]> git.ipfire.org Git - thirdparty/knot-resolver.git/log
thirdparty/knot-resolver.git
5 years agodaemon/lua/trust_anchors: Use module 'http.request' instead 'ssl.https'
Lukáš Ježek [Thu, 5 Dec 2019 14:42:34 +0000 (15:42 +0100)] 
daemon/lua/trust_anchors: Use module 'http.request' instead 'ssl.https'

5 years agomodules/prefill: support large zone file
Lukáš Ježek [Thu, 5 Dec 2019 09:35:16 +0000 (10:35 +0100)] 
modules/prefill: support large zone file

5 years agomodules/prefill: Add the functionality to specify a custom CA file
Lukáš Ježek [Tue, 3 Dec 2019 13:34:00 +0000 (14:34 +0100)] 
modules/prefill: Add the functionality to specify a custom CA file

5 years agomodules/prefill: Remove unused ltn12
Lukáš Ježek [Fri, 22 Nov 2019 15:18:51 +0000 (16:18 +0100)] 
modules/prefill: Remove unused ltn12

5 years agomodules/prefill: Fetch root zone file asynchronously
Lukáš Ježek [Fri, 22 Nov 2019 14:33:04 +0000 (15:33 +0100)] 
modules/prefill: Fetch root zone file asynchronously

5 years agomodules/prefill: Use module 'http.request' instead 'ssl.https'
Lukáš Ježek [Fri, 22 Nov 2019 14:27:04 +0000 (15:27 +0100)] 
modules/prefill: Use module 'http.request' instead 'ssl.https'

5 years agoMerge branch 'multiple-config-files' into 'master' obs-knot-dns-deve-jq0xxt/deployments/465 obs-knot-resolver-es11k1/deployments/466
Petr Špaček [Thu, 19 Dec 2019 09:06:29 +0000 (10:06 +0100)] 
Merge branch 'multiple-config-files' into 'master'

daemon/main: support multiple config files

See merge request knot/knot-resolver!909

5 years agoclarify errors from luaL_dofile while loading configs
Petr Špaček [Thu, 19 Dec 2019 08:51:44 +0000 (09:51 +0100)] 
clarify errors from luaL_dofile while loading configs

5 years agodaemon/main: remove "-" from config array
Tomas Krizek [Fri, 13 Dec 2019 15:40:35 +0000 (16:40 +0100)] 
daemon/main: remove "-" from config array

5 years agodaemon/main: log config path and workdir
Tomas Krizek [Wed, 11 Dec 2019 15:05:12 +0000 (16:05 +0100)] 
daemon/main: log config path and workdir

5 years agolib/utils: create get_workdir() utility function
Tomas Krizek [Wed, 11 Dec 2019 14:24:31 +0000 (15:24 +0100)] 
lib/utils: create get_workdir() utility function

5 years agodaemon/main: use engine_loadconf() for default config
Tomas Krizek [Wed, 11 Dec 2019 12:09:35 +0000 (13:09 +0100)] 
daemon/main: use engine_loadconf() for default config

5 years agodaemon/main: remove useless l_dosandboxfile macro
Tomas Krizek [Tue, 10 Dec 2019 18:22:16 +0000 (19:22 +0100)] 
daemon/main: remove useless l_dosandboxfile macro

The exact same function is implemented as luaL_dofile() in Lua 5.1,
there seems to be no reason to use our project-specific macro for it.

https://www.lua.org/manual/5.1/manual.html#luaL_dofile

5 years agodaemon/main: support multiple config files
Tomas Krizek [Tue, 10 Dec 2019 17:58:56 +0000 (18:58 +0100)] 
daemon/main: support multiple config files

5 years agoMerge branch '520-prefill-remove-depedency-on-lua-filesystem-lfs' into 'master' obs-knot-dns-deve-jq0xxt/deployments/463 obs-knot-resolver-es11k1/deployments/464
Petr Špaček [Wed, 18 Dec 2019 15:20:42 +0000 (16:20 +0100)] 
Merge branch '520-prefill-remove-depedency-on-lua-filesystem-lfs' into 'master'

prefill: remove depedency on lua-filesystem (lfs)

Closes #520

See merge request knot/knot-resolver!912

5 years agoprefill: remove depedency on lua-filesystem (lfs)
Lukáš Ježek [Wed, 18 Dec 2019 14:13:56 +0000 (15:13 +0100)] 
prefill: remove depedency on lua-filesystem (lfs)

