Vladimír Čunát [Mon, 11 Apr 2022 10:14:50 +0000 (12:14 +0200)]
daemon/zimport: close transaction after importing batch
I'm really sorry about this. It's my regression in 5.5.0 (!1225)
Practical consequence was that the RW transaction was held open
until that instance did something with cache (and thus closed),
so any other instance would be frozen in the meantime if doing
anything non-read-only with cache (e.g. startup).
https://lists.nic.cz/hyperkitty/list/knot-resolver-users@lists.nic.cz/thread/6DOXXOA6ACEUBVYPUY3T2MLGIHWOMV6M/
Vladimír Čunát [Thu, 7 Apr 2022 08:05:34 +0000 (10:05 +0200)]
ci: fix ambiguous tag-sets
In a few places the tag-set specification for jobs could match
either amd64 or arm64 runners. That non-determinism is bad,
especially when passing platform-specific artifacts around.
This is just a stop-gap measure. Later we'll need to rethink our CI
in terms of the two platforms.
I didn't touch tag-sets with `condor`, as that will probably always be
just a single machine (which coordinates scheduling on others).
Vladimír Čunát [Mon, 14 Mar 2022 14:27:54 +0000 (15:27 +0100)]
predict docs: be more explicit about recommended use
We're still run into people who thought that the example config
is a suitable default. Example where it caused practical issues:
https://lists.nic.cz/hyperkitty/list/knot-resolver-users@lists.nic.cz/thread/WQDJJ3LLEIZ5U3VVSCITW6DZPICW4L7U/
CI rp:fwd-tls6.udp-asan now repeatedly shows use-after-free.
That could be a serious issue, and this commit's feature
seems less important than the risk. Let's revert until the issue
gets deeper investigation.
Vladimír Čunát [Mon, 7 Mar 2022 17:04:05 +0000 (18:04 +0100)]
lib/selection: fix interaction of timeouts with reboots
We use "monotonic" time-stamps for the dead_since field;
that breaks on system reboots, in which case we reset the stats.
(if the server was categorized as dead)
If the server times out afterwards, we'd fail the condition
`cur_state.consecutive_timeouts == old_state.consecutive_timeouts`
so its stats would not update. Therefore we'd get stuck forever
in a state where the unusable server has high priority (no_rtt_info).
This commit changes a bit more than was necessary to fix this,
including precision of the stats (in some cases).
Vladimír Čunát [Fri, 4 Mar 2022 11:55:55 +0000 (12:55 +0100)]
lib/selection: improve randomness of ties
The approach was dubious: random shuffle, qsort() and choose the first.
The main functional problem was that qsort() isn't a stable sort,
so the effect of pre-shuffling is not reliable, even though I don't have
any evidence of this causing issues in practice.
The new code should also be a bit more efficient in terms of CPU and
consumed randomness, but that probably won't be noticeable.
The arrays passed into select_transport() are now const (no sorting),
which could make the code easier to "understand".
Vladimír Čunát [Tue, 8 Feb 2022 11:46:55 +0000 (12:46 +0100)]
modules/dnstap: don't do anything on loading the module
Usually in configuration the module is loaded in a separate command
from passing configuration to it. For dnstap this loading would
immediately lead to opening the default socket path, even if the
configuration actually specifies (a different) path later.
Users can still force using the default by passing an empty table:
`dnstap.config({})` or `modules = { dnstap = {}}`
(though I doubt the utility of the default /tmp/dnstap.sock anyway)
Vladimír Čunát [Thu, 20 Jan 2022 18:43:40 +0000 (19:43 +0100)]
lib/dnssec: conditionally ignore SHA1 DS, as SHOULD by RFC4509
We're a bit late with this ad-hoc rule; I think it was most useful
when SHA256 support in DS algorithms wasn't wide-spread yet.
(Note that DNSKEY algos have standardized no similar rule.)
Usage of SHA1 as DS algorithm is highly discouraged, but even at this
point it does *not* seem unsafe, in the sense of anyone publishing an
attack that would come anywhere close to breaking *this* usage of SHA1.
Tomas Krizek [Tue, 21 Dec 2021 15:38:45 +0000 (16:38 +0100)]
pytests: migrate to LXC runner
Due to missing support on some of the regular runners, let's migrate
these tests to our special LXC runners. This should hopefully make the
results more reliable and stable.
The downside is that we have to keep an additional image (and recipe)
for LXC, since it' slightly different. However, it's probably worth it,
since we'll likely migrate some other tests there in the future (for
better stability).
Vladimír Čunát [Mon, 10 Jan 2022 18:23:26 +0000 (19:23 +0100)]
doc: fix links to our mailing lists
Their implementation was changed.
Fortunately I was able to find the message in Google's cache
and thus discover easily which one it is in the new archive.
projects / thirdparty / knot-resolver.git / log
