daemon/worker: improved server-side error handling

See merge request !574

daemon/worker: orphaned tasks prevention

See merge request !570

ci: respdiff - run diffrepro 3 times to reproduce results

See merge request !572

distro/arch: generate debug symbols

See merge request !571

Marek Vavruša authored 6 years ago and Vladimír Čunát committed 6 years ago

Some nameservers are hopelessly broken (ns1-ord.salesforce.com),
and will return lame negative answers which will flag the nameserver
as bad, so it wouldn't be picked for valid queries.

Marek Vavruša authored 6 years ago and Vladimír Čunát committed 6 years ago

This is an issue for things like disabling minimisation, which only works
for the original query and not for the CNAME target.

Marek Vavruša authored 6 years ago and Vladimír Čunát committed 6 years ago

Checking query flags instead of global context option allows setting
overrides on individual queries. The effect is the same as query flags
start by copying request flags which start by copying context options.

Marek Vavruša authored 6 years ago and Vladimír Čunát committed 6 years ago

This one was missing from the current bindings. The checkout layer
runs when the worker attempts to send a DNS query to given upstream
when the address is already determined. The layer can add EDNS options
or update outbound query, or block particular addresses / protocol.

Closes #332.

Marek Vavruša authored 7 years ago and Vladimír Čunát committed 6 years ago

This was probably lost during the cache backend rewrite in 2.x

fixes #332

Marek Vavruša authored 7 years ago and Vladimír Čunát committed 6 years ago

Wrapping the error code in a structure preserves both the numeric value
and the ability to convert it into textual format.

Marek Vavruša authored 7 years ago and Vladimír Čunát committed 6 years ago

Previous implementation forgot to clear the compression table, which is
an internal structure to packet. So when a recycled packet was reused,
it compared owners of newly inserted records with dangling pointers left
in the compression table.

This is less of a problem in query processing,
as each packet uses a memory pool, so the pointed names were never deallocated,
but it would write out wrong compression pointers because the compression
table kept pointing into packet that was now cleared and reused for something else.

It is more of a problem with packets created without a memory pool,
as the compression table kept references to memory that was already freed.

Marek Vavruša authored 7 years ago and Vladimír Čunát committed 6 years ago

This is generally useful for parsing records from packet, as they
are broken into individual RRs that need reassembling.

Marek Vavruša authored 7 years ago and Vladimír Čunát committed 6 years ago

This adds metatype wrappers for kr_cache_insert_rr and kr_cache_sync
for the cache metatype, and tests.

Marek Vavruša authored 7 years ago and Vladimír Čunát committed 6 years ago

This updates the metatype to wrap knot_rrset_add_rdata and knot_rrset_init_empty
in a nicer way, and adds automatic GC destructor and tests.

Marek Vavruša authored 7 years ago and Vladimír Čunát committed 6 years ago

Before the API depended on the qry object which only makes sense during
resolution of requests, not when manipulating cache out of it.

This commit abstracts out stash_rrset from stash_rrarray_entry,
and fixes incrementing metrics on actual record insertion.
It then resurfaces kr_cache_insert_rr that was deleted in 2.0
using the extracted function.

vcunat separated stash_rrset_precond() later during rebase.

Closes #334 and #336

- TLS errors were mentioned twice
- the option mode wasn't changed, just a static function name

They didn't work locally for me, at least.

Release 2.3.0

Closes #334 and #336

See merge request knot/knot-resolver-security!3

Vladimír Čunát authored 6 years ago and Petr Špaček committed 6 years ago

Inspired by Marek's MR.

Grigorii Demidov authored 6 years ago and Petr Špaček committed 6 years ago

fixup! 8ea37cc3 daemon/worker: robustness against the slow-lorris attack

Vladimír Čunát authored 6 years ago and Petr Špaček committed 6 years ago

The NULL is never tested, and it was breaking our usual iteration pattern.

Grigorii Demidov authored 6 years ago and Petr Špaček committed 6 years ago

This is an attempt to fix two problems:
1. kresd tries to close incoming TCP connection too early. This may lead
to multiple client reconnections. This problem primarily
affects TCP/TLS clients who send several queries over single TCP connection.

2. In certain circumstances outbound TCP connection doesn't timeout
despite that fact that upstream doesn't send back any answers.
This may lead to timeouts on non-problematic queries.

Handle RRs with non-Internet class and meta-types

Closes #334

See merge request knot/knot-resolver-security!2