5 years agoMerge branch 'ci-obs-buildall' into 'master' obs-knot-dns-deve-jq0xxt/deployments/448 obs-knot-dns-deve-jq0xxt/deployments/450 obs-knot-dns-deve-jq0xxt/deployments/452 obs-knot-dns-deve-jq0xxt/deployments/454 obs-knot-dns-deve-jq0xxt/deployments/457 obs-knot-dns-deve-jq0xxt/deployments/461 obs-knot-resolver-es11k1/deployments/449 obs-knot-resolver-es11k1/deployments/451 obs-knot-resolver-es11k1/deployments/453 obs-knot-resolver-es11k1/deployments/455 obs-knot-resolver-es11k1/deployments/458 obs-knot-resolver-es11k1/deployments/462
Tomas Krizek [Thu, 12 Dec 2019 16:27:46 +0000 (17:27 +0100)] 
Merge branch 'ci-obs-buildall' into 'master'

ci: allow failure of obs:build:all

See merge request knot/knot-resolver!910

5 years agoci: allow failure of obs:build:all
Tomas Krizek [Thu, 12 Dec 2019 16:20:40 +0000 (17:20 +0100)] 
ci: allow failure of obs:build:all

This job tends to fail very often, but very frequently due to issues
with OBS itself - outside of our control. The output of the job can
still be useful to check manually, e.g. before releases.

5 years agoci: document confusing allow_failure: false
Tomas Krizek [Thu, 12 Dec 2019 16:19:29 +0000 (17:19 +0100)] 
ci: document confusing allow_failure: false

This value seems to be the default, but it is important to have
it set explicitly, otherwise when: manual actions could be skipped

https://docs.gitlab.com/ee/ci/yaml/#whenmanual

5 years agoMerge branch 'lua_gc' into 'master'
Petr Špaček [Thu, 12 Dec 2019 14:27:37 +0000 (15:27 +0100)] 
Merge branch 'lua_gc' into 'master'

lua: stop trying to tweak lua's GC

See merge request knot/knot-resolver!201

5 years agolua: stop trying to tweak lua's GC
Tomas Krizek [Wed, 9 Oct 2019 12:29:28 +0000 (14:29 +0200)] 
lua: stop trying to tweak lua's GC

cherry-picked from f0ca89ac, original author Vlada Cunat

TL;DR: I believe all lua_gc() calls stemmed from misunderstanding lua
documentation, and the current settings seem potentially dangerous.

First, let me rely on lua 5.1 docs, as luajit 2 is documented to have
done only minor changes in the GC.
http://www.lua.org/manual/5.1/manual.html#lua_gc
http://wiki.luajit.org/New-Garbage-Collector#rationale

Commit 5a709411 claims to have increased the speed of GC to 400 % of
speed of allocation, but LUA_GCSETSTEPMUL is the parameter that
controls that, and that one was lowered to 99 % and later in
0ee2d1d7 even to 50 %.  Documentation explicitly says that setting
the value under 100 % may cause problems.

The default values seem perfectly sane to me and currently I can't see
any particular reason to change them.  It's 200 % relative GC speed,
and waiting for allocated size to double before starting another cycle.

I assume the resulting possibility of GC being too slow caused the need
to explicitly force a non-incremental GC cycle once in a while, but
that seems not useful anymore and not good for latency.

5 years agoMerge branch 'reuseport-freebsd' into 'master' obs-knot-dns-deve-jq0xxt/deployments/445 obs-knot-resolver-8xyvhu/deployments/447 obs-knot-resolver-es11k1/deployments/446
Petr Špaček [Wed, 11 Dec 2019 10:02:59 +0000 (11:02 +0100)] 
Merge branch 'reuseport-freebsd' into 'master'

daemon/io: use SO_REUSEPORT_LB if available (FreeBSD 12.0+)

See merge request knot/knot-resolver!907

5 years agodaemon/io: use SO_REUSEPORT_LB if available (FreeBSD 12.0+)
Vladimír Čunát [Tue, 10 Dec 2019 16:08:30 +0000 (17:08 +0100)] 
daemon/io: use SO_REUSEPORT_LB if available (FreeBSD 12.0+)

and don't use SO_REUSEPORT on non-Linux.  (Free)BSD has a different
meaning for it, which only brings confusion - only the last instance
would be getting packets.

