Aleš Mrázek authored Aug 22, 2025 and Vladimír Čunát committed Aug 27, 2025

The 4th argument to 'setsockopt' should not be NULL, clang-tidy clang-analyzer-unix.StdCLibraryFunctions error.

Aleš Mrázek authored Aug 22, 2025 and Vladimír Čunát committed Aug 27, 2025

If it is not checked, the clang-tidy clang-analyzer-core::NonNullParamChecker error will be raised.

manager: logging: added NOTICE level

See merge request !1735

For now, only the level has been added, not the logger. To avoid confusion in the mapping, where notice(config) was mapped to warning (python).

- 224: hack compat with python >= 3.11 + libfaketime
- 225: val_nsec3_cnametocnamewctoposwc.rpl: reinstate NS in an answer
  This one finally fixes deckard in CI.

Fixes #934

This will help to keep the /latest docs up to date.

We do not use OBS for version 6.

Release 6.0.15

See merge request !1722

I don't think this can happen on correct records,
due to the way that the root zone is.  But we've seen
this assertion happen in real life, and attackers
might be able to misuse it to cause crashes.

No idea why it's been done in this weird way since forever.

This way it should better match docs for the flag,
and I think it makes a bit more sense now,
at least for the use cases we have in our code now.

Also add NEWS for these two commits.

As a side effect, this solves an issue which could be seen
during resolver startup where the trust anchor update would fail.
[taupd ] active refresh failed for . with rcode: 2

The cause is that for queries started with .flags.NO_CACHE,
we'd skip the section setting .flags.CACHE_TRIED, and consequently
kr_rule_local_data_answer() would get run more often than expected.

The new logic should be also much simpler to follow.
We always apply cache (and policy) just once per kr_query.

In commit c0482d5a this check was added.  Now one can e.g. disable by
> require('ffi').C.the_network.min_udp_source_port = 0
(typically used inside YAML config at /lua/script or /lua/script-file)

Fixes #933

In particular with ACLs this could have prevented resolver starting
even if the permissions were OK.  os.access() should be accurate
at least when running from manager (not from kresctl).