This makes git diff --word-diff easier to read.

Function originally called kr_cache_sync() was in fact responsible
for calling mdb_txn_commit() and not mdb_env_sync() which was confusing.

Cache cleaning needs to be done using separate mechanism
because cleaning it from worker process does not fit well into our
processing model. It is going to be a separate daemon.

... by setting FILE* properties and replace the explicit flushes.
Explicit flushing couldn't be well done e.g. for lua's error() function.
In particular, we had problems with journald not getting logs timely.

modules/policy.RPZ: log libzonefile errors as well

See merge request !780

lua event.socket(): remove a hacky workaround

See merge request !778

It should be fixed in quite old libuv versions already:
https://github.com/libuv/libuv/issues/883

Add ca-certificates to runtime on Dockerfile

See merge request !779

Splitting port from IP address

See merge request !776

and deduplicate the parsing logic.

After 83539eb7 it was a bit complicated.  It allowed to save a memcpy
of the address in case no port was specified, but we only need to do the
split when changing configuration, so it was overzealous optimization.

policy.TLS_FORWARD: send SNI on wire if configured

See merge request !762

Vladimír Čunát authored 6 years ago and Petr Špaček committed 6 years ago

It's mainly about the way we parse and validate them.

Almost all of the parts of validation that were being done
in modules/policy/policy.lua and daemon/tls.c got moved
to daemon/bindings/net.c, so it's easier to follow that.
Also more checks are being done now, e.g. contents of .pin_sha256
and .hostname strings.

Vladimír Čunát authored 6 years ago and Petr Špaček committed 6 years ago

In https world it's standard to do that, and it's relied on.
Real-life example: 8.8.8.8#853 over TLSv1.3 won't send a certificate
if we don't send SNI (no idea why; also they do send it with TLSv1.2).

As a consequence, we no longer allow multiple hostnames per
address-port tuple, but that didn't seem useful.

Tomas Krizek authored 6 years ago and Vladimír Čunát committed 6 years ago

Make sure gcc doesn't produce unused func/var warnings when using
optional compilation. This fixes three such issues on CentOS 7.

doc/flowcharts: use underscores instead of spaces in filename

See merge request !772

doc: attempt on documenting of some kresd algorithms

See merge request !731