Vladimír Čunát [Wed, 15 Jun 2022 08:46:19 +0000 (10:46 +0200)]
adapt to libknot 3.2 lower-casing knot_pkt_qname()
Our strategy was (and remains) that the in-header QNAME is overwritten
in-place, so most of our code was already (correctly) assuming that
knot_pkt_qname() returns lower-case only. That simplifies this commit.
Vladimír Čunát [Mon, 27 Jun 2022 08:37:13 +0000 (10:37 +0200)]
ci/pkgtest: switch bad LXC builds to manual start
We've been unable to progress with these failures for some time,
and it's not good to have them red in CI all the time.
Manual start should allow easier testing of future fixes,
without doing the futile runs automatically.
Oto Šťáva [Wed, 13 Jul 2022 06:21:48 +0000 (08:21 +0200)]
ci: confine docker and macOS jobs to main repository
Some of our CI jobs use project-specific GitLab runners (e.g. requiring
the `dind` tag). The jobs then fail when someone forks the repository
and opens a merge request. This commit confines those jobs to the
`knot/knot-resolver` repository.
Vasek Sraier [Fri, 24 Jun 2022 15:20:00 +0000 (17:20 +0200)]
manager: remove systemd support
Why? Because it is dangerous to use. You'd have to run manager with root privileges
to be able to spawn systemd services via DBus. There is an option to do the same
with session instances of systemd, but that is unpackageable and pretty much unusable
in production. We will therefore rely on supervisord, as it's support got much better
recently.
Oto Šťáva [Thu, 23 Jun 2022 08:14:58 +0000 (10:14 +0200)]
daemon/tls: fix a double-free for some cases of policy.TLS_FORWARD
The double-free may have happened in some cases when the upstream
resolver was stopped while answering a forwarded query. I was reliably
reproducing it by running resperf on two kresd instances with one forwarded
to the other, and killing the upstream one.
Vladimír Čunát [Thu, 16 Jun 2022 08:12:22 +0000 (10:12 +0200)]
modules/priming: don't warn against unloading it
I can't see sufficient motivation here. The cache will be slightly
less ready, but it's not often that you need to contact a root server.
Most importantly, kresd must work well anyway, even with empty cache.
Also, the compiled-in address set of root servers should be quite
accurate - the NS set has never changed, and the last address change
was five years ago with just one of 26 records changing.
Vasek Sraier [Fri, 17 Jun 2022 13:03:43 +0000 (15:03 +0200)]
made supervisord sd_notify() plugin properly functional + supervisord config changes
- X-SUPERVISORD-TYPE=notify in a process's environment should make the process behave similarly to Type=notify systemd service units
- startsec with the above means time, after which it will get killed without ready notification
Vasek Sraier [Wed, 25 May 2022 13:03:14 +0000 (15:03 +0200)]
manager: experimental implementation of supervisord extension to support sd_notify()
contains:
- python module written in C, because Python does not support socket auxiliary messages like SCM_CREDENTIALS
- XML-RPC extension for supervisord, which actually does not do anything except for injecting code into supervisord internals
Oto Šťáva [Fri, 17 Jun 2022 08:57:58 +0000 (10:57 +0200)]
daemon/http: improve URI checks
The `check_uri()` function now only checks that the endpoint is either
`/doh` or `/dns-query`. Parameter checks were moved into
`process_uri_path()` so that the check only takes place for GET
requests. POST requests now do not care about parameters at all.
Vladimír Čunát [Tue, 24 May 2022 09:35:14 +0000 (11:35 +0200)]
tweak inlining
I used -Winline (optimizing, gcc 11 or 12) to gather warnings
about cases that were considered too expensive for inlining.
Some of these probably used not to happen when we were dropping
assertions during preprocessing in -DNDEBUG builds.
This commit mainly improves size of the compiled binary by several KiB.
- queue_head_impl(): optionally (un)inline; not big but in warnings
- queue_pop_impl(): uninline; too complex for my today's eyes
- kr_rand_bytes(): optionally (un)inline
The inlining potential there comes from calling with a constant.
- kr_straddr(): uninline. It's never been meant for hot code,
and this gives us large savings due to deduplicating the static array.
- For some I couldn't see a good resolution due to restrictions in C.
C hint: `static inline` is probably well known;
the other inline combination is well explained at:
https://stackoverflow.com/a/6312813/587396
Vladimír Čunát [Tue, 24 May 2022 08:36:50 +0000 (10:36 +0200)]
lib/selection debug logs: print one more line
And that made the "NO6: is KO" line extraneous.
Example in context:
[select][14162.01] => id: '15271' choosing from addresses: 0 v4 + 1 v6; names to resolve: 6 v4 + 5 v6; force_resolve: 0; NO6: IPv6 is OK
[select][14162.01] => id: '15271' choosing: 'ns1.p31.dynect.net.'@'2600:2000:2210::31#00053' with timeout 774 ms zone cut: 'amazon.com.'
[select][14162.01] => id: '15271' updating: 'ns1.p31.dynect.net.'@'2600:2000:2210::31#00053' zone cut: 'amazon.com.' with rtt 316 to srtt: 311 and variance: 89
Vladimír Čunát [Tue, 24 May 2022 07:02:53 +0000 (09:02 +0200)]
lib/selection: improve IPv6 avoidance if broken
It was still possible to get into a deadlock here.
https://forum.turris.cz/t/not-connecting-to-applications-like-discord/17111/7
If A records for a NS fell out of cache but AAAA remained,
with probability 1-\epsilon we'd choose an AAAA address
even if IPv6 was considered broken.
I looked at *the whole* no6 strategy again, and I do think that
there are no such holes anymore. A few percent attempts will still
go over IPv6 even if it's considered broken, but that sounds OK-ish.
Vladimír Čunát [Thu, 7 Apr 2022 18:44:05 +0000 (20:44 +0200)]
ci docker: make into a x86+arm matrix
No other job can do it, as we don't have docker images ready for that,
and the usual manual workflow won't be well usable with arm64.
We'll need to convert their generation to (manual?) CI schedules.
Vladimír Čunát [Mon, 30 May 2022 11:48:16 +0000 (13:48 +0200)]
meson nit: deal with warning about future of run_command
WARNING: You should add the boolean check kwarg to the run_command call.
It currently defaults to false,
but it will default to true in future releases of meson.
See also: https://github.com/mesonbuild/meson/issues/9300
In almost all cases we already check the return code explicitly
and throw a more descriptive message than what would be the default.
projects / thirdparty / knot-resolver.git / log
