Karel Slaný authored 8 years ago and Ondřej Surý committed 8 years ago

The source address was always put into a subsequent query.

Karel Slaný authored 8 years ago and Ondřej Surý committed 8 years ago

This simplifies the response source identification on the cookie module.

Karel Slaný authored 8 years ago and Ondřej Surý committed 8 years ago

According to section 5.3 of the cookie draft the resolution should fail
if invalid cookie received.

Karel Slaný authored 8 years ago and Ondřej Surý committed 8 years ago

Currently without success.

this caused a bug in pseudo-lru table that negated
stickiness of values to table slots

Fix segmentation fault in early shutdown from `quit()` in config

kresd was segfaulting if configuration file contained `quit()`

See merge request !42

DNS over TLS and TCP out-of-order processing

Refresh !18

I merged few bits from @dkg branch, but there are two notable things missing:
- watch for on-disk chang of credentials - not sure if this is really needed, I would suggest a separate MR, where we can discuss benefits of doing so.
- ephemeral key generation from `net.tls_servicename` - this is fine, but instead of setting `tls_servicename`, let's make it an explicit generator e.g. net.generate_certificate("name") instead of setting `tls_servicename` in the `struct network`. Again I would suggest a separate MR.

To test the TLS listen, you can use a dns-over-tls branch from Knot DNS:
```
./daemon/kresd --tls=127.0.0.1\#5353
net.tls("cert", "key")
```

```
$ ./src/kdig +tls -p 5353 www.cmu.edu @127.0.0.1
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 9741
;; Flags: qr rd ra; QUERY: 1; ANSWER: 2; AUTHORITY: 0; ADDITIONAL: 0

;; QUESTION SECTION:
;; www.cmu.edu.        		IN	A

;; ANSWER SECTION:
www.cmu.edu.        	86400	IN	CNAME	www-cmu-prod-vip.andrew.cmu.edu.
www-cmu-prod-vip.andrew.cmu.edu. 21600	IN	A	128.2.42.52

;; Received 107 B
;; Time 2016-08-05 11:52:25 CEST
;; From 127.0.0.1@5353(TCP) in 2146.1 ms
;; TLS session info: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-256-GCM)
```


See merge request !41

Ensure that kr_log_info() gets sent promptly to stdout

If stdout is buffered, kr_log_info() might take ages to show up in the
output stream.  Since this stream could be interleaved with stderr
(e.g. kr_log_error()), it would be good to be able to see the messages
in the order in which they are generated.

See merge request !40

If stdout is buffered, kr_log_info() might take ages to show up in the
output stream.  Since this stream could be interleaved with stderr
(e.g. kr_log_error()), it would be good to be able to see the messages
in the order in which they are generated.

Daniel Kahn Gillmor authored 8 years ago and Ondřej Surý committed 8 years ago

RFC 7858 explicitly defines an out-of-band key pinning profile as one
authentication mechanism.  It uses the same format for representing
the pin as HPKP does (RFC 7469).

By logging this pin directly upon first use of the X.509 credentials,
we make it a little bit easier for an admin to publish part of a
pinset.

For ideal operation (including preparation for key rollover), a backup
public key should also be provided, but this is not defined
functionally here.

Daniel Kahn Gillmor authored 8 years ago and Ondřej Surý committed 8 years ago

We also propagate kresd's verbosity into the TLS logging level