5 years agoMerge branch 'tty-logging' into 'master'
Petr Špaček [Wed, 11 Dec 2019 09:48:22 +0000 (10:48 +0100)] 
Merge branch 'tty-logging' into 'master'

daemon/ tty commands: don't log unless --verbose

Closes #528

See merge request knot/knot-resolver!908

5 years agodaemon/ tty commands: don't log unless --verbose
Vladimír Čunát [Tue, 10 Dec 2019 17:04:15 +0000 (18:04 +0100)] 
daemon/ tty commands: don't log unless --verbose

It's minimalistic: no change if in interactive or --verbose mode.

5 years agoMerge branch 'systemd-instance' into 'master' obs-knot-dns-deve-jq0xxt/deployments/440 obs-knot-dns-deve-jq0xxt/deployments/442 obs-knot-resolver-es11k1/deployments/441 obs-knot-resolver-es11k1/deployments/443
Petr Špaček [Mon, 9 Dec 2019 15:44:02 +0000 (16:44 +0100)] 
Merge branch 'systemd-instance' into 'master'

systemd: add env variable SYSTEMD_INSTANCE

See merge request knot/knot-resolver!906

5 years agosystemd: add env variable SYSTEMD_INSTANCE
Tomas Krizek [Fri, 6 Dec 2019 15:20:12 +0000 (16:20 +0100)] 
systemd: add env variable SYSTEMD_INSTANCE

5 years agoMerge branch 'ci-update' into 'master' obs-knot-dns-deve-jq0xxt/deployments/433 obs-knot-dns-deve-jq0xxt/deployments/435 obs-knot-dns-deve-jq0xxt/deployments/437 obs-knot-resolver-es11k1/deployments/434 obs-knot-resolver-es11k1/deployments/436 obs-knot-resolver-es11k1/deployments/438
Tomas Krizek [Fri, 6 Dec 2019 15:00:50 +0000 (16:00 +0100)] 
Merge branch 'ci-update' into 'master'

ci: updates

See merge request knot/knot-resolver!905

5 years agoci: update respdiff jobs
Tomas Krizek [Fri, 6 Dec 2019 12:34:39 +0000 (13:34 +0100)] 
ci: update respdiff jobs

5 years agoci: allow odvr release in tag pipelines
Tomas Krizek [Fri, 6 Dec 2019 11:48:55 +0000 (12:48 +0100)] 
ci: allow odvr release in tag pipelines

5 years agoMerge branch 'release-4-3-0' into 'master' obs-knot-dns-deve-jq0xxt/deployments/428 obs-knot-dns-deve-jq0xxt/deployments/430 obs-knot-resolver-8xyvhu/deployments/427 obs-knot-resolver-es11k1/deployments/429 obs-knot-resolver-es11k1/deployments/431 obs-knot-resolver-kv62s6/deployments/426 v4.3.0
Tomas Krizek [Wed, 4 Dec 2019 14:28:25 +0000 (15:28 +0100)] 
Merge branch 'release-4-3-0' into 'master'

update NEWS, bump to 4.3.0

See merge request knot/knot-resolver!904

5 years agoupdate NEWS, bump to 4.3.0
Tomas Krizek [Wed, 4 Dec 2019 13:19:47 +0000 (14:19 +0100)] 
update NEWS, bump to 4.3.0

5 years agoMerge branch '518-confidential-issue' into 'master'
Tomas Krizek [Wed, 4 Dec 2019 13:59:21 +0000 (14:59 +0100)] 
Merge branch '518-confidential-issue' into 'master'

Resolve "RRset merge operation is too slow for big RRsets"

Closes #518

See merge request knot/knot-resolver!903

5 years agoNEWS: update obs-knot-resolver-bs4hbr/deployments/425
Tomas Krizek [Wed, 4 Dec 2019 13:41:16 +0000 (14:41 +0100)] 
NEWS: update

5 years agodoc: clarify upgrade instructions for modules
Petr Špaček [Wed, 4 Dec 2019 08:39:45 +0000 (09:39 +0100)] 
doc: clarify upgrade instructions for modules

5 years agolib/utils kr_ranked_rrarray_add(): clarify merging RRs
Vladimír Čunát [Thu, 21 Nov 2019 14:28:47 +0000 (15:28 +0100)] 
lib/utils kr_ranked_rrarray_add(): clarify merging RRs

5 years agoci: skip MacOS tests in security repo
Petr Špaček [Wed, 20 Nov 2019 15:05:08 +0000 (16:05 +0100)] 
ci: skip MacOS tests in security repo

