David Vasek authored 2 years ago and Daniel Salzman committed 2 years ago

The upper limit (C_EXPIRE_MAX_INTERVAL) is still valid even for
expire timer values received as EDNS EXPIRE options.

This partially changes the effect of commit b1f7e2f8
"refresh: don't impose limits on expire when EDNS expire takes effect".

David Vasek authored 2 years ago and Daniel Salzman committed 2 years ago

Ignore the value from SOA actually.

This change should improve next bootstrap attempt planning after zone expiration.

Robert Edmonds authored 3 years ago and Daniel Salzman committed 2 years ago

This commit adds minimal support for the haproxy PROXY v2 protocol which
is described at
https://www.haproxy.org/download/2.5/doc/proxy-protocol.txt.

Only the UDP-over-IPv4 and UDP-over-IPv6 PROXY v2 family/transports are
supported, and only the original source address/port of the proxied
client are recovered from the PROXY v2 payload. Only the PROXY command
is supported.

There is a hardcoded ACL check to verify that the query was sent from
127.0.0.0/8 before PROXY v2 decapsulation is attempted. This prevents
spoofing of the PROXY v2 header and avoids exposing the PROXY v2 parsing
code to the Internet. This should probably be converted to a real ACL
check that can be configured.

If a proxied client address/port was successfully extracted from the
PROXY v2 payload, the 'remote' field in the knotd_qdata_params_t
structure will be updated to represent the address of the real (proxied)
client. This way query modules (e.g. whoami) don't need to be updated to
continue to produce correct source address dependent behavior. The
address of the proxy that actually sent the proxied packet will be saved
in a new 'proxy' field in knotd_qdata_params_t in case this value needs
to be processed.

The 'sdig' utility that comes with PowerDNS supports generating queries
with a PROXY v2 header, which is in the 'pdns-tools' package on
Debian/Ubuntu systems. Example command-line invocations:

 * sdig 127.0.0.1 53053 example.net a proxy 0 192.0.2.1:49153 198.51.100.1:53

 * sdig 127.0.0.1 53053 example.net a proxy 0 '[2001:db8::1]:49153' '[2001:db8::100:1]:53'

Includes some code improvements and an optimization of reusing unchanged member zones.

Jan Hák authored 2 years ago and Daniel Salzman committed 2 years ago

Move ALPN and settings in context initialization

David Vasek authored 2 years ago and Libor Peltan committed 2 years ago

However, when purging orphan catalog members, knotc isn't notified about errors
returned from selective_zone_purge() and catalog_del() as for now.
Try to use similar reporting style as in zones_apply().