there are two modules that couldn't work before:

* graphite
* ketcd

It was rather low-level anyway.

Library lua-aho-corasick is provided as git submodule. Library
build is triggered with kresd build. ahocorasick.so is copied into
modules directory.

The RFC seems to read that resolvers should reply with address records
even for foo.bar.localhost.  Note: Unbound-1.6.4 does NOT do that.
https://tools.ietf.org/html/rfc6761#section-6.3

In particular, try to make the locally-served zones valid,
including SOA and NS in apex, empty non-terminal vs. NXDOMAIN, etc.
I might've missed something, but it should certainly be closer to ideal.

According to RFC6761 query to localhost domain should generate
immediate response with loopback ip address.

This allows to disable specific deny rules on zone-by-zone basis
as it should be according to RFC6303 sec.3. Disable can be done by
policy rule PASS.

Also any FORWARD rule for such zone will be evaluated before DENY
that query.

Casting is dangerous, e.g. it's easy to misconfigure policy with
  policy.add(policy.FORWARD('some address'))
which lead to segfault without showing any indication of the cause.
Now this case will show as
  .../policy.lua:98: 'struct kr_query' has no member named 'current'
and only abort the policy module instead of the whole process.

Thanks to Petr for finding this issue.

I see no sane way to set the flags from lua, so I made a C function.

Vladimír Čunát authored 8 years ago and Ondřej Surý committed 8 years ago

These shouldn't make any problems:
- the verbose messages don't print any scope, and
- reputation cache doesn't consider scope.

These shouldn't make any problems:
- the verbose messages don't print any scope, and
- reputation cache doesn't consider scope.

RTT tracking for all targets is also supported,
but no loadbalancing is done based on that yet

example:

> daf.add 'forward 127.0.0.1@5353'

all relevant modules now support running in
forked mode and polling workers for information.
for example graphite module can poll stats from
all workers and then aggregate before sending,
or HTTP module can run on the process group leader
only and then poll workers for information.