Oto Šťáva [Fri, 17 Jun 2022 08:57:58 +0000 (10:57 +0200)]
daemon/http: improve URI checks
The `check_uri()` function now only checks that the endpoint is either
`/doh` or `/dns-query`. Parameter checks were moved into
`process_uri_path()` so that the check only takes place for GET
requests. POST requests now do not care about parameters at all.
Vladimír Čunát [Tue, 24 May 2022 09:35:14 +0000 (11:35 +0200)]
tweak inlining
I used -Winline (optimizing, gcc 11 or 12) to gather warnings
about cases that were considered too expensive for inlining.
Some of these probably used not to happen when we were dropping
assertions during preprocessing in -DNDEBUG builds.
This commit mainly improves size of the compiled binary by several KiB.
- queue_head_impl(): optionally (un)inline; not big but in warnings
- queue_pop_impl(): uninline; too complex for my today's eyes
- kr_rand_bytes(): optionally (un)inline
The inlining potential there comes from calling with a constant.
- kr_straddr(): uninline. It's never been meant for hot code,
and this gives us large savings due to deduplicating the static array.
- For some I couldn't see a good resolution due to restrictions in C.
C hint: `static inline` is probably well known;
the other inline combination is well explained at:
https://stackoverflow.com/a/6312813/587396
Vladimír Čunát [Tue, 24 May 2022 08:36:50 +0000 (10:36 +0200)]
lib/selection debug logs: print one more line
And that made the "NO6: is KO" line extraneous.
Example in context:
[select][14162.01] => id: '15271' choosing from addresses: 0 v4 + 1 v6; names to resolve: 6 v4 + 5 v6; force_resolve: 0; NO6: IPv6 is OK
[select][14162.01] => id: '15271' choosing: 'ns1.p31.dynect.net.'@'2600:2000:2210::31#00053' with timeout 774 ms zone cut: 'amazon.com.'
[select][14162.01] => id: '15271' updating: 'ns1.p31.dynect.net.'@'2600:2000:2210::31#00053' zone cut: 'amazon.com.' with rtt 316 to srtt: 311 and variance: 89
Vladimír Čunát [Tue, 24 May 2022 07:02:53 +0000 (09:02 +0200)]
lib/selection: improve IPv6 avoidance if broken
It was still possible to get into a deadlock here.
https://forum.turris.cz/t/not-connecting-to-applications-like-discord/17111/7
If A records for a NS fell out of cache but AAAA remained,
with probability 1-\epsilon we'd choose an AAAA address
even if IPv6 was considered broken.
I looked at *the whole* no6 strategy again, and I do think that
there are no such holes anymore. A few percent attempts will still
go over IPv6 even if it's considered broken, but that sounds OK-ish.
Vladimír Čunát [Thu, 7 Apr 2022 18:44:05 +0000 (20:44 +0200)]
ci docker: make into a x86+arm matrix
No other job can do it, as we don't have docker images ready for that,
and the usual manual workflow won't be well usable with arm64.
We'll need to convert their generation to (manual?) CI schedules.
Vladimír Čunát [Mon, 30 May 2022 11:48:16 +0000 (13:48 +0200)]
meson nit: deal with warning about future of run_command
WARNING: You should add the boolean check kwarg to the run_command call.
It currently defaults to false,
but it will default to true in future releases of meson.
See also: https://github.com/mesonbuild/meson/issues/9300
In almost all cases we already check the return code explicitly
and throw a more descriptive message than what would be the default.
https://man7.org/linux/man-pages/man3/posix_fallocate.3.html#ERRORS:
> EOPNOTSUPP
> The filesystem containing the file referred to by fd does not support
> this operation. This error code can be returned by C libraries that
> don't perform the emulation shown in NOTES, such as **musl libc**.
I've encountered this problem on Alpine Linux running inside an LXC
container on Ubuntu with data on ZFS.
Vladimír Čunát [Wed, 27 Apr 2022 14:03:06 +0000 (16:03 +0200)]
lib/dnssec: rewrite kr_nsec_ref_to_unsigned()
- I see no motivation to search for NS records here;
and I didn't like that loop nesting
- philosophy shift akin to the recent
replacement of kr_nsec_existence_denial()
Vladimír Čunát [Sat, 23 Apr 2022 15:23:47 +0000 (17:23 +0200)]
lib/dnssec: replace kr_nsec_existence_denial()
The NSEC validation code has been written very mechanically
according to RFC 4033..4035, but those explain wildcard-related
topics in a way that's hard to understand right.
So here I rewrite it with a different philosophy, so it should be
easier to understand, a bit faster, and less buggy and bug-prone.
Vladimír Čunát [Fri, 13 May 2022 10:52:20 +0000 (12:52 +0200)]
lib/utils kr_sockaddr_key_same_addr(): more precision
... in case of IPv6 link-local addresses.
The casting isn't very nice, but we certainly rely on `family` being
always on the same offset anyway (and it's ensured by standards).
projects / thirdparty / knot-resolver.git / log
