Vladimír Čunát authored 8 years ago and Ondřej Surý committed 8 years ago

- docs: fix cache.current_* since long ago d5272b4b
- don't allow "cache.foo = 'bar'" for abitrary foo
- restore cache['nic.cz'] after b31bad2ccf while not breaking completion
- #cache won't work on lua 5.1, so remove it

Ondřej Surý authored 8 years ago and Ondřej Surý committed 8 years ago

trust anchor fixes

Closes #151

See merge request !193

Fixes https://gitlab.labs.nic.cz/knot/resolver/issues/93.
API of a KR_EXPORT function is changed, so ABIVER is bumped.

forks are connected with IPC pipes to process
group leader and can execute expressions on its
behalf. so running commands over all workers
is easy now:

> hostname() -- single
localhost

> map 'hostname()' -- all
localhost
localhost
localhost

* http embeds modified lua-http server code that
  reuses single cqueue for all h2 client sockets,
  this is also because the API in upstream is unstable
* http embeds rickshaw for real-time graphs over
  websockets, it displays latency heatmap by default
  and can show several other metrics
* http shows a world map with pinned recently contacted
  authoritatives, where diameter represents number
  of queries sent and colour its average RTT, so
  you can see where the queries are going
* http now exports several endpoints and websockets:
  /stats for statistics in JSON, and /metrics for
  metrics in Prometheus text format

this change introduces new API for cache backends,
that is a subset of knot_db_api_t from libknot
with several cache-specific operations

major changes are:
* merged 'cachectl' module into 'cache' as it is
  99% default-on and it simplifies things
* not transaction oriented, transactions may be
  reused and cached for higher performance
* scatter/gather API, this is important for
  latency and performance of non-local backends
  like Redis
* faster and reliable cache clearing
* cache-specific operations (prefix scan, ...) in
  the API not hacked in
* simpler code for both backends and caller

the daemon has now three modes of strictness
checking from strict to permissive.
it reflects the tradeoff between resolving the
query in as few steps as possible and security
for insecure zones

policy has policy.todnames() for table of names

fixes #41

i.e. if the user doesn't set the cache, it will be applied later
if he sets it, it will stay

effectively enables/disables usage of given IP protocol
for subrequests (the server can still listen on these)

todo: active refresh

before the cache was disabled by default, but this has led to many user
errors (mine as well). this enables it by default (which is what most
people want anyway)

example:

worker.resolve('cz', kres.type.NS, kres.class.IN, 0,
function (pkt)
	local answer = kres.pkt_t(pkt)
	print (answer:rcode())
end)

config:
trust_anchors.negative = { ‘bad.cz’, ‘here.com’ }

all names below these NTA will not be validated
(unless there is an island of trust below these anchors)

preparations for TA rotation and management
in config:
trust_anchors.file = ‘root.key’
trust_anchors.auto = true // NOTIMPL
trust_anchors.add(‘. IN DS …’) // Manual addition

when the daemon starts in non-interactive mode, it creates a pipe in the ‘tty/<pid>’ which can be used to interact with it remotely - much wow

e.g. $ socat - UNIX-CONNECT:tty/38284

the bindings wrote the keys on completion, so they existed
and __newindex was never called - now current {storage|size}
are saved as cache.current_{storage|size}

this allows list-like declaration of bound interfaces

e.g. net = { ‘127.0.0.1’, net.eth0 }

the cache can be setup declaratively with:

cache.size = 10 * MB

the cache storage backend can be changed with:

cache.storage = ‘lmdb://.'

if the module declares such properties, they can be accessed
by treating module as a table, e.g.

hints[‘localhost’] = ‘127.0.0.1’
hints.hostname = ‘192.168.1.1.
print(hints.localhost)

equals to:
hints.set(‘localhost 127.0.0.1’)
hints.set(‘hostname 192.168.1.1’)
print(hints.get(‘localhost’))