Remi Gacogne [Mon, 11 Jan 2016 09:45:23 +0000 (10:45 +0100)]
dnsdist: More regression tests cleanups
- Add a timeout on all queue operations
- Give dnsdist more time to start in the DNSCrypt tests, since
the key material has to be generated
- Clear the response counters and the queues before every test
- Add a one-line description for tests, displayed in verbose mode
Remi Gacogne [Fri, 8 Jan 2016 16:04:07 +0000 (17:04 +0100)]
mbed ECDSA: Completely reset the key on from* calls
As noted by @mind04 in #3161, nothing guarantees the signer will
be used for a single task with a single key. This way we make
sure that there is nothing left behind.
In addition, we now consistently use getName() in error messages.
Remi Gacogne [Fri, 8 Jan 2016 08:51:38 +0000 (09:51 +0100)]
dnsdist: Minor fixes reported by coverity
- Handle connection error in client mode
- Prevent FPE in some top* functions when no queries were processed
- Close Downstream FD in the destructor (no that we really care)
bert hubert [Thu, 7 Jan 2016 22:13:43 +0000 (23:13 +0100)]
Introduce TSIGTriple struct, hook up IXFR config in recursor to TSIG code for IXFR
merge the triplet 'tsigname, tsigalgo, tsigsecret' into a handy TSIGTriplet, and move most of the TSIG apis to this struct.
bert hubert [Thu, 7 Jan 2016 13:01:47 +0000 (14:01 +0100)]
turns out we weren't gathering the local address for TCP at all, and for UDP we did not do the work for ipfilter except when bound to 0.0.0.0. Now we do it right in the other case too AND gather the port number.
Remi Gacogne [Thu, 7 Jan 2016 11:55:14 +0000 (12:55 +0100)]
dnsdist: Add a 'source' option to select the source addr/interface
It only supports one source address/interface per downstream server.
The more I tried to support more than one, the more I realized I was
in fact having grouping several DS into one, without the benefits
of separate stats and status checking. In particular, having several
sources adresses mean that we would get "random" failures if some
addresses are allowed on the backend and some others are not.
Simply adding the same backend several times with different source
addresses means that only the ones with faulty addresses will be
disabled.
Closes #3138.
Remi Gacogne [Wed, 6 Jan 2016 09:50:22 +0000 (10:50 +0100)]
dnsdist: Apply the TCP timeout _before_ trying to connect.
In addition to that, we are now more aggressive in stopping
dnsdist to avoid getting stuck. Hopefully we should get more useful
error messages when the tests fail.
Removing usage of the timeout parameter with the same value than
the default for clarity.
Remi Gacogne [Tue, 5 Jan 2016 18:01:01 +0000 (19:01 +0100)]
Make sure the DelayPipe thread is the last member initialized
Otherwise the new thread might start running and access
uninitialized members like d_pipe or d_work.
On my host, running dnsdist in gdb without this modification
results in a SIGSEGV at delaypipe.cc:141.
Thomas D [Tue, 5 Jan 2016 16:42:38 +0000 (17:42 +0100)]
configure: Add base check for modules parameter to prevent impossible build attempts due to invalid values
We didn't validate modules parameter values which allowed build failures if a module was removed
(or the user just passed an invalid value).
Now we will do a base check by checking for the existence of the module's source dir.
This will allow us to catch errors like that and show a meaningful error message if
necessary.
Thomas D [Tue, 5 Jan 2016 15:39:07 +0000 (16:39 +0100)]
configure: Add base check for dynmodules parameter to prevent impossible build attempts due to invalid values
We didn't validate dynmodules parameter values which allows build failures like
> [...]
> Making all in geobackend
> /bin/sh: line 20: cd: geobackend: No such file or directory
> Makefile:499: recipe for target 'all-recursive' failed
> make[2]: *** [all-recursive] Error 1
which happens for example if a dynamic module was removed (or the user just passed an
invalid value).
Now we will do a base check by checking for the existence of the module's source dir.
This will allow us to catch errors like that and show a meaningful error message if
necessary.
Remi Gacogne [Mon, 4 Jan 2016 11:27:23 +0000 (12:27 +0100)]
dnsdist: Update documentation and console completion
- Update to recent changes
- Fix somewhat duplicated documentation
- Use parentheses in function calls in the documentation, as
it is probably easier to read for most people not accustomed to
Lua. Fixes #3137
Remi Gacogne [Tue, 5 Jan 2016 09:27:54 +0000 (10:27 +0100)]
dnsdist: Add sending CNAME in spoofed responses
- Add addDomainCNAMESpoof() and SpoofCNAMEAction()
- Check that we have enough space in the buffer to write the response
- Implement the first part of #3064
Remi Gacogne [Wed, 30 Dec 2015 08:20:30 +0000 (09:20 +0100)]
dnsdist: Add a basic regression test for DNSCrypt
I could not find any DNSCrypt client implementation in python without
zillions of dependencies, so I wrote a basic one depending only
on dnspython and libnacl bindings.
projects / thirdparty / pdns.git / log