5 years agoiterate: better efficiency on huge RRsets
Vladimír Čunát [Wed, 13 Nov 2019 13:07:46 +0000 (14:07 +0100)] 
iterate: better efficiency on huge RRsets

- written relatively defensively - act OK even if the API
  isn't used in an ideal way
- CI lint:scan-build: bump the error count;
  It's only another instance of the mis-detected array_push().
- the removed stale note in modules/meson.build isn't really related

5 years agoMerge branch 'cname-limit' into 'master'
Tomas Krizek [Wed, 4 Dec 2019 13:25:41 +0000 (14:25 +0100)] 
Merge branch 'cname-limit' into 'master'

iterate: fix limit on CNAME chain length

See merge request knot/knot-resolver!899

5 years agoci: skip Travis build for security repo
Petr Špaček [Wed, 4 Dec 2019 07:05:42 +0000 (08:05 +0100)] 
ci: skip Travis build for security repo

5 years agoiterate: clarify error messages about CNAME chains
Petr Špaček [Tue, 3 Dec 2019 14:09:47 +0000 (15:09 +0100)] 
iterate: clarify error messages about CNAME chains

5 years agoiterate: tests for CNAME chain restrictions
Vladimír Čunát [Mon, 2 Dec 2019 15:00:40 +0000 (16:00 +0100)] 
iterate: tests for CNAME chain restrictions

5 years agoiterate: reduce CNAME length limit: 40 -> 13
Vladimír Čunát [Fri, 29 Nov 2019 16:03:41 +0000 (17:03 +0100)] 
iterate: reduce CNAME length limit: 40 -> 13

Unbound has limit 10, and practically useful numbers are way lower.

5 years agoiterate: fix limit on CNAME chain length
Vladimír Čunát [Fri, 29 Nov 2019 15:15:10 +0000 (16:15 +0100)] 
iterate: fix limit on CNAME chain length

The accounting was just broken and overly messy anyway.

5 years agoMerge !896: daemon: support dropping capabilities obs-knot-resolver-bs4hbr/deployments/424
Vladimír Čunát [Wed, 4 Dec 2019 09:57:18 +0000 (10:57 +0100)] 
Merge !896: daemon: support dropping capabilities

5 years agoNEWS: mention dropping capabilities
Tomas Krizek [Wed, 27 Nov 2019 14:08:11 +0000 (15:08 +0100)] 
NEWS: mention dropping capabilities

5 years agodistro/*: add libcap-ng dependency
Tomas Krizek [Wed, 27 Nov 2019 14:03:51 +0000 (15:03 +0100)] 
distro/*: add libcap-ng dependency

5 years agosystemd/nosocket: use capabilities
Tomas Krizek [Wed, 27 Nov 2019 11:55:06 +0000 (12:55 +0100)] 
systemd/nosocket: use capabilities

5 years agodaemon/main: add libcap-ng support to drop capabilities
Tomas Krizek [Tue, 26 Nov 2019 11:37:45 +0000 (12:37 +0100)] 
daemon/main: add libcap-ng support to drop capabilities

5 years agoMerge branch 'perf-lua-ffi_cleaned' into 'master' obs-knot-dns-deve-jq0xxt/deployments/420 obs-knot-dns-deve-jq0xxt/deployments/422 obs-knot-resolver-es11k1/deployments/421 obs-knot-resolver-es11k1/deployments/423
Petr Špaček [Mon, 2 Dec 2019 12:55:10 +0000 (13:55 +0100)] 
Merge branch 'perf-lua-ffi_cleaned' into 'master'

performance: lua-related improvements

See merge request knot/knot-resolver!874

5 years agomodules/ta_signal_query: optimize
Vladimír Čunát [Wed, 14 Aug 2019 15:16:58 +0000 (17:16 +0200)] 
modules/ta_signal_query: optimize

Basically the same as the parent commit (just much simpler).

5 years agomodules/ta_sentinel: optimize
Vladimír Čunát [Wed, 14 Aug 2019 14:53:23 +0000 (16:53 +0200)] 
modules/ta_sentinel: optimize

When all lua modules get unloaded, this change makes the module's
contribution to QPS unmeasurable (for me), saving a few percent.
The point is to almost always return very cheaply, in particular without
creating any lua GC object (like FFI for kr_query).

Note: some checks didn't make much sense, so I improved those as well.

5 years agomodules/policy: optimize special domain processing
Vladimír Čunát [Mon, 12 Aug 2019 14:08:37 +0000 (16:08 +0200)] 
modules/policy: optimize special domain processing

Running the full special-domain checks is relatively expensive.

