Daniel Kahn Gillmor authored 8 years ago and Ondřej Surý committed 8 years ago

We also propagate kresd's verbosity into the TLS logging level

Marek Vavrusa authored 8 years ago and Ondřej Surý committed 8 years ago

there are cases where switches or middle-boxes
block DNS/UDP answers >512 octets completely,
this gives user an option to mitigate that.
however, there are authoritatives serving
large answers that don't support TCP, so it's
a compromise as always

Daniel Kahn Gillmor authored 8 years ago and Ondřej Surý committed 8 years ago

kresd has --tls/-t by analogy with --addr/-a where the daemon opens
the socket itself.

This changeset adds equivalent functionality for inherited sockets:
--tlsfd/-T by analogy with --fd/-Sa

Marek Vavrusa authored 8 years ago and Ondřej Surý committed 8 years ago

the TLS sessions now bypass the usuall event loop asynchronous iops
this is because the whole operation is synchronous right now, and
implementing asynchronous send operations would require TLS session to
restart write events on the event loop and making sure the "on complete"
callback is called eventually

Marek Vavrusa authored 8 years ago and Ondřej Surý committed 8 years ago

this is a workaround probably, but we need to
process all records in received buffer otherwise
it loses the rest of the data

add Documentation= reference to knot-resolver.service

This makes "systemctl help knot-resolver" bring up the appropriate man
page.

See merge request !39

This makes "systemctl help knot-resolver" bring up the appropriate man
page.

Control socket activation

This branch provides reasonable configs for full systemd socket activation for kresd.

See merge request !36

This is a fully-socket-activated knot-resolver service that can run as
a non-priivleged user named knot-resolver.

When run under systemd supervision, accept a control socket from the
supervisor if the name supplied is "control".

See FileDescriptorName= in systemd.socket(5) for more details.

this module is superseded by http module, removing

iterator already checks this and also chain length,
however these checks were omitted in the rrcache
CNAME unroll loop

there are cases where switches or middle-boxes
block DNS/UDP answers >512 octets completely,
this gives user an option to mitigate that.
however, there are authoritatives serving
large answers that don't support TCP, so it's
a compromise as always

in normal mode, only final CNAME target is refetched, but
not intermediate CNAMEs. intermediate CNAMEs are *never* cached,
but they are used to get final name for requery. in strict mode now,
every CNAME target is explicitly fetched even if it's a chained CNAME.

more kresd.8 cleanup



See merge request !35

emacs turds should never make it into git



See merge request !34

Doc cleanup

This is a simple cleanup of documentation

See merge request !33