Vladimír Čunát [Wed, 15 Nov 2017 08:48:29 +0000 (09:48 +0100)]
utils kr_strcatdup: deal with overflowing size_t
It's very unlikely to happen - sum of string lengths overflowing -
even on a 32-bit platform, and the input seems not controllable by
adversaries, but let's fix it anyway.
Vladimír Čunát [Mon, 13 Nov 2017 09:41:25 +0000 (10:41 +0100)]
tests_cache: give it more space
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878976
In general, platforms with page size other than 4k might better compile
with -DCPU_PAGE_SIZE=nnnnn but real impact should only be this test and
better alignment in the mempool allocator.
Vladimír Čunát [Mon, 13 Nov 2017 09:24:53 +0000 (10:24 +0100)]
daemon: block SIGPIPE
We can ignore the signal, as the affected libuv calls report error
by returning EPIPE anyway.
Fixes https://gitlab.labs.nic.cz/knot/knot-resolver/issues/271
This allows the socket to be bound before the network interface comes
up, which is preferable to having a race between the interface coming
up and the socket being bound.
systemd: drop RefuseManualStart=true, disable kresd.service by default
I introduced RefuseManualStart=true last year when writing the initial
systemd unit file for kresd. I did this because i didn't want to
start running the daemon if no one was going to talk to it.
I'm no longer convinced that this directive has a good justification.
While i think that there is no need to activate the service without
socket activation, i think preventing manual invocation is actively
harmful (admins will reflexively do "systemctl restart kresd" just
like they do "systemctl restart apache2" and it's jarring to have it
rejected).
A distributor who wants to (by default) delay kresd startup until it
is accessed can ship the preset file included here, but leave the
*.socket units enabled by default.
Vladimír Čunát [Thu, 21 Sep 2017 11:44:58 +0000 (13:44 +0200)]
validate: wildcard expansion -> adjust to_wire
We pushed all authority to the wire, but that was unnecessary,
and in particular it clashed with not validating NS in authority when
forwarding (new change). Let's only apply this to NSEC* RRs.
Vladimír Čunát [Thu, 21 Sep 2017 07:32:39 +0000 (09:32 +0200)]
hints: fix linkage on darwin
It's not very nice that this symbol used in hints.so is defined in
sbin/kresd, but it touches the daemon structures and thus doesn't
really belong into libkres.
Vladimír Čunát [Tue, 19 Sep 2017 13:43:03 +0000 (15:43 +0200)]
FORWARD: don't validate NS in authority section
Fixes https://gitlab.labs.nic.cz/knot/knot-resolver/issues/248
Some (exotic?) resolvers add extra NS records but doesn't provide
signatures for them even though we ask with +dnssec +cd.
That lead to validation errors. Current example server: 198.101.242.72
Let's not try to validate them when FORWARDing, as we won't most likely
need those records anyway (contrary to iteration mode).
Vladimír Čunát [Tue, 12 Sep 2017 11:45:30 +0000 (13:45 +0200)]
gnutls logging improvements
- move it to utils.c, so it's sensitive to later changes in verbosity
- don't mark the lines with [tls], as they may come through libdnssec
- use stdout like other verbose messages, instead of stderr (real errors)
Vladimír Čunát [Thu, 7 Sep 2017 09:04:06 +0000 (11:04 +0200)]
worker: disable assertion that we can't fix immediately
Production kresd should compile with -DNDEBUG, so it wouldn't be
affected by this, but it was annoying for debugging other problems.
See https://gitlab.labs.nic.cz/knot/knot-resolver/issues/245
Vladimír Čunát [Mon, 4 Sep 2017 12:22:50 +0000 (14:22 +0200)]
cache.clear() on LMDB: simplify .cachelock
The locking was done incorrectly - the copied text from man open(2)
suggested creating a *unique* file and linking that one to the lockfile.
Anyway, I don't think we need to support cache on NFSv3 on old kernels ;-)
Vladimír Čunát [Fri, 1 Sep 2017 13:33:30 +0000 (15:33 +0200)]
cache: rework reusing transactions (LMDB)
Previously a read transaction could be held open by each fork
indefinitely. That was done for better speed, but it had a downside
of keeping old pages alive and potentially reading only old data,
until some writes were attempted by that fork.
Now kr_cache_ provides explicit API for suitable points where to break
transactions, reusing the _sync command. On LMDB side the read-only
transaction is only reset and later renewed, supposedly giving better
performance than aborting (see LMDB docs on reset+renew).
Performance: preliminary testing with two forks, resperf on comcast
query-set shows no noticeable difference in peak QPS.
Štěpán Kotek [Wed, 30 Aug 2017 09:06:11 +0000 (11:06 +0200)]
Check for memory leaks during unittest CI using valgrind
New ci task has been added that checks for possible memory leaks when running unittests. Messages from valgrind are displayed only when leak is detected.
refs #227
Vladimír Čunát [Thu, 24 Aug 2017 11:59:01 +0000 (13:59 +0200)]
main ipc_activity: misc improvements
Stop IPC after getting an error. One point is the situation when one
of the forks ends for some reason, which lead to problems.
Another point is pipes getting out of sync.
Smaller changes:
- don't free the handle while it's still half-in-use
- don't fully panic here because of ENOMEM, just stop IPC
projects / thirdparty / knot-resolver.git / log