5 years agomodules/policy: optimize postrules
Vladimír Čunát [Wed, 31 Jul 2019 13:55:43 +0000 (15:55 +0200)] 
modules/policy: optimize postrules

I've never seen anyone use postrules.

5 years agolua FFI: avoid frequent usage of lua_pushpointer()
Vladimír Čunát [Wed, 7 Aug 2019 07:36:13 +0000 (09:36 +0200)] 
lua FFI: avoid frequent usage of lua_pushpointer()

The new way of transitioning to layer callbacks - done because of
portability (mainly to aarch64) - is a bit expensive.  This is a simple
way of recovering that cost.  Merge 603a24f regressed speed a bit.

5 years agoMerge branch 'packaging-fixes' into 'master' obs-knot-dns-deve-jq0xxt/deployments/412 obs-knot-dns-deve-jq0xxt/deployments/414 obs-knot-dns-deve-jq0xxt/deployments/416 obs-knot-dns-deve-jq0xxt/deployments/418 obs-knot-resolver-es11k1/deployments/413 obs-knot-resolver-es11k1/deployments/415 obs-knot-resolver-es11k1/deployments/417 obs-knot-resolver-es11k1/deployments/419
Petr Špaček [Thu, 28 Nov 2019 09:06:17 +0000 (10:06 +0100)] 
Merge branch 'packaging-fixes' into 'master'

Packaging fixes

See merge request knot/knot-resolver!895

5 years agosystemd: add proper User/Group
Tomas Krizek [Wed, 27 Nov 2019 11:46:06 +0000 (12:46 +0100)] 
systemd: add proper User/Group

The Group= settings was ommited and default group of User= was
implicitly used. Now the group set at build time is respected.

GC didn't respect the user/group set at build time at all.

5 years agodistro/*: http module requires the same knot-resolver version
Tomas Krizek [Tue, 26 Nov 2019 11:58:02 +0000 (12:58 +0100)] 
distro/*: http module requires the same knot-resolver version

Previously, it was possible to update just "knot-resolver" even
when the "knot-resolver-module-http" package was installed, or the
other way around.

5 years agoMerge branch 'ci-timeout' into 'master' obs-knot-dns-deve-jq0xxt/deployments/410 obs-knot-resolver-es11k1/deployments/411
Tomas Krizek [Wed, 27 Nov 2019 14:57:22 +0000 (15:57 +0100)] 
Merge branch 'ci-timeout' into 'master'

ci: increase test timeout

See merge request knot/knot-resolver!897

5 years agoci: increase test timeout
Tomas Krizek [Wed, 27 Nov 2019 14:43:54 +0000 (15:43 +0100)] 
ci: increase test timeout

During heavy load, test:valgrind tends to fail quite often with timeout.
This should improve the situation.

5 years agoMerge branch 'packaging-docs' into 'master' obs-knot-dns-deve-jq0xxt/deployments/386 obs-knot-dns-deve-jq0xxt/deployments/388 obs-knot-dns-deve-jq0xxt/deployments/392 obs-knot-dns-deve-jq0xxt/deployments/394 obs-knot-dns-deve-jq0xxt/deployments/396 obs-knot-dns-deve-jq0xxt/deployments/399 obs-knot-dns-deve-jq0xxt/deployments/404 obs-knot-resolver-bs4hbr/deployments/385 obs-knot-resolver-es11k1/deployments/387 obs-knot-resolver-es11k1/deployments/389 obs-knot-resolver-es11k1/deployments/393 obs-knot-resolver-es11k1/deployments/395 obs-knot-resolver-es11k1/deployments/397 obs-knot-resolver-es11k1/deployments/400 obs-knot-resolver-es11k1/deployments/405
Petr Špaček [Wed, 20 Nov 2019 12:42:51 +0000 (12:42 +0000)] 
Merge branch 'packaging-docs' into 'master'

tests: packaging

See merge request knot/knot-resolver!892

5 years agotests: packaging
Lukáš Ježek [Mon, 18 Nov 2019 11:16:42 +0000 (12:16 +0100)] 
tests: packaging

Directory with subdirectory "packaging" is called "component".

