Needed for followup commits.  The trie_* names aren't ideal for global
namespace, but ATM I can't see a better way.

Well, we could e.g require C11 instead of C99, but this one is easy.

(Don't use them anywhere yet.)

fixed validation of root DS

See merge request !544

Vladimír Čunát authored 6 years ago and Petr Špaček committed 6 years ago

... after the parent commit. Perhaps it can't cause trouble,
but I'll feel safer this way.

Marek Vavruša authored 6 years ago and Petr Špaček committed 6 years ago

The root DS exists outside of DNS hierarchy, so its NSEC proving non-existence
always contains the SOA, as that's the root of DNS and there's nothing above it.

Always create a endpoint in network_listen_fd

See merge request !523

Vicky Shrestha authored 7 years ago and Petr Špaček committed 6 years ago

There is no need to check for unique addr+port for FDs passed
by a supervisor process like systemd.

Packaging improvements

Closes #323

See merge request !540

Closes #323

Aho corasick update

See merge request !548

This continues work done in !547 by respecting sensible build patterns
across a submodule.

Daniel Kahn Gillmor authored 6 years ago and Vladimír Čunát committed 6 years ago

CPPFLAGS is a traditional build environment variable used to set C
pre-processor flags.  Accept these flags during the build if they've
been set.

iterate: update zone cut when NS is authoritative for both parent and child

See merge request !543

In some cases the NS is authoritative for both parent and the child side of
the delegation (e.g. nrl.navy.mil). When it gets the query for such NS,
it can respond from the child side with an NS record in the answer and AA=1.
The resolver should update the zone cut accordingly, otherwise it would fail
validation in cases when the child-side of the delegation is insecure,
but parent side  of the delegation is secure, because the child side
would respond without DNSSEC records, and it wouldn't indicate that
the zone cut needs updating (when using minimal answers) (e.g. www.nrl.navy.mil).

lib/resolve: cut fetching: don't use root hints if no keys fetched, but glue addresses found

See merge request knot/knot-resolver!513

Nitpicks

See merge request knot/knot-resolver!537

Vladimír Čunát authored 6 years ago and Petr Špaček committed 6 years ago

- clickable module references
- clickable RFC references via :rfc:`NNN#anchor`

Vladimír Čunát authored 6 years ago and Petr Špaček committed 6 years ago

and make docs conform to the reality.

validator: fix CNAME to NXDOMAIN in a single answer

See merge request !538

Real example: cname.nohats.ca
This case was handled for forwarding only, presumably because it
happened more often (no need to be withing single zone to be within
single answer); now the approach is the same.

Release 2.2.0

See merge request !535