDIwMTktMDEt + MTQiPgogIDxtZXRhZGF0YQogICAgIGlkPSJtZXRhZGF0YTQ2Ij4KICAgIDxyZGY6UkRGPgog + ICAgICA8Y2M6V29yawogICAgICAgICByZGY6YWJvdXQ9IiI+CiAgICAgICAgPGRjOmZvcm1h + dD5pbWFnZS9zdmcreG1sPC9kYzpmb3JtYXQ+CiAgICAgICAgPGRjOnR5cGUKICAgICAgICAg + ICByZGY6cmVzb3VyY2U9Imh0dHA6Ly9wdXJsLm9yZy9kYy9kY21pdHlwZS9TdGlsbEltYWdl + IiAvPgogICAgICAgIDxkYzp0aXRsZT5kYXRhLCBzZXJ2ZXIsIGRhdGFiYXNlLCByb3V0ZXIs + IGhhcmR3YXJlPC9kYzp0aXRsZT4KICAgICAgPC9jYzpXb3JrPgogICAgPC9yZGY6UkRGPgog + IDwvbWV0YWRhdGE+CiAgPGRlZnMKICAgICBpZD0iZGVmczQ0IiAvPgogIDxzb2RpcG9kaTpu + YW1lZHZpZXcKICAgICBwYWdlY29sb3I9IiNmZmZmZmYiCiAgICAgYm9yZGVyY29sb3I9IiM2 + NjY2NjYiCiAgICAgYm9yZGVyb3BhY2l0eT0iMSIKICAgICBvYmplY3R0b2xlcmFuY2U9IjEw + IgogICAgIGdyaWR0b2xlcmFuY2U9IjEwIgogICAgIGd1aWRldG9sZXJhbmNlPSIxMCIKICAg + ICBpbmtzY2FwZTpwYWdlb3BhY2l0eT0iMCIKICAgICBpbmtzY2FwZTpwYWdlc2hhZG93PSIy + IgogICAgIGlua3NjYXBlOndpbmRvdy13aWR0aD0iOTU2IgogICAgIGlua3NjYXBlOndpbmRv + dy1oZWlnaHQ9IjEwNTQiCiAgICAgaWQ9Im5hbWVkdmlldzQyIgogICAgIHNob3dncmlkPSJm + YWxzZSIKICAgICBmaXQtbWFyZ2luLXRvcD0iMCIKICAgICBmaXQtbWFyZ2luLWxlZnQ9IjAi + CiAgICAgZml0LW1hcmdpbi1yaWdodD0iMCIKICAgICBmaXQtbWFyZ2luLWJvdHRvbT0iMCIK + ICAgICBpbmtzY2FwZTp6b29tPSIxLjg4OCIKICAgICBpbmtzY2FwZTpjeD0iLTE0LjY0NjAx + MyIKICAgICBpbmtzY2FwZTpjeT0iMjkuNSIKICAgICBpbmtzY2FwZTp3aW5kb3cteD0iOTYy + IgogICAgIGlua3NjYXBlOndpbmRvdy15PSIyIgogICAgIGlua3NjYXBlOndpbmRvdy1tYXhp + bWl6ZWQ9IjEiCiAgICAgaW5rc2NhcGU6Y3VycmVudC1sYXllcj0ic3ZnNDAiIC8+CiAgPHRp + dGxlCiAgICAgaWQ9InRpdGxlMiI+ZGF0YSwgc2VydmVyLCBkYXRhYmFzZSwgcm91dGVyLCBo + YXJkd2FyZTwvdGl0bGU+CiAgPHJlY3QKICAgICB4PSIxMCIKICAgICB5PSIzNiIKICAgICB3 + aWR0aD0iNCIKICAgICBoZWlnaHQ9IjYiCiAgICAgaWQ9InJlY3Q0IiAvPgogIDxyZWN0CiAg + ICAgeD0iMTgiCiAgICAgeT0iMzYiCiAgICAgd2lkdGg9IjQiCiAgICAgaGVpZ2h0PSI2Igog + ICAgIGlkPSJyZWN0NiIgLz4KICA8cmVjdAogICAgIHg9IjI2IgogICAgIHk9IjM2IgogICAg + IHdpZHRoPSI0IgogICAgIGhlaWdodD0iNiIKICAgICBpZD0icmVjdDgiIC8+CiAgPHJlY3QK + ICAgICB4PSIzNCIKICAgICB5PSIzNiIKICAgICB3aWR0aD0iNCIKICAgICBoZWlnaHQ9IjYi + CiAgICAgaWQ9InJlY3QxMCIgLz4KICA8Y2lyY2xlCiAgICAgY3g9IjQ4IgogICAgIGN5PSIz + OSIKICAgICByPSIyIgogICAgIGlkPSJjaXJjbGUxMiIgLz4KICA8cGF0aAogICAgIGQ9Im0g + NTUsMjQgYSA1LDUgMCAwIDAgNSwtNSBWIDUgQSA1LDUgMCAwIDAgNTUsMCBIIDUgQSA1LDUg + MCAwIDAgMCw1IHYgMTQgYSA1LDUgMCAwIDAgNSw1IGggMSB2IDMgSCA1IGEgNSw1IDAgMCAw + IC01LDUgdiAxNCBhIDUsNSAwIDAgMCA1LDUgaCAxIHYgMyBIIDUgYSA1LDUgMCAwIDAgLTUs + NSB2IDE0IGEgNSw1IDAgMCAwIDUsNSBoIDEgdiA3IGggNDggdiAtNyBoIDEgYSA1LDUgMCAw + IDAgNSwtNSBWIDU5IGEgNSw1IDAgMCAwIC01LC01IGggLTEgdiAtMyBoIDEgYSA1LDUgMCAw + IDAgNSwtNSBWIDMyIEEgNSw1IDAgMCAwIDU1LDI3IEggNTQgViAyNCBaIE0gNTAsODEgSCAx + MCB2IC0zIGggNDAgeiBtIDUsLTIzIGEgMSwxIDAgMCAxIDEsMSB2IDE0IGEgMSwxIDAgMCAx + IC0xLDEgSCA1IEEgMSwxIDAgMCAxIDQsNzMgViA1OSBBIDEsMSAwIDAgMSA1LDU4IFogTSAx + MCw1NCB2IC0zIGggNDAgdiAzIHogTSA1NSwzMSBhIDEsMSAwIDAgMSAxLDEgdiAxNCBhIDEs + MSAwIDAgMSAtMSwxIEggNSBBIDEsMSAwIDAgMSA0LDQ2IFYgMzIgQSAxLDEgMCAwIDEgNSwz + MSBaIE0gMTAsMjcgdiAtMyBoIDQwIHYgMyB6IE0gNSwyMCBBIDEsMSAwIDAgMSA0LDE5IFYg + NSBBIDEsMSAwIDAgMSA1LDQgaCA1MCBhIDEsMSAwIDAgMSAxLDEgdiAxNCBhIDEsMSAwIDAg + MSAtMSwxIHoiCiAgICAgaWQ9InBhdGgxNCIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3Vy + dmF0dXJlPSIwIiAvPgogIDxyZWN0CiAgICAgeD0iMTAiCiAgICAgeT0iOSIKICAgICB3aWR0 + aD0iNCIKICAgICBoZWlnaHQ9IjYiCiAgICAgaWQ9InJlY3QxNiIgLz4KICA8cmVjdAogICAg + IHg9IjE4IgogICAgIHk9IjkiCiAgICAgd2lkdGg9IjQiCiAgICAgaGVpZ2h0PSI2IgogICAg + IGlkPSJyZWN0MTgiIC8+CiAgPHJlY3QKICAgICB4PSIyNiIKICAgICB5PSI5IgogICAgIHdp + ZHRoPSI0IgogICAgIGhlaWdodD0iNiIKICAgICBpZD0icmVjdDIwIiAvPgogIDxyZWN0CiAg + ICAgeD0iMzQiCiAgICAgeT0iOSIKICAgICB3aWR0aD0iNCIKICAgICBoZWlnaHQ9IjYiCiAg + ICAgaWQ9InJlY3QyMiIgLz4KICA8Y2lyY2xlCiAgICAgY3g9IjQ4IgogICAgIGN5PSIxMiIK + ICAgICByPSIyIgogICAgIGlkPSJjaXJjbGUyNCIgLz4KICA8cmVjdAogICAgIHg9IjEwIgog + ICAgIHk9IjYzIgogICAgIHdpZHRoPSI0IgogICAgIGhlaWdodD0iNiIKICAgICBpZD0icmVj + dDI2IiAvPgogIDxyZWN0CiAgICAgeD0iMTgiCiAgICAgeT0iNjMiCiAgICAgd2lkdGg9IjQi + CiAgICAgaGVpZ2h0PSI2IgogICAgIGlkPSJyZWN0MjgiIC8+CiAgPHJlY3QKICAgICB4PSIy + NiIKICAgICB5PSI2MyIKICAgICB3aWR0aD0iNCIKICAgICBoZWlnaHQ9IjYiCiAgICAgaWQ9 + InJlY3QzMCIgLz4KICA8cmVjdAogICAgIHg9IjM0IgogICAgIHk9IjYzIgogICAgIHdpZHRo + PSI0IgogICAgIGhlaWdodD0iNiIKICAgICBpZD0icmVjdDMyIiAvPgogIDxjaXJjbGUKICAg + ICBjeD0iNDgiCiAgICAgY3k9IjY2IgogICAgIHI9IjIiCiAgICAgaWQ9ImNpcmNsZTM0IiAv + Pgo8L3N2Zz4K + + + + + iVBORw0KGgoAAAANSUhEUgAAAD0AAABWCAYAAAB8UZ5wAAABO0lEQVR4nO2Z7Q6CMAxFJeH9 + XxmtyUzFgRtf2t5zfikjccduDnvHaZpuaoz+zTAMab+BR3GH8volnVnYML8iPpYLv53SNRTx + sTbol0Jklor5IZ1F2DCXmni10tlBWoVm6fnemO/9s8ePhEpHw6+OnpURWnorSEdj649ds/S3 + Dzh7/EhCV3orSKuAtKHQUKDSKjyllzoM2XhrDPoLhSv/6h1Bz3x1l7cazUdWtD1f5ltb5ulj + nZo8sU52iHU8WYQNYh0H0ioQ66gQWlou1tnzQBVWek/jI6y0QazTQehKbwVpFZA2FBoKVFoF + Yh1/A7FOMpA2iHUSQKxDrDPj34+nVoh1HBxZKiC9BrFOcEJLE+t0EFaaWKcTYh0VkFYBaUOh + oUClVSDW8TcQ6yQD6TUy7XkqrQLSnn8/ovZwB2IfDVe+8hdvAAAAAElFTkSuQmCC + + + data, server, database, router, hardware + + + + authoritativeserver + + + + + + + PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6 + IEFkb2JlIElsbHVzdHJhdG9yIDIzLjAuNiwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZl + cnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IlZyc3R2 + YV8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJo + dHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94 + PSIwIDAgMjA2IDIwOSIgc3R5bGU9ImVuYWJsZS1iYWNrZ3JvdW5kOm5ldyAwIDAgMjA2IDIw + OTsiIHhtbDpzcGFjZT0icHJlc2VydmUiPgo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPgoJLnN0 + MHtmaWxsOiMwMEEyRTI7fQo8L3N0eWxlPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjA2LDEw + NC42YzAsMzEuNC0xMy45LDU5LjUtMzYsNzguNmMxLjItNi4zLDEuOS0xMi45LDEuOS0xOS42 + YzAtMjAuNS02LjEtMzkuNy0xNi41LTU1LjgKCWMtNC4xLDUuNy04LjgsMTEtMTMuOSwxNS44 + YzYuNiwxMS44LDEwLjMsMjUuNSwxMC4zLDQwYzAsNS45LTAuNiwxMS42LTEuOCwxNy4yYy0w + LjEsMC42LTAuMywxLjItMC40LDEuOGMtMC4xLDAuNi0wLjMsMS4yLTAuNCwxLjgKCWMtMC42 + LTAuMi0xLjItMC4zLTEuOC0wLjVjLTAuNi0wLjItMS4yLTAuMy0xLjctMC42Yy0xOS02LjIt + MzUtMTkuMS00NS4yLTM1LjljLTAuMy0wLjUtMC42LTEuMS0xLTEuNmMtMC4zLTAuNS0wLjYt + MS4xLTAuOS0xLjYKCWMtMy4yLTUuOS01LjctMTIuMi03LjQtMTguOGMtMC4xLTAuNi0wLjMt + MS4yLTAuNC0xLjhjLTAuMi0wLjYtMC4zLTEuMi0wLjQtMS44Yy0xLjItNS41LTEuOC0xMS4z + LTEuOC0xNy4yczAuNi0xMS42LDEuOC0xNy4yCgljLTYuMy0xLjgtMTMtMi44LTE5LjktMi45 + Yy0xLjMsNi41LTIsMTMuMi0yLDIwYzAsNi45LDAuNywxMy42LDIsMjAuMWMwLjEsMC42LDAu + MiwxLjIsMC40LDEuOGMwLjEsMC42LDAuMywxLjIsMC40LDEuOAoJYzEuNiw2LjgsMy45LDEz + LjQsNi45LDE5LjdjMC4zLDAuNiwwLjUsMS4yLDAuOCwxLjdjMC4zLDAuNiwwLjYsMS4yLDAu + OSwxLjhjMTIuMSwyMy41LDMzLDQxLjgsNTguNCw1MC40CgljLTExLjIsNC4xLTIzLjMsNi40 + LTM1LjksNi40Yy01MS41LDAtOTQuMi0zNy41LTEwMi4zLTg2LjdjMC41LDAuNCwwLjksMC44 + LDEuNCwxLjJjMTguMSwxNS45LDQxLjgsMjUuNSw2Ny43LDI1LjUKCWMxLjcsMCwzLjQsMCw1 + LjEtMC4xYy0yLjktNi40LTUuMS0xMy02LjctMjBjLTIwLjYtMC40LTM5LjMtOC4zLTUzLjYt + MjEuMmMtMC41LTAuNC0wLjktMC44LTEuNC0xLjJjLTAuNS0wLjQtMC45LTAuOC0xLjMtMS4z + CgljMC40LTAuNCwwLjgtMC45LDEuMy0xLjNjMC40LTAuNCwwLjktMC44LDEuMy0xLjJjMTQu + My0xMi45LDMzLTIwLjgsNTMuNi0yMS4yYzAuNSwwLDEuMSwwLDEuNiwwaDAuM2MwLjYsMCwx + LjMsMCwxLjksMAoJYzYuOSwwLjIsMTMuNiwxLjIsMjAsM2MwLjYsMC4yLDEuMiwwLjMsMS43 + LDAuNWMwLjYsMC4yLDEuMiwwLjQsMS43LDAuNWMxMS4xLDMuNiwyMS4yLDkuNSwyOS42LDE3 + LjJjNC44LTQuNyw5LTEwLDEyLjUtMTUuOAoJYy0xMC04LjgtMjEuOC0xNS43LTM0LjctMjAu + MWMtMC42LTAuMi0xLjItMC40LTEuNy0wLjZjLTAuNi0wLjItMS4yLTAuNC0xLjgtMC42Yy02 + LjYtMi0xMy40LTMuMy0yMC41LTMuOQoJYy0wLjYtMC4xLTEuMy0wLjEtMS45LTAuMmMtMC43 + LDAtMS4zLTAuMS0yLTAuMWMtMS43LTAuMS0zLjQtMC4xLTUuMS0wLjFjLTI1LjksMC00OS42 + LDkuNi02Ny43LDI1LjVjLTAuNSwwLjQtMC45LDAuOC0xLjQsMS4yCglDOC4xLDM4LjQsNTAu + OCwwLjksMTAyLjMsMC45YzEyLjYsMCwyNC43LDIuMywzNS45LDYuNGMwLDAsMCwwLDAsMEMx + MTIuOCwxNS45LDkyLDM0LjEsNzkuOCw1Ny42YzcuMSwwLjcsMTQsMi4xLDIwLjcsNC4yCglj + MTAuMi0xNi44LDI2LjItMjkuNyw0NS4yLTM1LjljMC42LTAuMiwxLjItMC40LDEuNy0wLjZj + MC42LTAuMiwxLjItMC4zLDEuOC0wLjVjMC4xLDAuNiwwLjMsMS4yLDAuNCwxLjhjMC4xLDAu + NiwwLjMsMS4yLDAuNCwxLjgKCWMxLjIsNS41LDEuOCwxMS4zLDEuOCwxNy4yYzAsMTQuNS0z + LjcsMjguMS0xMC4zLDQwYy0wLjMsMC41LTAuNiwxLjEtMC45LDEuNmMtMC4zLDAuNS0wLjYs + MS4xLTEsMS42Yy0zLjUsNS43LTcuOCwxMS4xLTEyLjYsMTUuOAoJYy0wLjQsMC40LTAuOSww + LjktMS4zLDEuM2MtMC40LDAuNC0wLjksMC44LTEuMywxLjJjLTguNSw3LjYtMTguNiwxMy41 + LTI5LjcsMTcuMmMxLjcsNi42LDQuMiwxMi45LDcuNSwxOC43CgljMTIuOS00LjQsMjQuNi0x + MS4zLDM0LjYtMjAuMWMwLjUtMC40LDAuOS0wLjgsMS40LTEuMmMwLjUtMC40LDAuOS0wLjgs + MS40LTEuM2M1LjEtNC44LDkuNy0xMC4xLDEzLjctMTUuOAoJYzAuNC0wLjUsMC43LTEuMSwx + LjEtMS42YzAuNC0wLjUsMC43LTEuMSwxLjEtMS42YzEwLjQtMTYuMSwxNi41LTM1LjIsMTYu + NS01NS43YzAtNi43LTAuNi0xMy4zLTEuOS0xOS42CglDMTkyLDQ1LDIwNiw3My4yLDIwNiwx + MDQuNiIvPgo8L3N2Zz4K + + + + + iVBORw0KGgoAAAANSUhEUgAAAM4AAADRCAYAAACEn42KAAAKW0lEQVR4nO2dW3LkNgxFPVXe + RpaW1WVpWYhTmik6sppQUyQeF+A9n1NTbjaAI0BsPT6/vr4+CCHP+IxeAPn4+PXPv0NHr6+/ + //plvRYyBsUxZlQKrb9FuXygOApoyrHK3VoolR4UZxIkWUa5rpkizUNxHpBRljt634cyjUFx + bqgmygjsSmNQnAs7ynLHEQ/K8wrF+aAsEhRGZltxKEsfyjLGduJQmD4U5hnbiENh+lCYOUqL + Q1lkKMwaJcWhMH0oix5lxKEsMhRGn/TiUBgZCmNHanEojQylsSWtOJRGhtLYk1IcStOHwviR + ShwKI0NpfEkjDqWRoTT+pBCH0vShMHFAi0NhZChNLLDiUBoZShMPpDiUpg+FwQFOHErTJ4M0 + LXcZ1roKjDgURga9EK+52+F2awhxKI0McgF65g1NxnBxKI0MUqE0IvOFJE+oOJRGBqVAGii5 + QpEnTByURCCCUBgNxDwhyBMiDmIyUIguiAPE/BxxOa8rWh53cRCTgkK0NNlyEymPqzjZEuNJ + NWm8ijpKHjdxKI1MpDQV8hIhj4s4FZJjBaXRwVsec3EqJUebKGmq5sRTHlNxqiZIA0pjg5c8 + ZuJUT9AKEdLslA8PeUzE2SlJT6E0PljLoy7OjkkahdL4YilP+EWexI5q0lyvHhjBSh5Vcaol + ShPvboOQi+jLYixREwchUajsKA0SFgJzVCsGpfFBRRwmS8az2zAPMtpdZ1kcJkuG0mChKQ9H + tQJQGn+WxGHCZLy6DXPwDK2uMy0OEyZDaf5QdSv6gKNaUtClQUaj60yJw6TJeN31aP0Z5J7H + 4jBpsTD+Oqx2HY5qilh3m92lQXouwiNxdk/cHZVPhMkr7DhJ4EHLhtmuMywOEyfDEe2V6h2Y + HWcRSpOfma5DcRbpFXb1o21FnsozJA6Pes94F6/RBDHuuLDjBHAWQpKI0vjzpOu8Fad6AjXG + qpUY9SSqHvMKlO44Xucavc+ZKX4Kk4dbcTIkEvVEXEumjFjkxCt2o+Nayo6DKss7dpapGinE + ySrKCJQpJ6I4kcmrLMoI3CSIZWRcg+k4u8vS4xwTSoRFVxyvJFGWcbJ0ocwbA08I6TgUZp4s + AmXn3bjmJg5l0YVjXCwv4mgngcLYg9KFdsq1WcfZKYgooAhUhbtxTVUcyoJBpTEOdf0/xJld + JIXBxasL7VYDSx1nt2BlZuZtZkQe16bFoTT5sJLHqhaQRZ8Sh9LkhRsIOnyLMxJIClMHjm7j + 9Ma14Y5DaeqhIc+OY9rBkDiUpi4c3ea4FaeiMKhH2GiQRjeUdZy5jmuf7R+v/zFjgXgE/O4z + MsbszFN5sn/fFV46TrZgIB2dKhyAOLqN8UOcLEnOlFRpreixjhrdsuT2sy0UPZHeAbV+FkCG + uN/Jg7xuD353HNQgoB19LB5diy4Q0qZBNOcNgk/EhGVP1Ey3GnksbgSe522Z8g7zsI6DTIGz + BKULVdjssAJCHArTJ1Ig75xkq4EwcZADhXZU9R7juCHwHndxkIXJQFQXsvy8jDXhJk7G4CBj + JRDPa8YwF4fC2DL71mTpb13/je847WMqTtagZENDHl4lMEaLtZk4GYOSmZXRjZsBzzERh9L8 + xDMeT7tPlDTZa0RdnOwBqcDq6MZO8x41cSgMFiPyRO2gVagVFXEqBKIid+c93HZeY1mcatJU + LJ5r94nMWZV6WRKnShB24F2uKh4wrDhiOS0OpamDlzSVauaxOJW+PKE0szwSp9qX3x1KM88j + cXgbLSF/eDyqUZ78eG4EVK2VpbcVVA1KVbx3zirXx/KLpSoHpxKURpflH0ApDz4Iv9FUmlLU + biuoJI/mjWHRRH2Pay1UiecZtYs8K8lTAVRpqtSJyevaKwQmM6jSVMLkRrYqR5WMZCjWCvVh + dut0heBo4RGLaGF26jYHpg/roDw+RBfpjDTZa8P88VA877ElozTn/5utLr7fVuD9gdkChUq0 + MAe7jWdn3B+BS4HWQClOLWkydp2DsIeuo9zKmwEUWRrMF8hrPtC6EMrVAwhruGLxkI+MXQdC + nAaaQFEgCnPAJ+P8D5Q4jR0FQi9Aa2mydR3ot05XOg+SCgMx7mf4XOk+ny2hKHO9RCWJGsjx + PvCOM3rXOefrx6iGLk+jokRojLwlO0OtWPFyjoM8uvWwksijMBCLL/pAhN51Gr/F6S0WManv + GFlvZFLQiwJ5bWjc7qpllOcdM0/w34GZ712xPkZ5ux2dbXTTZIdxDfFAgdiZrzka/h0nOsFV + QCoKlHVk5FuckYTu0H2QCtsSre9odUBFz8PUlQM7dZ9q4xpyMaLSy83Saz52kUebqKNpNmmQ + u47Ki6UoED6WBbjjQfSHOLOGVxco87iGesTOgpQT1aujqwjk9VQaq8+IGgOz5/0JJrcVVBHI + m9Xiq9hdUM9zXsTRXGglgSyOqFqxRiysCtzl2+VGtowCoR7pGohr22lcc70DNKNA1lwFfVd8 + iMLsSFcc66NtVoEifyWnML68y3PoMwfOxYAoEX+ofA7yuaAmojjei814P74miMVBZCCfctNA + eMTq03MQkp+R/EKLc2X3rkRwuBUnw/hwtz5KRaxI1XGeMiL9zLtcdr0HZZTMGwSj634rTpVk + SqB9t+rxrkLpjmOJ5SYB5cFnSBwm0h/G3J8nB0J2nAW4NV2Hp3mkOItwZNuTYXGYRBnKk5uZ + 3LHjJCCjPNXH2EfiZEygF9ULpSqzOWPHUYQjWy5WcvVYHCYwjt1jj/T9pzoO0hdAw3pkY+x1 + WM0RR7WEUJ54psVh8mQ8NgoY/3k0crPUcZg8GcqDudOotR6OaslBl6cqy+IwcTJeR1zmYAzN + XKh0HCZOhvLUhKNaISiPjPbBS00cJk3G8ySZeXjFIvaqHYdJk6E8teCoVhQEeRC2oq3WoC4O + QsJQ8f5do31WlXw8/R6WsTbpOJRHJuJHwR3zYR1js1Ftx2SNEiVP+2zPz43AI7am5ziURybq + cpTqOfGKqfnmQPVErRApT/t878+2xDOWLrtqlEcm8kLISnnxjqHbdnSlJGkTLU9bQ8TnaxAR + O9ffcSiPTPQl+FlzExUz9x9AsybIAwR52jq0/pYlkbEKuXKA8shEy3OAOL4hvJ3vTNglN5RH + BkGeg/MakHKFEJvQa9UojwyKPA2ULoQSk/CLPCmPDJo8B5ECIcUiXJwDyiODKM+B9xiHFgMI + cQ5QRgFEUOVp7HjggxGnsWMSRsggT/QaPIET54Dy9Gkx2a1IEYEU54DyyKB3nx2AFeeA5z0y + lCcWaHEa7D59OLrFkUKcA8ojw+7jTxpxDji6yVAeX1KJ02D36cPRzY+U4hxQHhl2H3vSinNA + eWQojy2pxTngeY8MRzc70ovTQL13BAEKpE8Zcc6wC/U5x4MSrVFSnAYFkmEXWqO0OA2OcTIU + aI4txDnDLtSHAj1jO3Ea7EJ9eB40xrbinKFEfdiFZCjOBUr0E0rTh+LcsKtElOU9FGeQazFV + E4myPIPiTJK9G1GUNSiOAndFiCQVZdGD4hgzUqwrclGGGCgOACz+fPwHwrxYlCRUiFQAAAAA + SUVORK5CYII= + + + + + + Knot Resolver + + + + + + + PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+ + CjxzdmcKICAgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIgog + ICB4bWxuczpjYz0iaHR0cDovL2NyZWF0aXZlY29tbW9ucy5vcmcvbnMjIgogICB4bWxuczpy + ZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiCiAgIHht + bG5zOnN2Zz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciCiAgIHhtbG5zPSJodHRwOi8v + d3d3LnczLm9yZy8yMDAwL3N2ZyIKICAgeG1sbnM6c29kaXBvZGk9Imh0dHA6Ly9zb2RpcG9k + aS5zb3VyY2Vmb3JnZS5uZXQvRFREL3NvZGlwb2RpLTAuZHRkIgogICB4bWxuczppbmtzY2Fw + ZT0iaHR0cDovL3d3dy5pbmtzY2FwZS5vcmcvbmFtZXNwYWNlcy9pbmtzY2FwZSIKICAgZGF0 + YS1uYW1lPSJMYXllciAxIgogICB2aWV3Qm94PSIwIDAgODggODUuMDAwMDAzIgogICB4PSIw + cHgiCiAgIHk9IjBweCIKICAgdmVyc2lvbj0iMS4xIgogICBpZD0ic3ZnMTIzIgogICBzb2Rp + cG9kaTpkb2NuYW1lPSJub3VuX3NlcnZlcnNfMTY1MzA4My5zdmciCiAgIHdpZHRoPSI4OCIK + ICAgaGVpZ2h0PSI4NSIKICAgaW5rc2NhcGU6dmVyc2lvbj0iMC45Mi40IDVkYTY4OWMzMTMs + IDIwMTktMDEtMTQiPgogIDxtZXRhZGF0YQogICAgIGlkPSJtZXRhZGF0YTEyOSI+CiAgICA8 + cmRmOlJERj4KICAgICAgPGNjOldvcmsKICAgICAgICAgcmRmOmFib3V0PSIiPgogICAgICAg + IDxkYzpmb3JtYXQ+aW1hZ2Uvc3ZnK3htbDwvZGM6Zm9ybWF0PgogICAgICAgIDxkYzp0eXBl + CiAgICAgICAgICAgcmRmOnJlc291cmNlPSJodHRwOi8vcHVybC5vcmcvZGMvZGNtaXR5cGUv + U3RpbGxJbWFnZSIgLz4KICAgICAgICA8ZGM6dGl0bGU+ZGF0YSwgc2VydmVyLCBkYXRhYmFz + ZSxkYiwgaG9zdGluZzwvZGM6dGl0bGU+CiAgICAgIDwvY2M6V29yaz4KICAgIDwvcmRmOlJE + Rj4KICA8L21ldGFkYXRhPgogIDxkZWZzCiAgICAgaWQ9ImRlZnMxMjciIC8+CiAgPHNvZGlw + b2RpOm5hbWVkdmlldwogICAgIHBhZ2Vjb2xvcj0iI2ZmZmZmZiIKICAgICBib3JkZXJjb2xv + cj0iIzY2NjY2NiIKICAgICBib3JkZXJvcGFjaXR5PSIxIgogICAgIG9iamVjdHRvbGVyYW5j + ZT0iMTAiCiAgICAgZ3JpZHRvbGVyYW5jZT0iMTAiCiAgICAgZ3VpZGV0b2xlcmFuY2U9IjEw + IgogICAgIGlua3NjYXBlOnBhZ2VvcGFjaXR5PSIwIgogICAgIGlua3NjYXBlOnBhZ2VzaGFk + b3c9IjIiCiAgICAgaW5rc2NhcGU6d2luZG93LXdpZHRoPSI2MzYiCiAgICAgaW5rc2NhcGU6 + d2luZG93LWhlaWdodD0iMTA1NCIKICAgICBpZD0ibmFtZWR2aWV3MTI1IgogICAgIHNob3dn + cmlkPSJmYWxzZSIKICAgICBmaXQtbWFyZ2luLXRvcD0iMCIKICAgICBmaXQtbWFyZ2luLWxl + ZnQ9IjAiCiAgICAgZml0LW1hcmdpbi1yaWdodD0iMCIKICAgICBmaXQtbWFyZ2luLWJvdHRv + bT0iMCIKICAgICBpbmtzY2FwZTp6b29tPSIxLjg4OCIKICAgICBpbmtzY2FwZTpjeD0iNDQi + CiAgICAgaW5rc2NhcGU6Y3k9IjMwLjUwMDAwNCIKICAgICBpbmtzY2FwZTp3aW5kb3cteD0i + NjQyIgogICAgIGlua3NjYXBlOndpbmRvdy15PSIyIgogICAgIGlua3NjYXBlOndpbmRvdy1t + YXhpbWl6ZWQ9IjEiCiAgICAgaW5rc2NhcGU6Y3VycmVudC1sYXllcj0ic3ZnMTIzIiAvPgog + IDx0aXRsZQogICAgIGlkPSJ0aXRsZTk3Ij5kYXRhLCBzZXJ2ZXIsIGRhdGFiYXNlLGRiLCBo + b3N0aW5nPC90aXRsZT4KICA8cmVjdAogICAgIHg9IjEwIgogICAgIHk9IjkiCiAgICAgd2lk + dGg9IjQiCiAgICAgaGVpZ2h0PSI2IgogICAgIGlkPSJyZWN0OTkiIC8+CiAgPHJlY3QKICAg + ICB4PSIxOCIKICAgICB5PSI5IgogICAgIHdpZHRoPSI0IgogICAgIGhlaWdodD0iNiIKICAg + ICBpZD0icmVjdDEwMSIgLz4KICA8cmVjdAogICAgIHg9IjI2IgogICAgIHk9IjkiCiAgICAg + d2lkdGg9IjQiCiAgICAgaGVpZ2h0PSI2IgogICAgIGlkPSJyZWN0MTAzIiAvPgogIDxyZWN0 + CiAgICAgeD0iMTAiCiAgICAgeT0iMzYiCiAgICAgd2lkdGg9IjQiCiAgICAgaGVpZ2h0PSI2 + IgogICAgIGlkPSJyZWN0MTA1IiAvPgogIDxyZWN0CiAgICAgeD0iMTgiCiAgICAgeT0iMzYi + CiAgICAgd2lkdGg9IjQiCiAgICAgaGVpZ2h0PSI2IgogICAgIGlkPSJyZWN0MTA3IiAvPgog + IDxyZWN0CiAgICAgeD0iMjYiCiAgICAgeT0iMzYiCiAgICAgd2lkdGg9IjQiCiAgICAgaGVp + Z2h0PSI2IgogICAgIGlkPSJyZWN0MTA5IiAvPgogIDxyZWN0CiAgICAgeD0iMTAiCiAgICAg + eT0iNjMiCiAgICAgd2lkdGg9IjQiCiAgICAgaGVpZ2h0PSI2IgogICAgIGlkPSJyZWN0MTEx + IiAvPgogIDxyZWN0CiAgICAgeD0iMTgiCiAgICAgeT0iNjMiCiAgICAgd2lkdGg9IjQiCiAg + ICAgaGVpZ2h0PSI2IgogICAgIGlkPSJyZWN0MTEzIiAvPgogIDxyZWN0CiAgICAgeD0iMjYi + CiAgICAgeT0iNjMiCiAgICAgd2lkdGg9IjQiCiAgICAgaGVpZ2h0PSI2IgogICAgIGlkPSJy + ZWN0MTE1IiAvPgogIDxwYXRoCiAgICAgZD0iTSA2MS41LDcgSCA2MCBWIDUgQSA1LDUgMCAw + IDAgNTUsMCBIIDUgQSA1LDUgMCAwIDAgMCw1IHYgMTQgYSA1LDUgMCAwIDAgNSw1IGggMSB2 + IDMgSCA1IGEgNSw1IDAgMCAwIC01LDUgdiAxNCBhIDUsNSAwIDAgMCA1LDUgaCAxIHYgMyBI + IDUgYSA1LDUgMCAwIDAgLTUsNSB2IDE0IGEgNSw1IDAgMCAwIDUsNSBoIDEgdiA3IGggNDgg + diAtNyBoIDEgYSA1LDUgMCAwIDAgNSwtNSB2IC0xIGggMS41IEMgNzQuMjYsNzIgODgsNjku + MDkgODgsNjIuNzEgdiAtNDYuODEgMCBDIDg3Ljg0LDkuNzkgNzQuMTksNyA2MS41LDcgWiBN + IDUsMjAgQSAxLDEgMCAwIDEgNCwxOSBWIDUgQSAxLDEgMCAwIDEgNSw0IGggNTAgYSAxLDEg + MCAwIDEgMSwxIFYgNy4xOCBDIDQ1LjE1LDcuODcgMzUuMTMsMTAuNjcgMzUsMTUuOSB2IDAg + NC4xIHogbSAzMCw0IHYgMyBIIDEwIFYgMjQgWiBNIDUsNDcgQSAxLDEgMCAwIDEgNCw0NiBW + IDMyIGEgMSwxIDAgMCAxIDEsLTEgaCAzMCB2IDE2IHogbSAzMCw0IHYgMyBIIDEwIFYgNTEg + WiBNIDUwLDgxIEggMTAgdiAtMyBoIDQwIHogbSA2LC04IGEgMSwxIDAgMCAxIC0xLDEgSCA1 + IEEgMSwxIDAgMCAxIDQsNzMgViA1OSBhIDEsMSAwIDAgMSAxLC0xIGggMzAgdiA0LjcxIGMg + MCw1LjQ3IDEwLjA4LDguMzggMjEsOS4xMSB6IE0gODQsNjIuNzEgQyA4NCw2NC4yOSA3Ni4z + NCw2OCA2MS41LDY4IDQ2LjY2LDY4IDM5LDY0LjI5IDM5LDYyLjcxIFYgNTIuOSBDIDQ0LDU1 + LjY5IDUzLDU3IDYxLjUsNTcgNzAsNTcgNzksNTUuNjkgODQsNTIuOSBaIE0gODQsNDcuNjQg + QyA4NCw0OS4yNSA3Ni4zNCw1MyA2MS41LDUzIDQ2LjY2LDUzIDM5LDQ5LjI1IDM5LDQ3LjY0 + IFYgMzcgYyA1LDIuNzEgMTQsNCAyMi41LDQgQyA3MCw0MSA3OSwzOS43MiA4NCwzNyBaIE0g + ODQsMzEuODkgQyA4NCwzMy4zNyA3Ni4xMiwzNyA2MS41LDM3IDQ2Ljg4LDM3IDM5LDMzLjM3 + IDM5LDMxLjg5IFYgMjEuMDYgQyA0NCwyMy43NCA1MywyNSA2MS41LDI1IDcwLDI1IDc5LDIz + Ljc0IDg0LDIxLjA2IFogTSA2MS41LDIxIEMgNDYsMjEgMzksMTcuMTYgMzksMTYgMzksMTQu + ODQgNDYsMTEgNjEuNSwxMSA3NywxMSA4NCwxNC44NCA4NCwxNiBjIDAsMS4xNiAtNyw1IC0y + Mi41LDUgeiIKICAgICBpZD0icGF0aDExNyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3Vy + dmF0dXJlPSIwIiAvPgo8L3N2Zz4K + + + + + iVBORw0KGgoAAAANSUhEUgAAAFkAAABWCAYAAACkXTp6AAACgUlEQVR4nO2d0Y6EIAwAz8T/ + /+Xd44GNIYIg2E5r5+2yd2sZK0JtvP3z+fwFz7Iff9i2za3x/2TatI79k+xZcCKNT0v0ngPQ + OLg0WqL32geal9cqKMlzKtmD4EQaB0F0NZODdbxOciuzn7qCXUq+O0X0/N2dEzEkuQyiPODs + 5zOxSHF23KtxmMhkws2rRY6vJhsveYXg3itm9lg12WjJvYNedcO6+p7eeMpND1ZybUCaa/iz + Y9fiPIpGSr5zc9Eix9XK8iHJVwOd/TxhSfCRs91lzmZkJh+xIDhT28bjJWuWKEepTRl4yYmr + dag2V6sOE5IzK3eMK+O44lQyfYeVOcb5tPAZJ6YyuQU5MfCSe9ahBFpx7vkXrAwioxnv6NT0 + y+SeLaPEjWZlveLOiXhijPjpYgbKks+1ZApDSzj6vE3lNW1amrymTUuTV7VpaYFr0/J4wl23 + aVHAL+GinixE1JMFcVVP7v1yzTat8vuiniyA9qrkstRJ5pih2iJLeq8evOQjBOGPt86SiHoy + BMqSD9em5RHXmUwhJAsQkgUIyQKYbtOyQmSyAHjJburJ9DYtN/VkC21ar6gn04h6sjDa091w + PZnUpkUob9a4VU+mDaKEIHyqnkwXXGKunmxNcC+UJV+0aQkQbVoCuFnCkQnJAoRkAUy3aVkB + l8llRdByqRP9epwSN6VOErX6NmW6GX0TIlJyoudBArXUaeq9cCNPbAg7xSVvONRo06I/Gku4 + eFcn6TUMmZGEMSG5pDXAp07AzJxvUnIL4gbInWQi0aYlQGSyACFZABNtWqtQ/bdEtQAId+Ze + yLHGdCFASBZg6slI0EdksgAhWYCQLEBTMmkZZJkvMtHRb/cyBPsAAAAASUVORK5CYII= + + + data, server, database,db, hosting + + + + upstreamresolver + + + + + + + client + + + + + PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+ + CjxzdmcKICAgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIgog + ICB4bWxuczpjYz0iaHR0cDovL2NyZWF0aXZlY29tbW9ucy5vcmcvbnMjIgogICB4bWxuczpy + ZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiCiAgIHht + bG5zOnN2Zz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciCiAgIHhtbG5zPSJodHRwOi8v + d3d3LnczLm9yZy8yMDAwL3N2ZyIKICAgeG1sbnM6c29kaXBvZGk9Imh0dHA6Ly9zb2RpcG9k + aS5zb3VyY2Vmb3JnZS5uZXQvRFREL3NvZGlwb2RpLTAuZHRkIgogICB4bWxuczppbmtzY2Fw + ZT0iaHR0cDovL3d3dy5pbmtzY2FwZS5vcmcvbmFtZXNwYWNlcy9pbmtzY2FwZSIKICAgZGF0 + YS1uYW1lPSJMYXllciAxIgogICB2aWV3Qm94PSIwIDAgNzAgNjYiCiAgIHg9IjBweCIKICAg + eT0iMHB4IgogICB2ZXJzaW9uPSIxLjEiCiAgIGlkPSJzdmcxNDEiCiAgIHNvZGlwb2RpOmRv + Y25hbWU9Im5vdW5fdGVybWluYWxfMTY1MzA2MC5zdmciCiAgIHdpZHRoPSI3MCIKICAgaGVp + Z2h0PSI2NiIKICAgaW5rc2NhcGU6dmVyc2lvbj0iMC45Mi40IDVkYTY4OWMzMTMsIDIwMTkt + MDEtMTQiPgogIDxtZXRhZGF0YQogICAgIGlkPSJtZXRhZGF0YTE0NyI+CiAgICA8cmRmOlJE + Rj4KICAgICAgPGNjOldvcmsKICAgICAgICAgcmRmOmFib3V0PSIiPgogICAgICAgIDxkYzpm + b3JtYXQ+aW1hZ2Uvc3ZnK3htbDwvZGM6Zm9ybWF0PgogICAgICAgIDxkYzp0eXBlCiAgICAg + ICAgICAgcmRmOnJlc291cmNlPSJodHRwOi8vcHVybC5vcmcvZGMvZGNtaXR5cGUvU3RpbGxJ + bWFnZSIgLz4KICAgICAgICA8ZGM6dGl0bGU+ZGF0YSwgc2VydmVyLCBkYXRhYmFzZSwgbW9u + aXRvciwgdGVybWluYWw8L2RjOnRpdGxlPgogICAgICA8L2NjOldvcms+CiAgICA8L3JkZjpS + REY+CiAgPC9tZXRhZGF0YT4KICA8ZGVmcwogICAgIGlkPSJkZWZzMTQ1IiAvPgogIDxzb2Rp + cG9kaTpuYW1lZHZpZXcKICAgICBwYWdlY29sb3I9IiNmZmZmZmYiCiAgICAgYm9yZGVyY29s + b3I9IiM2NjY2NjYiCiAgICAgYm9yZGVyb3BhY2l0eT0iMSIKICAgICBvYmplY3R0b2xlcmFu + Y2U9IjEwIgogICAgIGdyaWR0b2xlcmFuY2U9IjEwIgogICAgIGd1aWRldG9sZXJhbmNlPSIx + MCIKICAgICBpbmtzY2FwZTpwYWdlb3BhY2l0eT0iMCIKICAgICBpbmtzY2FwZTpwYWdlc2hh + ZG93PSIyIgogICAgIGlua3NjYXBlOndpbmRvdy13aWR0aD0iOTU2IgogICAgIGlua3NjYXBl + OndpbmRvdy1oZWlnaHQ9IjEwNTQiCiAgICAgaWQ9Im5hbWVkdmlldzE0MyIKICAgICBzaG93 + Z3JpZD0iZmFsc2UiCiAgICAgZml0LW1hcmdpbi10b3A9IjAiCiAgICAgZml0LW1hcmdpbi1s + ZWZ0PSIwIgogICAgIGZpdC1tYXJnaW4tcmlnaHQ9IjAiCiAgICAgZml0LW1hcmdpbi1ib3R0 + b209IjAiCiAgICAgaW5rc2NhcGU6em9vbT0iNy41NTIiCiAgICAgaW5rc2NhcGU6Y3g9IjUy + LjIwNTQ4OCIKICAgICBpbmtzY2FwZTpjeT0iMzMuODcwMTc2IgogICAgIGlua3NjYXBlOndp + bmRvdy14PSI5NjIiCiAgICAgaW5rc2NhcGU6d2luZG93LXk9IjIiCiAgICAgaW5rc2NhcGU6 + d2luZG93LW1heGltaXplZD0iMSIKICAgICBpbmtzY2FwZTpjdXJyZW50LWxheWVyPSJzdmcx + NDEiIC8+CiAgPHRpdGxlCiAgICAgaWQ9InRpdGxlMTMxIj5kYXRhLCBzZXJ2ZXIsIGRhdGFi + YXNlLCBtb25pdG9yLCB0ZXJtaW5hbDwvdGl0bGU+CiAgPHBhdGgKICAgICBkPSJNIDgsMzkg + SCA2MiBWIDggSCA4IFogTSAxMiwxMiBIIDU4IFYgMzUgSCAxMiBaIgogICAgIGlkPSJwYXRo + MTMzIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiIC8+CiAgPHBhdGgK + ICAgICBkPSJtIDAsMCB2IDQ3IGggMjggdiA3LjA4IGMgLTMuNDQwOTI3LDAuNDk2NjUzIC01 + Ljk5NTkyNSwzLjQ0MzQxOCAtNiw2LjkyIHYgNSBIIDQ4IFYgNjEgQyA0Ny45OTU5LDU3LjUy + MzQxOCA0NS40NDA5MjcsNTQuNTc2NjUzIDQyLDU0LjA4IFYgNDcgSCA3MCBWIDAgTSA0NCw2 + MSB2IDEgSCAyNiB2IC0xIGMgMCwtMS42NTY4NTQgMS4zNDMxNDYsLTMgMywtMyBoIDEyIGMg + MS42NTY4NTQsMCAzLDEuMzQzMTQ2IDMsMyB6IE0gMzIsNTQgdiAtNyBoIDYgdiA3IHogTSA3 + MCw1LjU5IFYgMCBNIDQsNDMgViA0IGggNjIgdiAzOSB6IgogICAgIGlkPSJwYXRoMTM1Igog + ICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc29kaXBvZGk6bm9k + ZXR5cGVzPSJjY2NjY2NjY2NjY2NzY2Nzc3NzY2NjY2NjY2NjY2NjIiAvPgo8L3N2Zz4K + + + + + iVBORw0KGgoAAAANSUhEUgAAAEcAAABDCAYAAADOIRgJAAABJklEQVR4nO3ZyRKCMBAAUVPF + //8yGk8WhGadJGD3wZO4PMcQimEcx5eVG/JDSkmhSZ+hSUPrD9Fz4kAznDxOLT5I60pLi5MD + iQOJA63iPPU0v2VtdXIgcSBxoN04d90HHVk7nRxIHEgcSBxIHEgcSBxIHEgcSBxIHEgcSBxI + HEgcSBxIHEgcSBxIHEgcSBxoN85Tbw+XcnIgcSBxoFWcu97+vSInBxIHEgea4fzTPmYtJwcS + BxIH+uLU3MtM17Sl9976vMicHEgcSBxIHEgcSByoOU7PlytVcc5A5GNr73Wq4Fw1Hb+vUwMq + HCfqb1NjkkJxSjBHv1CLtanqmnPml87HToGipycMJ+LCsQQUWfNTec9Vw+l5P7OUkwOJA4kD + heE84TbyGynKUBIg/xD7AAAAAElFTkSuQmCC + + + data, server, database, monitor, terminal + + + + + + + + + + + + + + recursion + unencrypted DNS + + + + + (optional) + forwarding + unencrypted DNS + DNS-over-TLS + + + + + + + + + recursion + + + + + + client asking questions + unencrypted DNSDNS-over-TLSDNS-over-HTTPS + HTTP management API + + + + + + + + + + + ... as server + + + + + ... as client + + + + + + \ No newline at end of file diff --git a/doc/server_terminology.svg b/doc/server_terminology.svg new file mode 100644 index 000000000..49cc6390a --- /dev/null +++ b/doc/server_terminology.svg @@ -0,0 +1,1105 @@ + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + data, server, database, router, hardware + + + + + + + + + + + + + + + + + + + + + + + + + authoritativeserver + + + + + + + + + + + + + + + + + + + + Knot Resolver + + + + + + + data, server, database,db, hosting + + + + + + + + + + + + + + + + + + + upstreamresolvers + + + + + + + + + clients + + + + + data, server, database, monitor, terminal + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + recursionunencrypted DNS + + + + + + + (optional)forwardingunencrypted DNSDNS-over-TLS + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + recursion + + + + + + + + clients asking questionsunencrypted DNSDNS-over-TLSDNS-over-HTTPSHTTP management API + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ... as server + + + + + + + ... as client + + + + + + + + + \ No newline at end of file diff --git a/modules/http/README.rst b/modules/http/README.rst index fa7124a31..514d77a3a 100644 --- a/modules/http/README.rst +++ b/modules/http/README.rst @@ -1,14 +1,14 @@ .. _mod-http: -HTTP/2 services -=============== +HTTP services +============= -This module does the heavy lifting to provide an HTTP/2 enabled +This module does the heavy lifting to provide an HTTP and HTTP/2 enabled server which provides few built-in services and also allows other modules to export restful APIs and websocket streams. One example is statistics module that can stream live metrics on the website, -or publish metrics on request for Prometheus scraper. +or publish metrics on request for Prometheus scraper, and also :ref:`mod-http-doh`. By default this module provides two kinds of endpoints, and unlimited number of "used-defined kinds" can be added in configuration. diff --git a/modules/policy/README.rst b/modules/policy/README.rst index 037b89222..64ec560cf 100644 --- a/modules/policy/README.rst +++ b/modules/policy/README.rst @@ -233,6 +233,8 @@ Policy examples policy.del(rule.id) +.. _dns-graft: + Replacing part of the DNS tree ------------------------------