Remi Gacogne [Mon, 23 Jan 2023 11:12:54 +0000 (12:12 +0100)]
dnsdist: Apply Otto's remarks to the new carbon code
- We now explicitly convert to double, making sure that we will not
overflow by restricting the value of the counter
- Clear the endpoints list when the carbon threads are started, to
make clear we do not need them anymore
- Move the endpoints passed to the carbon threads, to make static
analysis tools happy.
auth: Speedup DNSRecordContent::deserialize() a little
The move from a vector to a PacketBuffer prevents the memory from
being zeroed while we are going to overwrite it right away.
The change from MOADNSParser to PacketReader avoids the need to
copy the header and the whole packet (allocation + copy),
parse the qname again, as well as the allocation of a vector of records
while we know we have only one of these.
Remi Gacogne [Fri, 20 Jan 2023 11:41:32 +0000 (12:41 +0100)]
Add a configure option to enable LTO
The supported options are:
- thin: this is the recommended option for clang, as it is more
scalable. It automatically determines the number of CPU cores
to use. It requires support in the linker as well.
- auto: this is the recommended option for GCC, and a valid
fallback for clang when 'thin' is not supported. It automatically
determines the number of CPU cores to use as well.
- yes: this translates to '-flto', which will use a single CPU core
in most cases, but is a valid fallback.
- no: LTO is disabled.
Remi Gacogne [Mon, 16 Jan 2023 14:28:02 +0000 (15:28 +0100)]
dnsdist: Skip invalid OCSP files after issuing a warning
Contrary to certificates and keys, OCSP files are never required to
provide a working DoT or DoH service, so it's better to start even
if would not load all, or any, OCSP files.
Otto Moerbeek [Tue, 17 Jan 2023 09:59:04 +0000 (10:59 +0100)]
Remove remains of g_dnssecLOG
It was never set from !recursor and has the same value as trace in
rec. Now validationo logging goes the same as other trace handling,
so trace-regex also shows validation.
Otto Moerbeek [Wed, 11 Jan 2023 14:25:27 +0000 (15:25 +0100)]
Plumbing to let validate.cc and aggressive-nsec.cc use the recursor trace logging
Until now the logging of the DNSSEC code used it's own logging, which has
the consequence that prefixed, tracing and indenditng all worked differently
compared to the regular (trace) logging in rec.
So provide a construct to unify them without exposing syncres
internals to the validation code.
Remi Gacogne [Tue, 17 Jan 2023 16:31:52 +0000 (17:31 +0100)]
Add a new configure option to initialize automatic variables
The new option, `--enable-auto-var-init`, when enabled, sets the
`-ftrivial-auto-var-init` flag when supported by the compiler
(GCC 12+, clang 16+) to either:
- `zero`: zero-initializes all automatic variables, and is enabled
with `--enable-auto-var-init=yes` or `--enable-auto-var-init=zero`.
This can be used as a hardening measure in production, reducing
information leakage issues.
- `pattern`: initialize all automatic variables to a pattern that
is likely to be detected, like 0xAA, and is enabled via
`--enable-auto-var-init=pattern`. This is useful in tests,
especially when the cost of sanitizers is too high.
I have not done any performance testing, but the zero option is
generally considered to have a less than 5% performance cost.
Otto Moerbeek [Tue, 17 Jan 2023 09:00:30 +0000 (10:00 +0100)]
Change the way RD=0 forwarded queries are handled.
Since forever, there has been special case code for forwarded queries
in the RD=0 case. This special case code does a hardcoded RD=0
query to the specified forwarder. This code has two consequences:
1. Even if the forwarder is marked recursive it gets a RD=0 query
2. The cache is not consulted at all
The corresponding unit tests actually test this behaviour, but after
historic digging with help from @rgacogne it turns out the the unit
test do not reflect the desired functionality, but the current state
of affairs to help with a refactoring PR. That is good, since
refactoring should not change functionality.
But now the time has come to change the code to do the desired thing:
1. If an RD=0 query is received, do a cache only-lookup in all cases.
2. Never send a RD=0 query to a recursive forwarder
I already did a similar thing when I wrote the QName Minimization
code, introducing a conditional that only gets set for that case,
to avoid changing unrelated (to QM) functionality.
projects / thirdparty / pdns.git / log
