Robert Edmonds authored 3 years ago and Daniel Salzman committed 3 years ago

This commit updates kdig's check_reply_question() function so that it
compares the original wire format QNAME of the query against the
original wire format QNAME of the response. Using knot_pkt_qname()
instead of knot_pkt_wire_qname() only compares the downcased QNAMEs.

RFC 5452:

    4.2.  Matching the Question Section

       DNS packets, both queries and responses, contain a question section.
       Incoming responses should be verified to have a question section that
       is equivalent to that of the outgoing query.

I think "equivalent" here means that the case of the QNAMEs should be
compared too.

Robert Edmonds authored 3 years ago and Daniel Salzman committed 3 years ago

This commit adds a new function knot_pkt_wire_qname() that returns the
QNAME in the wire format buffer. This is implemented the same as the
original knot_pkt_qname() function before this branch, but now that we
no longer modify the QNAME in the wire format buffer in-place, this
should now be the "original" QNAME as seen off the wire (if the packet
was parsed from a socket buffer).

Robert Edmonds authored 3 years ago and Daniel Salzman committed 3 years ago

This commit makes knot_pkt_qname() return a const pointer to indicate to
callers that the contents (the QNAME in the wire format buffer) should
not be modified.

Robert Edmonds authored 3 years ago and Daniel Salzman committed 3 years ago

This reverts commit 4a3eb76b.

Robert Edmonds authored 3 years ago and Daniel Salzman committed 3 years ago

This reverts commit 55663f09.

Robert Edmonds authored 3 years ago and Daniel Salzman committed 3 years ago

This reverts commit 7f3aa3f6.

knsec3hash: alternative params synopsis...

See merge request knot/knot-dns!1415

...better matching NSEC3 presentation format

namserver/compression: avoid pointing directly at pointer

Closes #765

See merge request knot/knot-dns!1388

Libor Peltan authored 3 years ago and Daniel Salzman committed 3 years ago

This reverts commit 4e385878.

Nsec3 resalt refactor

See merge request knot/knot-dns!1413

journal: compute serialized changeset directly from bi-nodes...

See merge request knot/knot-dns!1412

Libor Peltan authored 3 years ago and Daniel Salzman committed 3 years ago

...for DDNS, DNSSEC and IXFR

refresh: use exponential retry backoff with base 2 rather than 3

See merge request !1411

By using the cumulative time since the zone expiration (instead of the last
time interval) we achieve an approximation of exponential retry backoff with
base 2 (rather than with base 3, as it was until now). Now, with every retry attempt,
the interval between refreshes only doubles (with up to 30 second jitter).

This change helps avoid excessive waiting for a refresh when a few early attempts
fail.

Knot DNS cookies for TCP

See merge request !1410