Marek Vavruša [Sat, 12 May 2018 04:06:21 +0000 (21:06 -0700)]
use LRU for packet cache instead of persistent cache
The primary motivation is that packet cache is shared with records,
but it isn't useful for improving performance of popular domain lookups.
Negative answers (with DNSSEC) are typically around 1kB, so it doesn't
take many queries to force a full cache flush, including useful record data.
This changes the packet cache to use a fixed-size LRU, which is more resilient
to random prefix attacks, but it isn't persistent or shared between processes.
Vladimír Čunát [Fri, 13 Apr 2018 16:09:31 +0000 (18:09 +0200)]
lua bindings: complete knot_pkt_t
We don't need the end, but I prefer to get rid of the exception,
as we now require libknot > 2.6 anyway and it only implies adding
a few more binding lines.
Vladimír Čunát [Tue, 24 Apr 2018 14:14:29 +0000 (16:14 +0200)]
policy docs: replace incorrect example
The example didn't work and I don't immediately see how to quickly fix
it, so let's have another more complex example instead (fished from an
older forum post of mine).
Marek Vavruša [Mon, 9 Apr 2018 07:01:53 +0000 (00:01 -0700)]
iterate: allow lame negative answers in PERMISSIVE mode
Some nameservers are hopelessly broken (ns1-ord.salesforce.com),
and will return lame negative answers which will flag the nameserver
as bad, so it wouldn't be picked for valid queries.
Marek Vavruša [Fri, 6 Apr 2018 05:43:57 +0000 (22:43 -0700)]
check per-query flags instead of global options, getter for NS name
Checking query flags instead of global context option allows setting
overrides on individual queries. The effect is the same as query flags
start by copying request flags which start by copying context options.
Marek Vavruša [Fri, 6 Apr 2018 05:48:51 +0000 (22:48 -0700)]
add bindings for the checkout layer
This one was missing from the current bindings. The checkout layer
runs when the worker attempts to send a DNS query to given upstream
when the address is already determined. The layer can add EDNS options
or update outbound query, or block particular addresses / protocol.
Marek Vavruša [Fri, 16 Mar 2018 02:27:59 +0000 (19:27 -0700)]
lib/utils: fixed memory corruption in kr_pkt_recycle and kr_pkt_clear_payload
Previous implementation forgot to clear the compression table, which is
an internal structure to packet. So when a recycled packet was reused,
it compared owners of newly inserted records with dangling pointers left
in the compression table.
This is less of a problem in query processing,
as each packet uses a memory pool, so the pointed names were never deallocated,
but it would write out wrong compression pointers because the compression
table kept pointing into packet that was now cleared and reused for something else.
It is more of a problem with packets created without a memory pool,
as the compression table kept references to memory that was already freed.
Vladimír Čunát [Mon, 23 Apr 2018 12:26:48 +0000 (14:26 +0200)]
cache: restored kr_cache_insert_rr API
This commit abstracts out stash_rrset from stash_rrarray_entry,
and fixes incrementing metrics on actual record insertion.
It then resurfaces kr_cache_insert_rr that was deleted in 2.0
using the extracted function.
vcunat separated stash_rrset_precond() later during rebase.
This is an attempt to fix two problems:
1. kresd tries to close incoming TCP connection too early. This may lead
to multiple client reconnections. This problem primarily
affects TCP/TLS clients who send several queries over single TCP connection.
2. In certain circumstances outbound TCP connection doesn't timeout
despite that fact that upstream doesn't send back any answers.
This may lead to timeouts on non-problematic queries.
Petr Špaček [Wed, 18 Apr 2018 10:49:50 +0000 (12:49 +0200)]
prefill: replace CA directory path with CA file path
luasec internally calls SSL_CTX_load_verify_locations() which has
non-intuituve behavior for directories. Given that we already use path
to certificate file for TLS_FORWARD it is better to use consistent and
intuitive interface.
Petr Špaček [Mon, 16 Apr 2018 16:03:05 +0000 (18:03 +0200)]
prefill: split into separate functions, handle daemon restart
The original prefill module did not import zone data after daemon
restart unless the file TTL was expired. The module now reuses data
on disk as long as TTL is not expired, and imports the zone after module
load.
lib/utils: merge kr_rrkey() and kr_rrkey2() functions
The old kr_rrkey() was used only on one place (and incorrectly) so now
we are replacing both copies with single implementation for general
resolver and root zone import.
It should not make any practical difference.
Marek Vavruša [Sat, 14 Apr 2018 04:18:42 +0000 (21:18 -0700)]
worker: fixed infinite loop on send failure
The problem here is when qr_task_send() returns an error, the
following error handler will attempt to cancel all tasks that were
started on the same connection, but that will only work for the first
task (which is finished), the qr_task_on_send() will have no effect
on tasks in progress as the passed handle is NULL, and the task->finished
is false, thus looping infinitely.
The solution here is to let the rest of the tasks complete, even though
sending answer back will fail (which is fine).
projects / thirdparty / knot-resolver.git / log
