Aho corasick update

See merge request !548

This continues work done in !547 by respecting sensible build patterns
across a submodule.

Daniel Kahn Gillmor authored 6 years ago and Vladimír Čunát committed 6 years ago

CPPFLAGS is a traditional build environment variable used to set C
pre-processor flags.  Accept these flags during the build if they've
been set.

iterate: update zone cut when NS is authoritative for both parent and child

See merge request !543

In some cases the NS is authoritative for both parent and the child side of
the delegation (e.g. nrl.navy.mil). When it gets the query for such NS,
it can respond from the child side with an NS record in the answer and AA=1.
The resolver should update the zone cut accordingly, otherwise it would fail
validation in cases when the child-side of the delegation is insecure,
but parent side  of the delegation is secure, because the child side
would respond without DNSSEC records, and it wouldn't indicate that
the zone cut needs updating (when using minimal answers) (e.g. www.nrl.navy.mil).

lib/resolve: cut fetching: don't use root hints if no keys fetched, but glue addresses found

See merge request !513

Nitpicks

See merge request !537

Vladimír Čunát authored 7 years ago and Petr Špaček committed 6 years ago

- clickable module references
- clickable RFC references via :rfc:`NNN#anchor`

Vladimír Čunát authored 7 years ago and Petr Špaček committed 6 years ago

and make docs conform to the reality.

validator: fix CNAME to NXDOMAIN in a single answer

See merge request !538

Real example: cname.nohats.ca
This case was handled for forwarding only, presumably because it
happened more often (no need to be withing single zone to be within
single answer); now the approach is the same.

Release 2.2.0

See merge request !535

Serve stale with reputation cache: version 1

See merge request !534

Grigorii Demidov authored 7 years ago and Petr Špaček committed 7 years ago

lib/nsrep: tuning of serve-stale parameters; valid NS's sometimes been ignored by ns election algorithm, fixed

cache: fixed crash with RR sets with over 255 records

See merge request !532

The previous cache version encoded RR count as uint8_t, which doesn't
work with RR sets with over 255 records. This caused cache writes
to fail and subsequently ending in an assertion failure.
It is not very common to have large RR sets, but it has legitimate
use cases such as a lot of SRV or address records for large container
deployments etc.