Commit graph

12176 commits

Author SHA1 Message Date
Libor Peltan
4c68483be1 bugfix: add changed NSEC3nodes to correct tree 2020-09-30 16:47:38 +02:00
Libor Peltan
406d7018a3 ixfr: split multi-mesage responses to 16kib -- compression 2020-09-18 11:53:18 +02:00
Libor Peltan
91c9df6cda bugfix: zone load: dont start extra chgset if zonefile unupdated 2020-09-17 17:50:39 +02:00
Jan Hak
61f6be8a60 kxdpgun: option for setup network interface 2020-09-17 14:26:31 +02:00
Libor Peltan
473d165497 dnssec: warn if reproducible signing not avail 2020-09-15 17:48:03 +02:00
Daniel Salzman
1696901f15 node: fix some documentation typos 2020-09-14 16:45:35 +02:00
Daniel Salzman
37a86dba2a Merge branch 'libnghttp2_include_fixups' into 'master'
Libnghttp2 include fixups

Closes #690

See merge request knot/knot-dns!1176
2020-09-11 08:14:32 +02:00
Robert Edmonds
c600ae0fa3 src/utils/Makefile.inc: Add $(libnghttp2_CFLAGS) where needed
The header file src/utils/common/https.h includes the external header
file <nghttp2/nghttp2.h> (when nghttp2 support is enabled by the build
system). This header file is included by src/utils/common/netio.h, which can
in turn be included directly or indirectly by various knot components.

The nghttp2 header files are not guaranteed to be located in the compiler's
default include paths. This dependency is detected by the build system
via PKG_CHECK_MODULES, which populates the automake variable
$(libnghttp2_CFLAGS). These extra CFLAGS must be added to the compiler flags
for any targets that include a header file that results in header file
inclusions of the external dependencies. Otherwise the build will fail when
those external header files cannot be located.

This commit adds $(libnghttp2_CLAGS) to the *_CPPFLAGS for kdig, khost, and
knsupdate.

Without the $(libnghttp2_CFLAGS) fixes in this commit, the build will
fail with an error like:

