menakite authored 7 months ago and Vladimír Čunát committed 6 months ago

Rename config to init, which is called when a module is loaded.
It seems it's been broken for a while.

adds libjemalloc-detector

menakite authored 6 months ago and Vladimír Čunát committed 6 months ago

See:
  !1590 (comment 304380)

menakite authored 7 months ago and Vladimír Čunát committed 6 months ago

If the tag and algorithm of DS and DNSKEY do not correspond, or in case
the DNSKEY is revoked, set EDE code "DNSKEY Missing".
If both match, but the algorithm is not supported, set EDE code
"Unsupported DNSKEY Algorithm".
In case RRSIGs for DNSKEY exist, but can't be validated due to a key
error, set EDE code "RRSIGs Missing".

menakite authored 7 months ago and Vladimír Čunát committed 6 months ago

dnssec:
  * Provide a way to retrieve whether a DNSKEY has the Zone Key bit set,
    and add bindings for Lua modules (kr_dnssec_key_zonekey_flag), like
    kr_dnssec_key_sep_flag.
  * In kr_ds_algo_support() provide a way to retrieve what is wrong with
    the keys.
  * Check if a RRSIG RR has the signature expired already before
    inception time.

validator:
  * Set EDE "Unsupported NSEC3 Iterations Value" when downgrading.
  * Set EDE "Signature Expired before Valid" when checking RRSIGs.
  * Set EDE "No Zone Key Bit Set" when a DNSKEY with the Zone Key Bit
    set to 0 is discarded.
  * Instead of the generic "Other Error" with extra text
    "unsupported digest/key", set appropriate EDEs
    "Unsupported DNSKEY Algorithm" and "Unsupported DS Digest Type".

resolver:
  * Set EDE "No Reachable Authority" when it is decided that all
    authoritative servers are unreachable or misbehaving.

Some parts adjusted by vcunat, in particular construction of EDE messages.

It's trivial really, and I'd like to use it now.

Closes #631

Oto Šťáva authored 6 months ago and Vladimír Čunát committed 6 months ago

Closes #631

datamodel: file permission checks

See merge request !1595

Frantisek Tobias authored 7 months ago and Aleš Mrázek committed 6 months ago

formatting ignored for now since the code that is to be formated will likely be moved elsewhere

Frantisek Tobias authored 7 months ago and Aleš Mrázek committed 6 months ago

datamodel: file permission checks: #814 created function to check that kresd_user() can access the files and directories

Fixes #813

It simplifies a bit.  No need to support ancient versions.

The new pin logging is better than this.  No need to recompile with -DDEBUG (rare).

Frantisek Tobias authored 6 months ago and Vladimír Čunát committed 6 months ago

pin sha256 were used and tested for in incorrect format, refer to: https://www.rfc-editor.org/rfc/rfc7469#section-2.1.5

Minor, but I believe quite important. I stumbled across this while
writing the protocol layer article and thought it was not emphasized
enough in the docs.