Vladimír Čunát [Tue, 14 Jul 2020 15:13:35 +0000 (17:13 +0200)]
ci travis: tweak the timeouts a bit
In the past week the Travis runs have been consistently taking much more
time than before, usually around 20 minutes, leading to our CI timing out.
https://travis-ci.com/github/CZ-NIC/knot-resolver/builds
Vladimír Čunát [Tue, 14 Apr 2020 10:06:44 +0000 (12:06 +0200)]
doc-comments: fix some of the complaints from doxygen
There's still frequent issue that documenting some parameters would be
mainly noise but doxygen will warn when not doing it.
WARN_IF_UNDOCUMENTED apparently doesn't cover this and
WARN_IF_DOC_ERROR would probably remove even some useful warnings.
Vladimír Čunát [Fri, 10 Jul 2020 12:35:36 +0000 (14:35 +0200)]
config tests: better test net.tls_sticket_secret()
The trick there is that it isn't supported (by us) on gnutls < 3.6.3.
I checked that the test fails before the fix in parent commit
and that it succeeds (is skipped) with gnutls 3.6.2.
Tomas Krizek [Fri, 19 Jun 2020 09:47:33 +0000 (11:47 +0200)]
daemon: don't drop capabilities when running as root
When the effective user is root, no capabilities are dropped. This
change has no effect when running as non-privileged user or when
switching to non-privileged user via user() in config.
Dropping capabilities as a root user resulted in the following
unexpected behaviour:
1. When using trust anchor update, r/w access to root keys is neeeded.
These are typically owned by knot-resolver user. When kresd is
executed as root and capabilities are dropped, this file was no longer
writable, because it is owned by knot-resolver, not root.
2. It is impossible to recreate/resize cache due to the same permission
issue as above.
If you want to drop capabilities when starting kresd as a root user,
you can switch the user with the `user()` command. This changes the
effective user ID and drops any capabilities as well.
Vladimír Čunát [Tue, 30 Jun 2020 12:37:12 +0000 (14:37 +0200)]
policy.rpz: fix $ORIGIN-related handling
- use parser-detected $ORIGIN instead of looking at SOA owner
- skip records outside $ORIGIN (and warn) instead of nesting them
- simplify a bit, and tweak warnings
Vladimír Čunát [Tue, 30 Jun 2020 08:51:08 +0000 (10:51 +0200)]
policy.rpz: don't warn on NS and SOA records
Also utilize table indexing.
This was a "regression" from extending RPZ support in 5.1.0.
NS and SOA are even mandatory, as RPZ is supposed to be a valid zone:
https://tools.ietf.org/html/draft-ietf-dnsop-dns-rpz-00#section-2
Vladimír Čunát [Tue, 9 Jun 2020 06:09:32 +0000 (08:09 +0200)]
gc: fix integer overflow when computing how much to GC
On 32-bit systems the insufficient GC could commonly happen:
https://lists.nic.cz/pipermail/knot-resolver-users/2020/000265.html
The meaning of -f parameter got slightly changed, so that the buggy
computation could be greatly simplified. GC seems to make sense when
most of cache space is used, in which case the difference is small.
Vladimír Čunát [Wed, 20 May 2020 12:30:15 +0000 (14:30 +0200)]
modules/hints: NODATA answers also for non-address queries
Apparently the original implementation in 14de9110 didn't think of this.
Noticed by Fantomas:
https://forum.turris.cz/t/kresd-returns-nxdomain-for-local-mx-records/12991
Petr Špaček [Thu, 21 May 2020 06:40:07 +0000 (08:40 +0200)]
use 3rd party submodule mirrors from our Gitlab
lua-aho-corasick and lua-tapered submodules now use our mirrors
to avoid problems when upstream repositories are deleted
(which happened to lua-tapered on or around 2020-05-21).
Petr Špaček [Tue, 5 May 2020 15:01:38 +0000 (17:01 +0200)]
NXNSAttack mitigation tests
New Deckard repo without conflicting iter_refused.rpl test
does not contain libswrap and libfaketime anymore
so I had to remove hacks in build system for these.
Vladimír Čunát [Tue, 5 May 2020 09:32:02 +0000 (11:32 +0200)]
mitigate NXNSAttack protocol vulnerability for wildcards in victim zone
Attacker might generate fake NS records pointing to victim's DNS zone.
If the zone contains wildcard the attacker might force us into packet
exchange with a (lame) DNS server on that IP address.
We now limit number of consecuctive failures and kill whole request if
limit is exceeded.
Vladimír Čunát [Tue, 24 Mar 2020 08:07:54 +0000 (09:07 +0100)]
mitigate NXNSAttack protocol vulnerability for unresolvable NS names
CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
We now limit number of failed NS name resolution attempts for each
request. This does not prevent attacker from spoofing delegations
but it puts upper bound on amplification factor.
Vladimír Čunát [Wed, 13 May 2020 09:08:47 +0000 (11:08 +0200)]
scripts/gen-cdefs.sh: adapt to changes in new gdb
Now it works again with the latest gdb-9.1.
As a side effect, some simplification was possible, so that some
typedefs are newly defined at once with the underlying type.
projects / thirdparty / knot-resolver.git / log
