summaryrefslogtreecommitdiffstats
path: root/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
| * | daemon, lib, modules: trivial fixes for Coverity issuesOto Šťáva2024-05-152-3/+4
| | |
| * | Merge 'origin/master' into 6.0 - last merge before renameOto Šťáva2024-05-1412-20/+40
| |\| | | | | | | | | | | | | This is the last commit in `6.0` before it is shifted into `master`, with 5.x support being moved to `master-5`.
| | * Silence Clang-TidyOto Šťáva2024-05-1312-21/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit makes lots of changes to the C code to appease the Clang-Tidy linter. Some of the less obvious ones are due to C's weird semantics regarding handling of numeric literals. We also disable a bunch of the detections because they are super-pedantic, arguably useless, or we have our own unwritten coding style rules that solve the issues.
| * | Resolve !1509 with 6.0 (libknot 3.4 compatibility)Vladimír Čunát2024-05-0911-34/+42
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - some knot_wire_next_label() calls were added since master, so those get changed as in a083f3fe63cffbabb19e6b67848151f4bb6d623c - some code has moved since master (to lib/resolve-produce.c), and unfortunately the MR !1509 did change some of it, and git was unable to handle this automatically This merge commit is separate, only bringing !1509 and no other changes from master, so that it's easier to understand.
| | * treewide: more compatibility with future libknot 3.4Vladimír Čunát2024-05-063-12/+14
| | | | | | | | | | | | | | | knot_wire_next_label used to return NULL when applied to . (root) but that's not allowed anymore, and some of our calls relied on that.
| | * treewide: more compatibility with future libknot 3.4Vladimír Čunát2024-05-0610-22/+28
| | | | | | | | | | | | knot_wire_next_label isn't allowed with NULL wire anymore.
* | | Merge branch rrl-wip-sample into rrl-wipLukáš Ondráček2024-05-221-1/+1
|\ \ \
| * | | daemon/rrl WIP: estimate CPU work done on behalf of clientsVladimír Čunát2024-05-071-1/+1
| | | |
* | | | Merge remote-tracking branch 'origin/6.0' into rrl-wipLukáš Ondráček2024-05-074-15/+38
|\ \ \ \ | |/ / / |/| / / | |/ /
| * | Merge remote-tracking branch 'origin/master' into 6.0Oto Šťáva2024-04-101-1/+1
| |\|
| | * lib/dnssec nit: improve #include pathVladimír Čunát2024-04-081-1/+1
| | | | | | | | | | | | | | | The issue was exposed when working on rrl-wip branch: lib/dnssec/nsec.c:19:10: fatal error: resolve.h: No such file or director
| * | lib/rules: avoid RPZ overriding the root SOAVladimír Čunát2024-03-271-0/+2
| | |
| * | lib/rules: fix RPZ if SOA is repated, as usual in AXFR outputVladimír Čunát2024-03-271-8/+11
| | | | | | | | | | | | The check for name equality didn't cover the case of repeated SOA.
| * | lib/rules: increase default DB size to 2G on 64-bit platformsVladimír Čunát2024-03-221-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | The file is sparse, which really is supported by all sane filesystems nowadays I think. But for 32-bit systems I'm a bit afraid for the ability to reliably get such a large contiguous mapping in process memory, so there we take the 500M limit tested in knot-dns: https://gitlab.nic.cz/knot/knot-dns/-/blob/v3.3.5/src/knot/conf/schema.c#L39
| * | Merge remote-tracking branch 'origin/master' into 6.0Oto Šťáva2024-03-222-6/+9
| |\|
| | * lib/dnssec: rename 'check_crypto_limit' to 'account_crypto_limit'Oto Šťáva2024-03-051-4/+7
| | |
| | * lib/cache: bump CACHE_VERSIONVladimír Čunát2024-02-231-1/+1
| | | | | | | | | | | | | | | | | | | | | Ideally we would've done that at once with increasing NSEC3 strictness, i.e. in 5.7.1 + 6.0.6, as otherwise we could run into some recoverable assertions until the records got removed or expired. We at least do the bump now.