List all components: python3 tests/packaging-doc.py --list
Run all tests/compoments: python3 tests/packaging-doc.py
Run specific test/component: python3 tests/packaging-doc.py --test <component>

The file structure for 1 component:
daemon - dependencies for 1 component "kresd daemon" (default component, must always be there)
scripts/distros - dependencies for 1 component for specific distro (must always be there)
scripts/dockerfile_gen.py - test Dockerfile generator, see below
tests/packaging.py - script to generate and build all combinations
                     of Docker files for all components
[component] - directory of component/test, see below
      (e.g. "client/packaging/", "modules/http/packaging/" etc.)

The file structure of each component:
[component]
<distro>/<version> - package names
- builddeps - list of build depedencies
- rundeps - list of runtime depedencies
- pre-build.sh - script called before build phase
- post-build.sh - script called after build phase
- pre-run.sh - script called before run phase
- post-run.sh - script called after run phase
- install.sh and build.sh script called during build phase
test.config or test.sh - kresd config test or shell script
note: content of "scripts/distroos" is same as "<distro>/<version>" of component.

There are "build" and "run" phases. "build" phase precedes "run" phase.
All script are called in this order:
1. pre-<phase>.sh
2. install packages specifed in the file "<phase>deps"
3a. for "build" phase: run build.sh and install.sh
3b. for "run" phase: run 'kresd -c [component]/test.config' or config.sh
4. remove packages specified in the file "<phase>deps"
5. post-<phase>.sh

Each step above is combines base components with a component under test.
E.g. component "scripts/distros" always precedes component "daemon/packaging"
and it precedes the tested component e.g. "modules/http".

In long term we might migrate this to py.test or some other well known
framework.

5 years agoMerge branch 'doh_decrypt' into 'master'
Tomas Krizek [Wed, 20 Nov 2019 12:19:11 +0000 (12:19 +0000)] 
Merge branch 'doh_decrypt' into 'master'

DoH debugging: auxiliary library for OpenSSL key logging

See merge request knot/knot-resolver!886

5 years agodistro/rpm: fix opensuse build
Tomas Krizek [Wed, 20 Nov 2019 10:45:42 +0000 (11:45 +0100)] 
distro/rpm: fix opensuse build

opensslkey_debug is never built for opensuse, because
openssl is not a dependency, thus there's no need to remove
the non-existent file.

5 years agodog debug: ignore -Wpedantic to unblock CI
Vladimír Čunát [Wed, 23 Oct 2019 13:18:51 +0000 (15:18 +0200)] 
dog debug: ignore -Wpedantic to unblock CI

It would be cumbersome to explicitly cast all those void*
to correct function types.

5 years agodoh debug: do not build debug_opensslkeylog if openssl is missing
Petr Špaček [Wed, 23 Oct 2019 11:34:08 +0000 (13:34 +0200)] 
doh debug: do not build debug_opensslkeylog if openssl is missing

5 years agoci: add openssl devel package for http module debug library
Petr Špaček [Tue, 22 Oct 2019 14:08:08 +0000 (16:08 +0200)] 
ci: add openssl devel package for http module debug library

5 years agodoh debug: add depedency on openssl to meson build
Petr Špaček [Tue, 22 Oct 2019 13:04:38 +0000 (15:04 +0200)] 
doh debug: add depedency on openssl to meson build

5 years agodoh debug: package debug_opensslkeylog.so
Petr Špaček [Tue, 22 Oct 2019 12:57:03 +0000 (14:57 +0200)] 
doh debug: package debug_opensslkeylog.so

5 years agodoh debug: log timestamp of each OPENSSLKEYLOGFILE opening
Petr Špaček [Tue, 22 Oct 2019 11:30:47 +0000 (13:30 +0200)] 
doh debug: log timestamp of each OPENSSLKEYLOGFILE opening

Wireshark 3.0.5 is able to deal with # comments in middle of log file.

5 years agodoh debug: create OPENSSLKEYLOGFILE accessible only by process owner
Petr Špaček [Tue, 22 Oct 2019 11:26:39 +0000 (13:26 +0200)] 
doh debug: create OPENSSLKEYLOGFILE accessible only by process owner

5 years agodoh debug: log timestamp of OPENSSLKEYLOGFILE creation
Petr Špaček [Tue, 22 Oct 2019 11:26:04 +0000 (13:26 +0200)] 
doh debug: log timestamp of OPENSSLKEYLOGFILE creation

5 years agodoh debug: build and install OpenSSL SSLKEYLOGFILE helper library
Petr Špaček [Tue, 22 Oct 2019 10:56:08 +0000 (12:56 +0200)] 
doh debug: build and install OpenSSL SSLKEYLOGFILE helper library

It is not used in any way by default, enabling it requires manual
LD_PRELOAD= trickery as described in the source file.

