Josh Soref authored 3 years ago and Tomas Krizek committed 3 years ago

Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>

Vladimír Čunát authored 3 years ago and Tomas Krizek committed 3 years ago

Issues affecting functionality of the RPZ should NOT be hidden
by default.

Vladimír Čunát authored 3 years ago and Tomas Krizek committed 3 years ago

Partly to document changes from recent changes,
partly to fix long-lasting issues in the descriptions.
Hopefully it will be easier to understand now.

Vladimír Čunát authored 3 years ago and Tomas Krizek committed 3 years ago

The logs can be triggered from policy actions, in per-request fashion:
- they're on LOG_DEBUG level but always sent, regardless of log config
- those messages will show double group tags: "[reqdbg][foo   ]"
  (but they lack proper meta-data - about location of the log's origin)
- reqdbg is *in addition* to normal logs, so the lines may be duplicated
  if that's how the logging was configured

Using a single function to get/set values is more consistent with our
existing lua API rather than having two separate set and get functions.

Vladimír Čunát authored 3 years ago and Tomas Krizek committed 3 years ago

It's mainly in tests.

Vladimír Čunát authored 3 years ago and Štěpán Balážik committed 3 years ago

The requests get traced even without verbose logging.
I expect it was a copy&paste mistake from QTRACE docs.

Vladimír Čunát authored 3 years ago and Štěpán Balážik committed 3 years ago

Perhaps this bug was now more pronounced since 5.3.0 changes.
Example problem was disabling minimization or 0x20 (globally or
for some problematic requests); without this change they would get
re-enabled during some fallback actions... which might be exactly
the wrong moment wrt. the motivation to setting these.
https://gitter.im/CZ-NIC/knot-resolver?at=60a221e86a950f3d46ed1cd9

Regressed in acd019db.  The intention was clearly to say that
encryption (i.e. DNS-over-TLS) is not supported.

- return SOA in NODATA answers and allow customizing it
- only call ensure_answer() if really generating an answer
  (otherwise we might e.g. deplete XDP buffers, in extreme cases)

Štěpán Balážik authored 5 years ago and Vladimír Čunát committed 4 years ago

Design discussion: #447
Code discussion: !1030

:func: directive automatically always adds brackets. This results in
links such as "policy.PASS()", which can be confusing, since the actual
policy is supposed to be "policy.PASS".

Using :any: results in links without the added brackets, which makes
non-function policies less confusing.

This amends commit 99e014ac.

For now I was too afraid to use "multi-flag" kr_request::state,
so I kept it at _FAIL; anyone can recognize it by NULL answer anyway.

Lua wrapper: using exception was considered but didn't seem good.
I utilized the fact that modules can return nil meaning no state change.

FIXME: see FIXMEs in diff, document the API change, re-review.

Vladimír Čunát authored 4 years ago and Petr Špaček committed 4 years ago

It's deprecated since 5.0.0.

Also allow using empty set as an alternative to NODATA pseudo-RCODE,
and migrate RPZ tests to this merged function.

... by allowing .rdata to be a table.  Larger RRsets seem useful.

- use parser-detected $ORIGIN instead of looking at SOA owner
- skip records outside $ORIGIN (and warn) instead of nesting them
- simplify a bit, and tweak warnings

Also utilize table indexing.
This was a "regression" from extending RPZ support in 5.1.0.
NS and SOA are even mandatory, as RPZ is supposed to be a valid zone:
https://tools.ietf.org/html/draft-ietf-dnsop-dns-rpz-00#section-2