| | * lib/dnssec: fix imprecise assertionVladimír Čunát2024-02-231-1/+1
| | | | | | | | | | | | It was no longer correct after commit cc5051b444130 (KeyTrap).
| * | lib/rules: fix RPZ if it contains apex NS recordVladimír Čunát2024-03-201-0/+14
| | | | | | | | | | | | | | | | | | | | | The spec even requires (at least one) NS record in apex https://datatracker.ietf.org/doc/html/draft-vixie-dns-rpz-00#section-2 but until now the implementation took it as override for the root NS, which obviously broke resolution (depending on the supplied name/s).
* | | lib/dnssec nit: improve #include pathVladimír Čunát2024-04-081-1/+1
| | | | | | | | | | | | | | | No idea why it started causing issues now and for me, with: lib/dnssec/nsec.c:19:10: fatal error: resolve.h: No such file or director
* | | rrl: porting unit tests from Knot DNSLukáš Ondráček2024-04-032-0/+36
|/ /
* | doc: various fixesOto Šťáva2024-03-151-1/+5
| | | | | | | | Fix cross-references, heading levels, etc.
* | lib/dnssec nit: reverse order of validating a DNSKEY setVladimír Čunát2024-03-051-2/+6
| | | | | | | | Suggested by Libor Peltan.
* | lib/dnssec: refactor kr_dnssec_key_*Vladimír Čunát2024-03-053-30/+31
| | | | | | | | | | | | | | | | - The "ksk" and "zsk" in names were confusing, as they did NOT match the normal terms of KSK and ZSK. - Add _usable() as a more useful function than _zsk() was. - don't use 16-bit flag-sets; it's way easier to extract on byte level - use inline for the simplified code
* | document limitation of forwarding to authoritative serversVladimír Čunát2024-02-261-1/+4
| |
* | Merge branch 'release-6.0.6' into 6.0v6.0.6Vladimír Čunát2024-02-1311-26/+158
|\ \
| * | Merge branch 'master' into dos-feb13-6.0Vladimír Čunát2024-02-1311-26/+158
| |\| | | | | | | | | | | | | | | | There were some nontrivial conflicts to resolve, NEWS + the line ctx->vld_limit_crypto = KR_VLD_LIMIT_CRYPTO_DEFAULT; (I had this resolution prepared for a long time.)
| | * mitigate KeyTrap DoS = CVE-2023-50387Vladimír Čunát2024-02-133-4/+11
| | | | | | | | | | | | Improve: don't retry in this case.
| | * mitigate KeyTrap DoS = CVE-2023-50387Vladimír Čunát2024-02-136-0/+47
| | |
| | * lib/resolve kr_request_set_extended_error(): tweak prioritiesVladimír Čunát2024-02-131-1/+1
| | | | | | | | | | | | | | | | | | | | | Keep the first error in case priorities are equal. At least with the current KeyTrap topic that should work better, but blaming a single error is alchemy anyway, at least in some cases.
| | * lib/dnssec kr_rrset_validate_with_key(): deduplicate cleanupVladimír Čunát2024-02-131-6/+5
| | |
| | * validator: compatibility with older libknot versionsVladimír Čunát2024-02-121-1/+1
| | | | | | | | | | | | The value is in IANA registry, so it's very constant anyway.
| | * validator: refuse to validate answers with more than 8 NSEC3 recordsVladimír Čunát2024-02-121-0/+18
| | |
| | * validator: limit the amount of work on SHA1 in NSEC3 proofsVladimír Čunát2024-02-121-0/+12
| | |
| | * lib/cache: limit the amount of work on SHA1Vladimír Čunát2024-02-122-0/+26
| | | | | | | | | | | | That's when searching NSEC3 aggressive cache.