5 years agodoh debug: avoid warning about _GNU_SOURCE redefinition
Petr Špaček [Tue, 22 Oct 2019 10:40:49 +0000 (12:40 +0200)] 
doh debug: avoid warning about _GNU_SOURCE redefinition

5 years agodoh debug: use more descriptive name debug_opensslkeylog
Petr Špaček [Tue, 22 Oct 2019 10:07:22 +0000 (12:07 +0200)] 
doh debug: use more descriptive name debug_opensslkeylog

5 years agodoh debug: rename SSLKEYLOG environment variable to OPENSSLKEYLOG
Petr Špaček [Tue, 22 Oct 2019 10:03:30 +0000 (12:03 +0200)] 
doh debug: rename SSLKEYLOG environment variable to OPENSSLKEYLOG

This avoids conflict between GnuTLS's built-in SSLKEYLOG and our hack
for OpenSSL. This would be important for instances which run
DNS-over-TLS using built-in GnuTLS
and at the same time DNS-over-HTTPS using lua-http (based on OpenSSL).

5 years agodoh debug: add helper library with OpenSSL SSLKEYLOGFILE= support
Petr Špaček [Tue, 22 Oct 2019 09:58:30 +0000 (11:58 +0200)] 
doh debug: add helper library with OpenSSL SSLKEYLOGFILE= support

Original file is GNU GPLv3+ licensed and was copied from
https://git.lekensteyn.nl/peter/wireshark-notes/plain/src/sslkeylog.c
blob: 370668907056f769e2d09bf7bd2e768249049f8f
commit: de25eb75c8d90282ba90396218210c4601603347
Copyright (C) 2014 Peter Wu <peter@lekensteyn.nl>

5 years agoMerge branch 'zone-forward-ng' into 'master'
Petr Špaček [Wed, 20 Nov 2019 12:00:16 +0000 (12:00 +0000)] 
Merge branch 'zone-forward-ng' into 'master'

cache entry_list: fix crash on insertion via lua

See merge request knot/knot-resolver!889

5 years agotests: skip Deckard integration tests if sendmmsg is enabled
Petr Špaček [Wed, 20 Nov 2019 11:46:20 +0000 (12:46 +0100)] 
tests: skip Deckard integration tests if sendmmsg is enabled

All Deckard tests would fail anyway so we now print a warning and skip
Deckard tests.

5 years agocache: integration test for explicit NS insertion
Petr Špaček [Wed, 20 Nov 2019 11:38:38 +0000 (12:38 +0100)] 
cache: integration test for explicit NS insertion

5 years agocache entry_list: fix crash on insertion via lua
Vladimír Čunát [Thu, 24 Oct 2019 08:35:31 +0000 (10:35 +0200)] 
cache entry_list: fix crash on insertion via lua

When inserting NS or xNAME, we could get into this place with
qry == NULL, and we'd crash when trying to use the memory pool.
Let's simply use the stack instead.

5 years agoMerge branch 'rpm-config-permissions' into 'master'
Petr Špaček [Wed, 20 Nov 2019 09:53:03 +0000 (09:53 +0000)] 
Merge branch 'rpm-config-permissions' into 'master'

distro/rpm: move root.keys to proper location

Closes #513

See merge request knot/knot-resolver!888

5 years agodistro/rpm: don't mark certificate as config file
Tomas Krizek [Fri, 8 Nov 2019 12:03:08 +0000 (13:03 +0100)] 
distro/rpm: don't mark certificate as config file

5 years agodistro/rpm: move root.keys to proper location
Tomas Krizek [Thu, 24 Oct 2019 14:40:35 +0000 (16:40 +0200)] 
distro/rpm: move root.keys to proper location

Fixes #513

5 years agomeson: add option install_root_keys
Tomas Krizek [Fri, 8 Nov 2019 11:23:45 +0000 (12:23 +0100)] 
meson: add option install_root_keys

5 years agomeson: enable root keys installation to keyfile_default location
Tomas Krizek [Thu, 24 Oct 2019 14:40:20 +0000 (16:40 +0200)] 
meson: enable root keys installation to keyfile_default location

5 years agoMerge branch 'sendmmsg_use-after-free' into 'master'
Petr Špaček [Wed, 20 Nov 2019 09:40:30 +0000 (09:40 +0000)] 
Merge branch 'sendmmsg_use-after-free' into 'master'

sendmmsg: fix a use-after-free case

See merge request knot/knot-resolver!891

5 years agoNEWS for sendmmsg (preliminary text)
Vladimír Čunát [Fri, 15 Nov 2019 14:40:07 +0000 (15:40 +0100)] 
NEWS for sendmmsg (preliminary text)

5 years agodaemon/worker: add assertion
Vladimír Čunát [Fri, 15 Nov 2019 12:25:27 +0000 (13:25 +0100)] 
daemon/worker: add assertion

It might detect some use-after-free cases even without ASAN.

