attempt validation for more records but require it for fewer of them
(e.g. avoids SERVFAIL when server adds extra records but omits RRSIGs)

Vitezslav Kriz authored 7 years ago and Petr Špaček committed 7 years ago

Implementation of RFC 8145 section 5 as module.

Fixes: #383

fixup! Signaling Trust Anchor Knowledge in DNSSEC using Key Tag Query

systemd: drop RefuseManualStart=true, disable kresd.service by default

See merge request !380

This allows the socket to be bound before the network interface comes
up, which is preferable to having a race between the interface coming
up and the socket being bound.

I introduced RefuseManualStart=true last year when writing the initial
systemd unit file for kresd.  I did this because i didn't want to
start running the daemon if no one was going to talk to it.

I'm no longer convinced that this directive has a good justification.
While i think that there is no need to activate the service without
socket activation, i think preventing manual invocation is actively
harmful (admins will reflexively do "systemctl restart kresd" just
like they do "systemctl restart apache2" and it's jarring to have it
rejected).

A distributor who wants to (by default) delay kresd startup until it
is accessed can ship the preset file included here, but leave the
*.socket units enabled by default.

roothints: fix segfault with hints.root_file, added test

See merge request !378

Check deckard with valgrind during CI

See merge request !365

refs #227

CI: new Dockerfile

See merge request !375

The -r has two different meanings, apparently :-D

... when the installed root.hints isn't found

It's true by default anyway.

... even if only building

Fixes https://gitlab.labs.nic.cz/knot/knot-resolver/issues/248

We pushed all authority to the wire, but that was unnecessary,
and in particular it clashed with not validating NS in authority when
forwarding (new change).  Let's only apply this to NSEC* RRs.

Sometimes I was getting huge RTT numbers in the output (>4G).

It's not very nice that this symbol used in hints.so is defined in
sbin/kresd, but it touches the daemon structures and thus doesn't
really belong into libkres.