| | * validator: similarly also limit excessive NSEC3 salt lengthVladimír Čunát2024-02-125-11/+36
| | | | | | | | | | | | | | | | | | | | | Limit combination of iterations and salt length, based on estimated expense of the computation. Note that the result only differs for salt length > 44 which is rather nonsensical and very rare: https://chat.dns-oarc.net/community/pl/h58qx9sjkbgt9dajb7x988p78a
| | * validator: lower the NSEC3 iteration limit (150 -> 50)Vladimír Čunát2024-02-121-5/+2
| | | | | | | | | | | | | | | | | | | | | | | | Also done by BIND9 >= 9.19.19: https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8515 The latest real-life measurements show that values above 50 are rare: https://chat.dns-oarc.net/community/pl/aadp9wwrp7g7ux1b8chbzebmze
* | | lib/dnssec: allow validating some RRsets around 64 KiB sizeVladimír Čunát2024-02-131-3/+19
|/ / | | | | | | | | - only with libknot >= 3.4 though (which is not released yet) - use stack instead of static buffer (saves RAM; see code comment)
* | libknot 3.4 compatVladimír Čunát2024-02-061-1/+1
| | | | | | | | | | This extends the new 5.x commit 673c8d2b56b6. Now I can build fine against knot-dns master again.
* | Merge branch 'master' into 6.0Vladimír Čunát2024-02-062-1/+12
|\|
| * compatibility with libknot's master (3.4 WIP)Vladimír Čunát2024-02-062-1/+12
| | | | | | | | | | I'm adding this as a function, as in knot-resolver 6.x we have one more place where it is used, and I find this more readable.
* | Update links to documentationOto Šťáva2024-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replaces all mentions of `knot-resolver.readthedocs.io` with `www.knot-resolver.cz/documentation/latest`. Some of the links used to point to the `latest` documentation, which meant the latest `master` commit, but the current system does not really allow us to do this, so instead we link to the latest stable (which is what `www.knot-resolver.cz/documentation/latest` basically is). We also cannot reliably get the documentation for a particular version in the code, so it all just points to `latest` as well. This may change in the future, although I do not yet have a good approach in mind (particularly, I don't want to bother our admins with nginx configuration updates for each newly released version).
* | datamodel: sync the whole list logging groupsVladimír Čunát2023-11-261-2/+2
| | | | | | | | | | Now that manager is integrated into kresd, I expect these will naturally keep it in sync.
* | Merge branch 'master' into 6.0Vladimír Čunát2023-11-061-2/+5
|\|
| * lib/zonecut.c fetch_addr(): resurrect filtering by NO_IPV*Vladimír Čunát2023-11-031-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This filtering was dropped in 4565cc596680 (v5.3.0). Now it's reintroduced - but inside the function, as that seems nicer. Nit: naming and comment were updated to fit the current usage. As the code is designed so far (in whole history probably), in order to detect whether we need to choose a zone cut closer to the root, we need to do something like this in lib/zonecut.c already, instead of just during server selection. I don't think this change can break anything. Fetching unusable addresses from cache seems pointless, as selection wouldn't be allowed to use them or try resolving them.
* | tests: fix config.hints after view changesVladimír Čunát2023-10-051-1/+6
| | | | | | | | It seems such an edge case that I chose to avoid the issue this way.
* | /views/*/{dst_subnet,protocols}: add, both backend+configVladimír Čunát2023-10-053-26/+144
| | | | | | | | | | | | | | | | | | | | Examples: - tagging based on dst_subnet is useful for providing different filtering setting on different resolver addresses - tagging based on protocols is useful to signal used transport (change in DNS data that can be read by the final app) (docs added in a later commit)
* | WIP lib/rules: consider multiple tags variants when answeringVladimír Čunát2023-10-051-21/+22
| |
* | lib/cache/cdb_*: add API for iteration with MDB_DUPSORTVladimír Čunát2023-10-052-1/+55
| |
* | MDB_DUPSORT for rulesVladimír Čunát2023-10-054-33/+47
| | | | | | | | | | This doesn't yet search among the multiple values. The rules/api parts that write rules were adapted or commented on.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-18 10:02:31 +0100