Tomas Krizek [Thu, 13 Aug 2020 14:17:10 +0000 (16:17 +0200)]
daemon/session: add write_queue_size
This data is useful to track whether our code has buffered any data
for writing to the socket. Tracking this in session instead of
tls_common_ctx is required to support other protocols, e.g. plain HTTP.
Štěpán Balážik [Tue, 11 Aug 2020 14:18:27 +0000 (16:18 +0200)]
ci: fix divergent commit in Deckard submodule
Branch on Deckard tree tracked in this repository was left unmerged in
Deckard. The two trees therefore diverged and broke CI in knot-resolver
repo on a few commits retroactively.
Petr Špaček [Fri, 24 Jul 2020 13:37:50 +0000 (15:37 +0200)]
validator: up->bottom chase DS if RRSIG(s) are missing
The original approach was using SOA owner in negative answers
to optimize number of DS queries. This approarch is less realiable with
weird "servers", including pre-DNSSEC servers which reply to DS query
with an SOA owner pointing to the child zone instead of parent zone.
We now walk the tree from root down to find the missing DS or proof of
its non-existance.
Vladimír Čunát [Thu, 2 Jul 2020 15:04:08 +0000 (17:04 +0200)]
validator: bottom->up chase DS if RRSIG(s) are missing
This is about situations when validator *thinks* it's in a signed zone
but an unsigned answer comes in. The assumption was that RRSIGs didn't
make it through some middle-boxes and it retried with explicit QTYPE=RRSIG.
There were two issues with that.
1. It seems that in most cases the cause of the situation is that
we skipped over a zone cut that transitioned to insecure state,
so the signatures correctly don't exist.
2. An explicit RRSIG query appears to be more trouble than worth;
it seems reasonable for servers not to answer it (fully);
see RFC 8482 sect. 7.
The new approach simply tries to find a proof that the name is insecure,
by spawning a QTYPE=DS sub-query on that name. That fixes some
real-life cases; usually this happens in iteration mode where one IP
address serves zones on both sides of a cut that transitions to insecure.
For details see new comments in that rrsig_not_found() function.
The change resulted in the iterator fallback not making sense anymore
so it was removed.
Vladimír Čunát [Mon, 3 Aug 2020 17:32:23 +0000 (19:32 +0200)]
daemon/lua: get rid of __engine symbol in lua
In particular this gets rid of last light user data inside kresd.
It was still causing problems on some systems, for example Debian Sid.
The error was the same: "bad light userdata pointer" from luajit,
but note that the problem can still be triggered by lua libraries,
e.g. cqueues.
Petr Špaček [Fri, 31 Jul 2020 15:52:50 +0000 (17:52 +0200)]
kr_pkt_text: OPT RR does not need to be at the end of Additional section
Previous code incorrectly assumed that OPT was last RR in section
and this lead to truncating output.
https://tools.ietf.org/html/rfc6891#section-6.1.1 clearly states that
OPT can be anywhere in Additional section.
Printer relies on checks in libknot packet parser: check_rr_constraints()
prevents packets with more OPT RRs or OPT outside of additional section
from being parsed so the printer cannot see them.
Vladimír Čunát [Mon, 13 Jul 2020 14:10:22 +0000 (16:10 +0200)]
validate: don't chase non-sensical signers
When signer name isn't a prefix of owner, the signature does not make
sense and it's no use trying to use that signer name in any way.
We generally don't force queries on every level of the path,
so this signer confusion could "introduce SERVFAILs" if we
skip over a transition to insecure.
Vladimír Čunát [Tue, 14 Jul 2020 15:13:35 +0000 (17:13 +0200)]
ci travis: tweak the timeouts a bit
In the past week the Travis runs have been consistently taking much more
time than before, usually around 20 minutes, leading to our CI timing out.
https://travis-ci.com/github/CZ-NIC/knot-resolver/builds
Vladimír Čunát [Tue, 14 Apr 2020 10:06:44 +0000 (12:06 +0200)]
doc-comments: fix some of the complaints from doxygen
There's still frequent issue that documenting some parameters would be
mainly noise but doxygen will warn when not doing it.
WARN_IF_UNDOCUMENTED apparently doesn't cover this and
WARN_IF_DOC_ERROR would probably remove even some useful warnings.
Vladimír Čunát [Fri, 10 Jul 2020 12:35:36 +0000 (14:35 +0200)]
config tests: better test net.tls_sticket_secret()
The trick there is that it isn't supported (by us) on gnutls < 3.6.3.
I checked that the test fails before the fix in parent commit
and that it succeeds (is skipped) with gnutls 3.6.2.
Tomas Krizek [Fri, 19 Jun 2020 09:47:33 +0000 (11:47 +0200)]
daemon: don't drop capabilities when running as root
When the effective user is root, no capabilities are dropped. This
change has no effect when running as non-privileged user or when
switching to non-privileged user via user() in config.
Dropping capabilities as a root user resulted in the following
unexpected behaviour:
1. When using trust anchor update, r/w access to root keys is neeeded.
These are typically owned by knot-resolver user. When kresd is
executed as root and capabilities are dropped, this file was no longer
writable, because it is owned by knot-resolver, not root.
2. It is impossible to recreate/resize cache due to the same permission
issue as above.
If you want to drop capabilities when starting kresd as a root user,
you can switch the user with the `user()` command. This changes the
effective user ID and drops any capabilities as well.
Vladimír Čunát [Tue, 30 Jun 2020 12:37:12 +0000 (14:37 +0200)]
policy.rpz: fix $ORIGIN-related handling
- use parser-detected $ORIGIN instead of looking at SOA owner
- skip records outside $ORIGIN (and warn) instead of nesting them
- simplify a bit, and tweak warnings
Vladimír Čunát [Tue, 30 Jun 2020 08:51:08 +0000 (10:51 +0200)]
policy.rpz: don't warn on NS and SOA records
Also utilize table indexing.
This was a "regression" from extending RPZ support in 5.1.0.
NS and SOA are even mandatory, as RPZ is supposed to be a valid zone:
https://tools.ietf.org/html/draft-ietf-dnsop-dns-rpz-00#section-2
Vladimír Čunát [Tue, 9 Jun 2020 06:09:32 +0000 (08:09 +0200)]
gc: fix integer overflow when computing how much to GC
On 32-bit systems the insufficient GC could commonly happen:
https://lists.nic.cz/pipermail/knot-resolver-users/2020/000265.html
The meaning of -f parameter got slightly changed, so that the buggy
computation could be greatly simplified. GC seems to make sense when
most of cache space is used, in which case the difference is small.
projects / thirdparty / knot-resolver.git / log
