Vladimír Čunát [Mon, 3 Aug 2020 17:32:23 +0000 (19:32 +0200)]
daemon/lua: get rid of __engine symbol in lua
In particular this gets rid of last light user data inside kresd.
It was still causing problems on some systems, for example Debian Sid.
The error was the same: "bad light userdata pointer" from luajit,
but note that the problem can still be triggered by lua libraries,
e.g. cqueues.
Petr Špaček [Fri, 31 Jul 2020 15:52:50 +0000 (17:52 +0200)]
kr_pkt_text: OPT RR does not need to be at the end of Additional section
Previous code incorrectly assumed that OPT was last RR in section
and this lead to truncating output.
https://tools.ietf.org/html/rfc6891#section-6.1.1 clearly states that
OPT can be anywhere in Additional section.
Printer relies on checks in libknot packet parser: check_rr_constraints()
prevents packets with more OPT RRs or OPT outside of additional section
from being parsed so the printer cannot see them.
Vladimír Čunát [Mon, 13 Jul 2020 14:10:22 +0000 (16:10 +0200)]
validate: don't chase non-sensical signers
When signer name isn't a prefix of owner, the signature does not make
sense and it's no use trying to use that signer name in any way.
We generally don't force queries on every level of the path,
so this signer confusion could "introduce SERVFAILs" if we
skip over a transition to insecure.
Vladimír Čunát [Tue, 14 Jul 2020 15:13:35 +0000 (17:13 +0200)]
ci travis: tweak the timeouts a bit
In the past week the Travis runs have been consistently taking much more
time than before, usually around 20 minutes, leading to our CI timing out.
https://travis-ci.com/github/CZ-NIC/knot-resolver/builds
Vladimír Čunát [Tue, 14 Apr 2020 10:06:44 +0000 (12:06 +0200)]
doc-comments: fix some of the complaints from doxygen
There's still frequent issue that documenting some parameters would be
mainly noise but doxygen will warn when not doing it.
WARN_IF_UNDOCUMENTED apparently doesn't cover this and
WARN_IF_DOC_ERROR would probably remove even some useful warnings.
Vladimír Čunát [Fri, 10 Jul 2020 12:35:36 +0000 (14:35 +0200)]
config tests: better test net.tls_sticket_secret()
The trick there is that it isn't supported (by us) on gnutls < 3.6.3.
I checked that the test fails before the fix in parent commit
and that it succeeds (is skipped) with gnutls 3.6.2.
Tomas Krizek [Fri, 19 Jun 2020 09:47:33 +0000 (11:47 +0200)]
daemon: don't drop capabilities when running as root
When the effective user is root, no capabilities are dropped. This
change has no effect when running as non-privileged user or when
switching to non-privileged user via user() in config.
Dropping capabilities as a root user resulted in the following
unexpected behaviour:
1. When using trust anchor update, r/w access to root keys is neeeded.
These are typically owned by knot-resolver user. When kresd is
executed as root and capabilities are dropped, this file was no longer
writable, because it is owned by knot-resolver, not root.
2. It is impossible to recreate/resize cache due to the same permission
issue as above.
If you want to drop capabilities when starting kresd as a root user,
you can switch the user with the `user()` command. This changes the
effective user ID and drops any capabilities as well.
Vladimír Čunát [Tue, 30 Jun 2020 12:37:12 +0000 (14:37 +0200)]
policy.rpz: fix $ORIGIN-related handling
- use parser-detected $ORIGIN instead of looking at SOA owner
- skip records outside $ORIGIN (and warn) instead of nesting them
- simplify a bit, and tweak warnings
Vladimír Čunát [Tue, 30 Jun 2020 08:51:08 +0000 (10:51 +0200)]
policy.rpz: don't warn on NS and SOA records
Also utilize table indexing.
This was a "regression" from extending RPZ support in 5.1.0.
NS and SOA are even mandatory, as RPZ is supposed to be a valid zone:
https://tools.ietf.org/html/draft-ietf-dnsop-dns-rpz-00#section-2
Vladimír Čunát [Tue, 9 Jun 2020 06:09:32 +0000 (08:09 +0200)]
gc: fix integer overflow when computing how much to GC
On 32-bit systems the insufficient GC could commonly happen:
https://lists.nic.cz/pipermail/knot-resolver-users/2020/000265.html
The meaning of -f parameter got slightly changed, so that the buggy
computation could be greatly simplified. GC seems to make sense when
most of cache space is used, in which case the difference is small.
Vladimír Čunát [Wed, 20 May 2020 12:30:15 +0000 (14:30 +0200)]
modules/hints: NODATA answers also for non-address queries
Apparently the original implementation in 14de9110 didn't think of this.
Noticed by Fantomas:
https://forum.turris.cz/t/kresd-returns-nxdomain-for-local-mx-records/12991
Petr Špaček [Thu, 21 May 2020 06:40:07 +0000 (08:40 +0200)]
use 3rd party submodule mirrors from our Gitlab
lua-aho-corasick and lua-tapered submodules now use our mirrors
to avoid problems when upstream repositories are deleted
(which happened to lua-tapered on or around 2020-05-21).
projects / thirdparty / knot-resolver.git / log
