Used for queries that are BOGUS or
(negative and either insecure or unvalidated).

FIXME: review, opt-out, etc.

It might better be passed by value, but let me keep the way for now.

attempt validation for more records but require it for fewer of them
(e.g. avoids SERVFAIL when server adds extra records but omits RRSIGs)

attempt validation for more records but require it for fewer of them
(e.g. avoids SERVFAIL when server adds extra records but omits RRSIGs)

Vitezslav Kriz authored 7 years ago and Petr Špaček committed 7 years ago

Implementation of RFC 8145 section 5 as module.

Fixes: #383

fixup! Signaling Trust Anchor Knowledge in DNSSEC using Key Tag Query

and some smaller fixes

including quite some refactoring of the new cache code

systemd: drop RefuseManualStart=true, disable kresd.service by default

See merge request !380

e.g. in _lf2wire

Root zone features seem usable now.

This allows the socket to be bound before the network interface comes
up, which is preferable to having a race between the interface coming
up and the socket being bound.

I introduced RefuseManualStart=true last year when writing the initial
systemd unit file for kresd.  I did this because i didn't want to
start running the daemon if no one was going to talk to it.

I'm no longer convinced that this directive has a good justification.
While i think that there is no need to activate the service without
socket activation, i think preventing manual invocation is actively
harmful (admins will reflexively do "systemctl restart kresd" just
like they do "systemctl restart apache2" and it's jarring to have it
rejected).

A distributor who wants to (by default) delay kresd startup until it
is accessed can ship the preset file included here, but leave the
*.socket units enabled by default.

Positive caching seems usable now. (No xNAME, wildcards, etc.)
Problem around zone cuts:
 - clear cache
 - kdig fubar
 - kdig DNSKEY cz

roothints: fix segfault with hints.root_file, added test

See merge request !378

Check deckard with valgrind during CI

See merge request !365

refs #227

CI: new Dockerfile

See merge request !375