5 years agodaemon/udp_queue: add a ref-unref pair
Vladimír Čunát [Fri, 15 Nov 2019 12:22:11 +0000 (13:22 +0100)] 
daemon/udp_queue: add a ref-unref pair

I must admit I don't really understand why we had a rare case
of use-after-free in the sendmmsg call, but this change should avoid
that without affecting anything else.

5 years agoMerge branch 'ci-backtraces' into 'master' obs-knot-dns-deve-jq0xxt/deployments/381 obs-knot-resolver-es11k1/deployments/382
Tomas Krizek [Tue, 19 Nov 2019 12:00:36 +0000 (12:00 +0000)] 
Merge branch 'ci-backtraces' into 'master'

ci: print backtraces from respdiff/resperf

See merge request knot/knot-resolver!893

5 years agoci: print docker output on respdiff/resperf failure
Tomas Krizek [Tue, 19 Nov 2019 11:44:17 +0000 (12:44 +0100)] 
ci: print docker output on respdiff/resperf failure

5 years agoci: use new security repo in gitlabci
Tomas Krizek [Tue, 19 Nov 2019 11:42:03 +0000 (12:42 +0100)] 
ci: use new security repo in gitlabci

5 years agoMerge branch 'ci-boxes' into 'master' obs-knot-dns-deve-jq0xxt/deployments/363 obs-knot-dns-deve-jq0xxt/deployments/366 obs-knot-dns-deve-jq0xxt/deployments/368 obs-knot-dns-deve-jq0xxt/deployments/370 obs-knot-dns-deve-jq0xxt/deployments/372 obs-knot-dns-deve-jq0xxt/deployments/374 obs-knot-dns-deve-jq0xxt/deployments/376 obs-knot-dns-deve-jq0xxt/deployments/378 obs-knot-resolver-bs4hbr/deployments/365 obs-knot-resolver-es11k1/deployments/364 obs-knot-resolver-es11k1/deployments/367 obs-knot-resolver-es11k1/deployments/369 obs-knot-resolver-es11k1/deployments/371 obs-knot-resolver-es11k1/deployments/373 obs-knot-resolver-es11k1/deployments/375 obs-knot-resolver-es11k1/deployments/377 obs-knot-resolver-es11k1/deployments/379
Tomas Krizek [Mon, 11 Nov 2019 09:23:06 +0000 (09:23 +0000)] 
Merge branch 'ci-boxes' into 'master'

ci: update distrotests

See merge request knot/knot-resolver!890

5 years agoci: use new distros for distrotests
Tomas Krizek [Fri, 8 Nov 2019 14:53:50 +0000 (15:53 +0100)] 
ci: use new distros for distrotests

5 years agodistro/tests: add ubuntu1910
Tomas Krizek [Fri, 8 Nov 2019 14:47:57 +0000 (15:47 +0100)] 
distro/tests: add ubuntu1910

5 years agodistro/tests: add Fedora 31
Tomas Krizek [Fri, 8 Nov 2019 14:47:38 +0000 (15:47 +0100)] 
distro/tests: add Fedora 31

5 years agodistro/tests: use generic/opensuse15 box
Tomas Krizek [Fri, 8 Nov 2019 14:46:35 +0000 (15:46 +0100)] 
distro/tests: use generic/opensuse15 box

5 years agodistro/tests: make ansible debug output readable
Tomas Krizek [Fri, 8 Nov 2019 14:45:52 +0000 (15:45 +0100)] 
distro/tests: make ansible debug output readable

5 years agomeson: remove upper version limit for knot
Tomas Krizek [Fri, 8 Nov 2019 12:18:43 +0000 (13:18 +0100)] 
meson: remove upper version limit for knot

The advanced version comparison was isn't implemeted in meson 0.46,
which is used for CentOS 7 and it caused build issue with development
version of Knot.