Lukas Jezek authored 5 years ago and Petr Špaček committed 5 years ago

Directory with subdirectory "packaging" is called "component".

List all components: python3 tests/packaging-doc.py --list
Run all tests/compoments: python3 tests/packaging-doc.py
Run specific test/component: python3 tests/packaging-doc.py --test <component>

The file structure for 1 component:
	daemon - dependencies for 1 component "kresd daemon" (default component, must always be there)
	scripts/distros - dependencies for 1 component for specific distro (must always be there)
	scripts/dockerfile_gen.py - test Dockerfile generator, see below
	tests/packaging.py - script to generate and build all combinations
	                     of Docker files for all components
	[component] - directory of component/test, see below
		      (e.g. "client/packaging/", "modules/http/packaging/" etc.)

The file structure of each component:
[component]
	<distro>/<version> - package names
		- builddeps - list of build depedencies
		- rundeps - list of runtime depedencies
		- pre-build.sh - script called before build phase
		- post-build.sh - script called after build phase
		- pre-run.sh - script called before run phase
		- post-run.sh - script called after run phase
		- install.sh and build.sh script called during build phase
	test.config or test.sh - kresd config test or shell script
note: content of "scripts/distroos" is same as "<distro>/<version>" of component.

There are "build" and "run" phases. "build" phase precedes "run" phase.
All script are called in this order:
	1. pre-<phase>.sh
	2. install packages specifed in the file "<phase>deps"
	3a. for "build" phase: run build.sh and install.sh
	3b. for "run" phase: run 'kresd -c [component]/test.config' or config.sh
	4. remove packages specified in the file "<phase>deps"
	5. post-<phase>.sh

Each step above is combines base components with a component under test.
E.g. component "scripts/distros" always precedes component "daemon/packaging"
and it precedes the tested component e.g. "modules/http".

In long term we might migrate this to py.test or some other well known
framework.

It might detect some use-after-free cases even without ASAN.

I must admit I don't really understand why we had a rare case
of use-after-free in the sendmmsg call, but this change should avoid
that without affecting anything else.

Vladimír Čunát authored 5 years ago and Petr Špaček committed 5 years ago

This shouldn't change the operation in any way, it's just nicer.

Vladimír Čunát authored 5 years ago and Petr Špaček committed 5 years ago

Calling this on every incoming UDP request could cost us up to 5% time.

The watchdog module now can be loaded without systemd, has customisable
callbacks, and can do real DNS queries and check their results.

I'm really sorry; I didn't notice and it only hit parts that
*apparently* aren't tested normally.  Only 32-bit systems would be
affected, due to the structure only changing ABI on 32-bit systems.

Refusing to answer queries without RD bit makes it harder
to read what data is present in resolver's cache.

Somehow I didn't notice this field when adding ::add_selected.
We probably never put anything into answer's ADDITIONAL,
so noone's noticed a problem until now.

Tomas Krizek authored 5 years ago and Vladimír Čunát committed 5 years ago

The code incorrectly assumes GNUTLS_E_AGAIN can only be caused
by reading the entire libuv buffer. Legitime causes of GNUTLS_E_AGAIN
wouldn't be processed correctly. These could be caused by a new
session ticket sent by the server.

Fixes #489

Vladimír Čunát authored 5 years ago and Petr Špaček committed 5 years ago

- don't print a line in every checking cycle
- don't exit when cache isn't found
- reduce recommended interval to 10s (compromise)
- don't increase cache size (but keep the code for now)

This reverts commit c3a754dd, reversing
changes made to 06d01bf0.

I've have accidentally merged incorrect branch, let's try to fix that by
reverting incorrect version of GC and merging the correct one.

Vladimír Čunát authored 5 years ago and Petr Špaček committed 5 years ago

Don't stash a packet with mismatching QNAME+QTYPE.
When receiving an NXDOMAIN or NODATA packet in an insecure zone,
it would get cached with KR_RANK_INSECURE regardless of mismatch
in QNAME.  If the 0x20 pattern was preserved in the fake QNAME,
such packet would then be used to answer queries with matching QNAME,
even if there's no proof that this QNAME is insecure.

Also the log now uses the same format query UID format as elsewhere.

name of SOA record must be "."

Fixes: #474

Vladimír Čunát authored 5 years ago and Petr Špaček committed 5 years ago

- don't print a line in every checking cycle
- don't exit when cache isn't found
- reduce recommended interval to 10s (compromise)
- don't increase cache size (but keep the code for now)

Petr Špaček authored 5 years ago and Vladimír Čunát committed 5 years ago

Regression in 19ef77d1 (unreleased): Default value IN for qclass
parameter was missing.  Also consistently use A as default for qtype.

Thanks to changes in this branch the functions are called with correctly
typed parameters already, so these weird casts can be deleted.