- return SOA in NODATA answers and allow customizing it
- only call ensure_answer() if really generating an answer
  (otherwise we might e.g. deplete XDP buffers, in extreme cases)

Arch Linux now ships knot-resolver in their repositories, delete
reference to AUR.

Thanks to daurnimator who adopted the package!

minor module docs fixes

See merge request !1131

Reported on:
https://gitter.im/CZ-NIC/knot-resolver?at=601ae90e9fa6765ef8f6b408

(and regularize indentation)  Reported on:
https://gitter.im/CZ-NIC/knot-resolver?at=601b36f6aa6a6f319d0235f5

In particular, non-support of EDNS is implied iff FORMERR without OPT
comes.  If OPT is there, one possibility is that there was something
wrong in the OPT that *we* sent, but it seems much more likely that
this particular server is just bad and we want to try another one.
https://tools.ietf.org/html/rfc6891#section-7
In particular, we would be in trouble if we dropped OPT in a zone
that is covered by DNSSEC.

It's now consistent with KNOT_RCODE_FORMERR and the official name
https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6

It wasn't really used for a long time and became completely obsolete after
!1030.

Rework iterate.c/selection.c error handling

Closes #640

See merge request !1126

This way leaves less room for mistakes, etc.  It's just the idea from:
dd0c99bd (comment 191580)

Previously this would pollute the RTT cache with non-sensical
measurements from unsuccessful TCP connects for example.

Module would crash due to the change of `request->upstream`
structure.

Previously the mitigation would stop some longer benign resolutions.
We can safely zero the subquery counter when choose a concrete transport
for the query (i.e. NS name with known IP address).

Lame delegations are weird, they breed more lame delegations on broken
zones since trying another server from the same set usualy doesn't help.
We force resolution of another NS name in hope of getting somewhere.

Previously a 12B reply with FORMERR would be treated as malformed
creating a need for a workaround (switching off EDNS for every malformed
answer).

Instead copy it from the request's options.

Reasoning: Minimization might have been turned off as a workaround for
broken authoritative servers which doesn't support it. There is no
reason to drop minimization when switching zones when following a CNAME.

When cancelling a query due to NSNXAttack mitigation when validator was
also in BOGUS state, records wouldn't be stripped from the answer.

These will become useful once we actually use it…

Previously there where resolve_badmsg and resolve_error functions used
to apply workarounds. This is now moved to selection.c and iterate.c
just provides feedback using the server selection API. Errors are now
handled centrally in selection.c:error.

ci lint:scan-build: work around changes in meson

See merge request !1127

In 1f7678ea meson was updated and that broke our scan-build.
Now we work around that.  Quick analysis of why:
https://github.com/mesonbuild/meson/pull/5918#issuecomment-762064902

dnstap tests: integrate into meson, CI, etc.

See merge request !1123

+ it's more efficient to schedule longer tests before shorter tests
- we get a warning (if meson is new enough to use priorities)

Priority numbers: I took the config tests as baseline.
I didn't touch tests with "is_parallel: false".

They need one go package which I can't find even in Debian,
so it probably can't work without network access.
The new dnstap in extra_tests runs if dnstap is built and go is found.
It also tries to keep the source tree clean.

Now both query and reply messages are tested.

In CI (after caching go deps in image) this tests only takes slightly
more time than the longest config.* tests, so that seems OK.
Even so, it's not added into the valgrind variant, as compilation
of the test still isn't split away from the run itself.

From distro packages, just libprotobuf-c-dev and golang-any are new,
but I also broke the overlong line and reorganized its contents a bit.

add dnstap subpackage

Closes #655

See merge request !1118

Jakub Ružička authored 4 years ago and Tomas Krizek committed 4 years ago

introduce new dependencies:

* libfstrm
* libprotobuf-c

SUSE is missing protoc-c compiler so don't build dnstap there.

Jakub Ružička authored 4 years ago and Tomas Krizek committed 4 years ago

introduce new dependencies:

* libfstrm
* libprotobuf-c

Jakub Ružička authored 4 years ago and Tomas Krizek committed 4 years ago

This is a relic of ancient times.

selection: return early from forward_choose_transport with asserts off

See merge request !1125

This lead to unintitialized values being possibly used down the line.