In particular, redirection from a file was leading to abort(),
so we provide an error message instead.

fix some inconsistencies in tcp connection error handling; forwarding - avoid attempts to communicate with timeouted upstream.

See merge request !716

daemon/session: session_close() alwayes delete peers addresses from the list of estblished TCP connections even if underlying transport is UDP; fixed

Vladimír Čunát authored 6 years ago and Grigorii Demidov committed 6 years ago

Reduce copy&paste.

docs: TLS server config clarification

See merge request !718

Experimental DNS-over-TLS to auth module

See merge request !711

chantra authored 6 years ago and Petr Špaček committed 6 years ago

This modules allows knot-resolver to discover authoritative servers SPKI
digest by leveraging magic NS target names ala DNSCurve.

Marek Vavruša authored 6 years ago and Petr Špaček committed 6 years ago

This commit allows opportunistic DNS over TLS to origins configured
as supporting DoT on port 853. It also adds interface for clearing
configured TLS clients to allow runtime reconfiguration.

The general mode of operation is as follows:

1. Produce a new outgoing query
2. Check if the selected upstream address has configured TLS support on port 853
 2a. If it does: upgrade to DNS over TLS, it cannot be downgraded from this point
 2b. If not: continue with preferred protocol

This allows further automatic discovery as in [1], but right now it has to be configured
manually.

[1]: https://tools.ietf.org/id/draft-bortzmeyer-dprive-resolver-to-auth-00.html

(cherrypicked from cloudflare branch, need to be adapted)

transport tests

See merge request !707