Tomas Krizek [Thu, 1 Oct 2020 12:09:47 +0000 (14:09 +0200)]
daemon/http: make sure uv_handle is always initialized
It is later closed in endpoint_close(), which would fail with assert if
not initialized (e.g. when compiled without nghttp2 support and
attempting to use doh2 kind).
Tomas Krizek [Fri, 25 Sep 2020 08:58:08 +0000 (10:58 +0200)]
daemon/io: use MANDATORY_APLN only with new gnutls
This is only needed to fail early during the handshake, if protocol
negotiation doesn't succeed. With older GnuTLS, if there's a protocol
mismatch, the data won't be understood and the connection will close
later on.
Mandatory ALPN doesn't affect clients that don't use the ALPN extension.
Tomas Krizek [Thu, 20 Aug 2020 13:03:05 +0000 (15:03 +0200)]
daemon/http: write correct packet buffer
task->pktbuf isn't the same as the passed in pkt in qr_task_send().
pkt must be used and it must also stay valid as long as the task
lives. This seems to be the case for request answers, as they aren't
freed until there are no more tasks that reference them.
Tomas Krizek [Tue, 11 Aug 2020 10:34:20 +0000 (12:34 +0200)]
daemon/http: additional checks for HEADERS processing
1. We musn't process path for POST method (check there are no DATA
frames).
2. A GET request may not interefere with an ongoing unfinished data from
other stream, since we only use a single buffer for the entire conn.
Tomas Krizek [Mon, 12 Oct 2020 12:45:28 +0000 (14:45 +0200)]
distro/rpm: don't use sysusers
Only Fedora 32+ and opensuse have sysusers support, but handling centos
would require keeping the current commands. For simplicity's sake, let's
not use sysusers yet for rpm.
Tomas Krizek [Mon, 12 Oct 2020 12:10:20 +0000 (14:10 +0200)]
meson: fix sysusers/tmpfiles installation
Target name must be unique in meson, but the installed files share
the same name. To get around this, use a temporary target name and
rename it when installing the file to its proper location.
Petr Špaček [Fri, 9 Oct 2020 09:30:56 +0000 (11:30 +0200)]
lib/cache: do not unlink cache lock file
This change serves two purposes:
- removes corner case where lock is deleted and created by another
instance
- prevents incredibly rare problem where filesystem inodes run out
Beware that lock file is still not created on start-up.
It gets created only when emergency cache clear is executed and stays there.
We might consider creating the file at start-up as well
but that's topic for another MR.
Petr Špaček [Fri, 9 Oct 2020 09:29:23 +0000 (11:29 +0200)]
lib/cache: fix cache lock based on fcntl()
Fixes bug introduced in b65e8977566be831c0308390b70fc2151f40e4e7.
open() was creating a file which could not be open again because of
insufficient permissions. This somehow worked because lockfile_release()
unlinks the file, but it broke terribly if lockfile_release() was not
called because of crash or something like that.
Tomas Krizek [Mon, 5 Oct 2020 14:18:24 +0000 (16:18 +0200)]
distro/arch: remove upgrade script
Arch is a fast moving rolling release and users expect to upgrade
their configs. The migration period over 6 months is certainly
sufficient - remove this hard to read convoluted code.
Vladimír Čunát [Tue, 6 Oct 2020 07:15:43 +0000 (09:15 +0200)]
validator: avoid using RRSIG from a different packet
Restrict tried RRSIGs by qry_uid equality.
I see no use case against and it could be confusing.
(Also rewrite the conditions around to positive form.)
An assertion in cache noticed an NSEC with _SECURE rank but no RRSIG
(in practice). It was a side-effect of still not keeping RRSIGs with
their RRs in some places. It wasn't a security problem, as it doesn't
really matter where the signatures came from. Theoretically it
might've lead to incorrect caching (missing usable RRSIGs), as cache
was restricting qry_uid to match, but that hasn't been noticed
in practice.
Vladimír Čunát [Wed, 7 Oct 2020 07:51:16 +0000 (09:51 +0200)]
contrib/cleanup: be more correct
It's mainly about the fact that FD can be zero (though it's not common).
Our current usage is just in tests and seems fine.
I don't think that other negative FDs are possible, but I'm lazy to find
"proof" in POSIX and using other negative values than -1 doesn't make
sense to me anyway (might be an assert, I guess).
Tomas Krizek [Fri, 2 Oct 2020 11:04:01 +0000 (13:04 +0200)]
modules/http: answer to /dns-query endpoint as well
When using DoH, it seems /dns-query is a more common convetion for
an endpoint name. Let's use it in addition to /doh, since it doesn't
hurt anything and makes kresd more alike the other DoH implementations
out there. It'll also play more nicely with kdig, which uses /dns-query
as default as well.
Tomas Krizek [Fri, 2 Oct 2020 08:23:40 +0000 (10:23 +0200)]
clang: silence useless warning in lib/layer.h
This silences the following warning, which frequently appears in Travis
CI.
./lib/layer.h:51:21: warning: result of comparison of constant 32 with
expression of type 'enum kr_layer_state' is always true
[-Wtautological-constant-out-of-range-compare]
return s >= 0 && s < (1 << 5);
~ ^ ~~~~~~~~
Vladimír Čunát [Wed, 16 Sep 2020 11:10:44 +0000 (13:10 +0200)]
daemon/io_tty_process_input: remove a special case
After changes in this MR, sending an empty newline evaluates in lua
as nil, and that seems fine. Let's drop this piece of code;
it was broken now anyway (incorrect `io_mode_text` part).
projects / thirdparty / knot-resolver.git / log
