Tomas Krizek [Fri, 16 Feb 2018 09:20:32 +0000 (10:20 +0100)]
systemd: compatibility drop-in for kresd@.service
Unify the drop-in files for manual activation and systemd compatibility,
since it is not recommended to use manual activation if socket
activation is supported.
Also add --forks=1 to the command, otherwise the service attempts to
start in interactive mode.
Tomas Krizek [Fri, 9 Feb 2018 11:03:07 +0000 (12:03 +0100)]
systemd: remove kresd.service meta-service
The kresd.service meta-service could be confusing for users and provides
no extra functionality. The system-kresd.slice can be used to restart or
stop all running instances.
Distributions shipping with /etc/init.d/kresd should symlink the
kresd.service to /dev/null to prevent systemd-sysv-generator from
creating this service.
systemd: clarify dropping Sockets= for non-socket-activated services
If the adminstrator of a non-socket-activated kresd installation
doesn't clear Sockets=, then they will also inherit sockets from the
process manager, which doesn't make sense. Help them avoid that
situation.
Administrators using bash tab completion with the full completion
utilities enabled will be able to tab-complete instantiated services.
shipping symlinks gets confused during tarball generation, and during
package installation, so it's safer and cleaner to just ship the
regular unit files.
Please see discussion at:
https://github.com/systemd/systemd/issues/8096
The new approach is:
* non-templated kresd.socket and kresd-tls.socket, for the
public-facing listening ports. They know to invoke kresd@1.service
if they're socket-activated.
* kresd@.service *is* templated, to allow the admin to add more
concurrent runners with:
systemctl enable kresd@2.service
* kresd-control@.socket is still templated, since each daemon has a
separately-addressable different control port.
* non-templated kresd.service is a dummy meta-service. it is in the
same slice as kresd@.service, and all the kresd@.service instances
are PartOf= it, so you should be able to stop and restart all
services together. On systems like debian that ship
/etc/init.d/kres, this also avoids having systemd-sysv-generator
create a kresd.service based on the initscript.
* no templated instances are explicitly instantiated during initial
ship, but kresd@1.service should be socket-activated cleanly
Gbp-Pq: Name 0010-More-systemd-service-management-cleanup.patch
Petr Špaček [Thu, 15 Feb 2018 16:25:56 +0000 (17:25 +0100)]
Require libknot 2.6.4 to avoid mysterious problems with DNS-over-TLS.
Respdiff on kresd under load showed that DNS-over-TLS has higher ratio
of SERVFAILs than other transports. For some reason the problem
disappeared after upgrading from libknot 2.6.3 to 2.6.4, and appeared
again after downgrade.
Vladimír Čunát [Wed, 14 Feb 2018 14:24:03 +0000 (15:24 +0100)]
cache: fix broken refresh of insecure records
... that were about to expire. The effect was that predict module
started the request, but cache still didn't overwrite the record if it
wasn't secure.
Vladimír Čunát [Mon, 5 Feb 2018 15:13:55 +0000 (16:13 +0100)]
update README.md
- no need to have gitter twice
- update information about modules (one cache, no alternative backends)
- add EPEL 7
- add mailing-list
- link to stable docs instead of latest master
Vladimír Čunát [Fri, 2 Feb 2018 10:25:52 +0000 (11:25 +0100)]
cache: assume NSEC if ". NS" is missing in cache
This happens e.g. after cache.clear(), and currently one can stay
long-term without that record in cache. That was effectively disabling
aggressive answers from the root zone.
This needs disabling a buggy part of Deckard test.
doc: kresd.systemd belongs in section 7 of the manual
"man man" says that the sections are:
1 Executable programs or shell commands
2 System calls (functions provided by the kernel)
3 Library calls (functions within program libraries)
4 Special files (usually found in /dev)
5 File formats and conventions eg /etc/passwd
6 Games
7 Miscellaneous (including macro packages and conventions), e.g.
man(7), groff(7)
8 System administration commands (usually only for root)
9 Kernel routines [Non standard]
Since there is no command named kresd.system it does not belong in
section 8.
Section 7 includes conventions and useful patterns like gitcli(7),
which seems more similar to the documentation that is supplied in
kresd.systemd.
Tomas Krizek [Mon, 5 Feb 2018 09:10:35 +0000 (10:10 +0100)]
systemd defaults: turn off verbose logging
Verbose logging should be used for debugging purposes, as it generates a
lot of output. It shouldn't be turned on by default for normal mode of
operation.
drop world-executable permissions on /run/knot-resolver
It's not clear why anyone other that the superuser needs to be able to
descend into /run/knot-resolver, so we should drop this extra
permission.
it appears to have been added e0f33604fac3bdd6f105ed0c50a4a08f562c72f8, but the log message for that
commit doesn't explain why the permission needs to be loosened.
The main situation that calls for executable but not readable
directories is when a directory contains something at a known location
that everyone must be able to reach, but also contains some sensitive
file with a name that itself is unguessable (i.e. high entropy
string). That doesn't appear to be the case here.
By principle of least privilege, we should leave it locked down unless
there's a clear justification for opening it up.
Tomas Krizek [Tue, 30 Jan 2018 17:29:34 +0000 (18:29 +0100)]
ci: increase respdiff mismatch tolerance to 3%
Since we've added the `timeout` metric to respdiff, it uncovered
an issue when running in Docker, where a large amount of queries
(~2% / resolver) end with a timeout.
Until the issue is investigated and fixed, temporarily bump the CI's
tolerance for the test to pass to 3%.
Tomas Krizek [Thu, 25 Jan 2018 17:17:09 +0000 (18:17 +0100)]
systemd: enable multiple processes with socket activation
In order to be able to spawn multiple processes with socket activation,
systemd template (see systemd.unit(5)) is used. This allows the user to
create any amount of instances by simply providing a unique name for
each of them. The most sensible instance identifiers are natural
numbers, but any convention could be used.
The default recommended service name becomes kresd@1.service, replacing
the older kresd.service. Sockets are renamed in a similar way. Users are
able to take advantage of bash expansion to spawn/control multiple
processes, e.g. "systemctl start kresd@{1..16}.service"
The socket-activated service can now be launched directly with
"systemctl start kresd@1.service", which will request the associated
sockets without the need for any extra priviledges or capabilities.
Stopping the kresd service now also stops the associated sockets.
Stopping any individual socket is an isolated opration now (stopping
kresd@1.socket no longer stop kresd-tls@1.socket and
kresd-control@1.socket).
Users and packagers are also encouraged to use drop-in files for extra
configuration or modifications to ensure compatibility with their
distribution.
projects / thirdparty / knot-resolver.git / log
