Kevin P. Fleming [Wed, 18 Nov 2020 15:05:39 +0000 (10:05 -0500)]
Avoid accidental removal of generated files
When generated files (man pages, api-swagger files, etc.) are
in the tree because they were part of a source distribution
but were not locally generated, 'make clean' should not remove
them. Doing so results in a broken tree, as the Makefiles
expect the files to be present, and running 'configure' again
will introduce the additional dependencies required to
generate them.
Remi Gacogne [Tue, 17 Nov 2020 10:21:14 +0000 (11:21 +0100)]
rec: Test that the "zero scope" option doesn't exceed the maximum payload size
When use-incoming-edns-subnet is enabled, the query has an ECS option,
and the answer was not variable, we do return a 0-scoped ECS answer,
to make it possible to the client (dnsdist for example) to cache the
response and serve it to all clients.
Still we need to make sure that adding the 0-scoped ECS option does not
exceed the client EDNS UDP payload size.
Remi Gacogne [Tue, 17 Nov 2020 10:51:14 +0000 (11:51 +0100)]
rec: Switch to TCP in case of spoofing (near-miss) attempts
Instead of treating this like an unrecoverable network error and
trying the next server, let's switch to TCP instead. This might
prevent a DoS by making us try every single servers and failing,
and will make the spoofing attempt a bit much harder.
Remi Gacogne [Mon, 16 Nov 2020 14:20:40 +0000 (15:20 +0100)]
dnsdist: Add per connection queries count and duration stats for DoH
This is done by implementing a per-thread table of DoH connections,
keyed on the underlying file descriptor, since we don't have access
to the h2o_conn_t object but only to the h2o_socket_t when the
connection is first established (h2o_socket_read_start() callback)
or terminated (on_close callback of the socket).
This also makes it possible to use a std::shared_ptr instead of our
custom reference counting, since we keep an entry in the table for
the duration of the connection and don't need to rely on h2o's raw
pointer anymore to pass our data.
Kevin P. Fleming [Fri, 13 Nov 2020 22:35:34 +0000 (17:35 -0500)]
Use Python 3 in build system
The various tasks in the build system which use Python
will now use Python 3 (3.6 or later) and the 'venv' module,
instead of the 'virtualenv' tool which was primarily used
with Python 2.7.
georgeto [Fri, 13 Nov 2020 13:05:36 +0000 (14:05 +0100)]
dnsdist: Improve const-correctness of Lua bindings
Since LuaWrapper enforces const-correctness, a const (shared) pointer
to an object can only read members and call const methods.
Therefore we have to take care to use the const qualifier during
registration of constant lambda Lua function bindings.
An example where the absence of the const qualifier was problematic is
LuaRule, which invokes its user provided match function with a constant
DNSQuestion object. Because the functions of DNSQuestion lacked
the const qualifier (e.g. getTag()), it was not possible to call them
from within the LuaRule match function.
Otto Moerbeek [Wed, 11 Nov 2020 11:02:50 +0000 (12:02 +0100)]
Do not add request to a wait chain that's already processed or being processed.
The following scenario can occur. Multiple concurrent clients doing the same query A
are needed to trigger it:
1. Incoming request A, which has a need for request X
2. Add request X to chain because we already have an identical outstanding request
3. We receive the reply for X
4. We process the chain
5. In the meantime a new request for X that's identical is added to the chain
6. The added id in step 5 is not being processed anymore -> timeout
This can happen if request X has TTL 0, otherwise the record cache would have a hit.
Kevin P. Fleming [Tue, 10 Nov 2020 12:29:39 +0000 (07:29 -0500)]
auth: Add /api/docs endpoint to obtain OpenAPI document
This patch adds an /api/docs endpoint to the API webserver,
allowing clients to obtain the OpenAPI (Swagger) document that
describes the server's API directly from the server.
It also modifies the response body mechanism in the webserver
to no longer assume JSON output, but allow handlers to specify
JSON, YAML, or plain text. It also adds detection of YAML
support in the request so that handlers can choose which type
to send in their response. Since there is not yet a standard
MIME type for YAML, 'application/x-yaml' is used since it
appears to be the most commonly used type.
Remi Gacogne [Tue, 10 Nov 2020 10:15:02 +0000 (11:15 +0100)]
rec: Avoid a CNAME loop detection issue with DNS64
When the requested qname is a CNAME to a second CNAME, the CNAME
loop detection might get incorrectly triggered because the CNAMEs
were already present in the vector of result records.
projects / thirdparty / pdns.git / log