    Making all in src
    make[1]: Entering directory '/tmp/knot-3.0.0/src'
      GEN      contrib/dnstap/dnstap.pb-c.c
      GEN      contrib/dnstap/dnstap.pb-c.h
    NOTE: Compilation of scanner.c can take several minutes!
    make  all-recursive
    make[2]: Entering directory '/tmp/knot-3.0.0/src'
    make[3]: Entering directory '/tmp/knot-3.0.0/src'
      CC       libdnssec/la-tsig.lo
      CC       utils/kdig/khost-kdig_exec.o
      CC       utils/kdig/khost-kdig_params.o
      CC       utils/kdig/kdig-kdig_exec.o
      CC       utils/kdig/kdig-kdig_main.o
      CC       utils/kdig/kdig-kdig_params.o
      CC       utils/common/libknotus_la-cert.lo
      CC       utils/common/libknotus_la-exec.lo
      CC       utils/common/libknotus_la-hex.lo
      CC       utils/common/libknotus_la-https.lo
      CC       utils/common/libknotus_la-lookup.lo
      CC       utils/common/libknotus_la-msg.lo
    In file included from ./utils/common/netio.h:23,
                     from ./utils/common/exec.h:21,
                     from ./utils/kdig/kdig_params.h:22,
                     from ./utils/kdig/kdig_exec.h:19,
                     from utils/kdig/kdig_exec.c:22:
    ./utils/common/https.h:45:10: fatal error: nghttp2/nghttp2.h: No such file or directory
       45 | #include <nghttp2/nghttp2.h>
          |          ^~~~~~~~~~~~~~~~~~~
    compilation terminated.
    In file included from ./utils/common/netio.h:23,
                     from ./utils/common/exec.h:21,
                     from ./utils/kdig/kdig_params.h:22,
                     from utils/kdig/kdig_params.c:23:
    ./utils/common/https.h:45:10: fatal error: nghttp2/nghttp2.h: No such file or directory
       45 | #include <nghttp2/nghttp2.h>
          |          ^~~~~~~~~~~~~~~~~~~
    compilation terminated.
    make[3]: *** [Makefile:5500: utils/kdig/khost-kdig_exec.o] Error 1
    make[3]: *** Waiting for unfinished jobs....
    make[3]: *** [Makefile:5514: utils/kdig/khost-kdig_params.o] Error 1
    In file included from ./utils/common/netio.h:23,
                     from ./utils/common/exec.h:21,
                     from ./utils/kdig/kdig_params.h:22,
                     from utils/kdig/kdig_main.c:20:
    ./utils/common/https.h:45:10: fatal error: nghttp2/nghttp2.h: No such file or directory
       45 | #include <nghttp2/nghttp2.h>
          |          ^~~~~~~~~~~~~~~~~~~
    compilation terminated.
    make[3]: *** [Makefile:5416: utils/kdig/kdig-kdig_main.o] Error 1
    In file included from ./utils/common/netio.h:23,
                     from ./utils/common/exec.h:21,
                     from ./utils/kdig/kdig_params.h:22,
                     from ./utils/kdig/kdig_exec.h:19,
                     from utils/kdig/kdig_exec.c:22:
    ./utils/common/https.h:45:10: fatal error: nghttp2/nghttp2.h: No such file or directory
       45 | #include <nghttp2/nghttp2.h>
          |          ^~~~~~~~~~~~~~~~~~~
    compilation terminated.
    In file included from ./utils/common/netio.h:23,
                     from ./utils/common/exec.h:21,
                     from ./utils/kdig/kdig_params.h:22,
                     from utils/kdig/kdig_params.c:23:
    ./utils/common/https.h:45:10: fatal error: nghttp2/nghttp2.h: No such file or directory
       45 | #include <nghttp2/nghttp2.h>
          |          ^~~~~~~~~~~~~~~~~~~
    compilation terminated.
    make[3]: *** [Makefile:5402: utils/kdig/kdig-kdig_exec.o] Error 1
    make[3]: *** [Makefile:5430: utils/kdig/kdig-kdig_params.o] Error 1
    make[3]: Leaving directory '/tmp/knot-3.0.0/src'
    make[2]: *** [Makefile:5950: all-recursive] Error 1
    make[2]: Leaving directory '/tmp/knot-3.0.0/src'
    make[1]: *** [Makefile:2046: all] Error 2
    make[1]: Leaving directory '/tmp/knot-3.0.0/src'
    make: *** [Makefile:491: all-recursive] Error 1
2020-09-10 10:44:10 +02:00
Daniel Salzman
ff9794e783 kjournalprint: use proper include to avoid compilation issues with gnutls/libnghttp2 headers 2020-09-10 10:40:20 +02:00
Libor Peltan
b47f51d7e0 dnssec validation: dont crash if unsigned zone 2020-09-09 16:12:40 +02:00
Daniel Salzman
8f406b4387 dnssec: don't crash if no policy is configured 2020-09-09 16:05:43 +02:00
Libor Peltan
e009c2007e axfr: split multi-mesage responses to 16kib -- compression 2020-09-09 13:24:27 +02:00
Libor Peltan
7a7c725fc5 libknot: bugfix: dont compress across multi-message response 2020-09-08 13:19:30 +02:00
Libor Peltan
afb616d2ff zone backup: fix restoring expired zone 2020-09-07 10:37:13 +02:00
David Vašek
aead60dbea contrib/sockaddr: abandon __POSIX_VISIBLE define
Forced define of __POSIX_VISIBLE is no longer needed. Default
__POSIX_VISIBLE has been at least 200112 on all supported platforms
for many years. In fact, the default is much higher today.
2020-08-28 16:03:54 +02:00
Daniel Salzman
01cda38a5b doc/conf: unify section items order 2020-08-27 15:31:57 +02:00
Daniel Salzman
93b5c8958c libdnssec: make privkey_export_x509 static 2020-08-27 14:15:27 +02:00
David Vašek
6d35f3ab6c contrib: fix proper Knot build on OpenBSD
Fixes a compatibility bug introduced by a commit named
  "BSD compatibility fixes, not yet fully ported."
more than 9 years ago.
2020-08-27 13:26:50 +02:00
Daniel Salzman
8001170a56 libdnssec: add workaround for missing gnutls_privkey_export_x509() on CentOS 7 2020-08-27 13:24:33 +02:00
Daniel Salzman
f069399564 libknot: reorganize errcodes 2020-08-26 15:02:29 +02:00
Daniel Salzman
21bb3e9e43 backup: fix memory leak (Coverity) 2020-08-26 14:50:54 +02:00
Daniel Salzman
3ee38e67ff backup: tiny code improvements (Coverity) 2020-08-26 14:31:17 +02:00
Daniel Salzman
9c1a499211 backup: check return from mkdir and fix TOETOU (Coverity) 2020-08-26 14:31:17 +02:00
Daniel Salzman
174c4b75ff libdnssec: remove unmaintained API examples 2020-08-26 13:33:34 +02:00
Libor Peltan
bf8df3ddc6 reproducible sign: ED* algorithms are always reproducible 2020-08-26 11:11:19 +02:00
Libor Peltan
03029bcbfe dnssec: enable speedup of rrsig validation by deterministic ECDSA 2020-08-26 11:10:02 +02:00
Libor Peltan
7803589738 dnssec: implemented DSA deterministic signing 2020-08-26 10:48:47 +02:00
Daniel Salzman
34461a037b module: refactor module reset 2020-08-25 21:52:30 +02:00
Daniel Salzman
81f7b1bea8 backup: don't consider global modules, which don't use DNSSEC policy + fixup 2020-08-25 21:52:30 +02:00
Daniel Salzman
67c338ccbc ctl: set failed if backup in progress for some zones 2020-08-25 21:52:30 +02:00
Libor Peltan
28d1952915 backup: reset modules after restore 2020-08-25 21:52:30 +02:00
Libor Peltan
3c25676e6e backup: fix keystore backup if onlinesign 2020-08-25 21:52:30 +02:00
Daniel Salzman
2e28c02512 backup: refactor context handling 2020-08-25 21:52:30 +02:00
Daniel Salzman
b9d1579bc2 libdnssec: rename dnssec_keystore_export() to dnssec_keystore_get_private() 2020-08-25 21:52:30 +02:00
Libor Peltan
7645985606 catalog: log catalog update 2020-08-25 21:52:29 +02:00
Libor Peltan
276106c4d3 backup: implemented catalog database backup 2020-08-25 21:52:29 +02:00
David Vašek
bf693aec50 zone: modified file_overwrite()
Made to match already existing zonefile_write(). First create the file,
then move it to its place.
2020-08-25 21:52:29 +02:00
Daniel Salzman
485f8e1258 ctl: add zone-backup and zone-restore to help 2020-08-25 21:52:29 +02:00
Libor Peltan
cb85a8aa80 implemented zone data backup 2020-08-25 21:52:29 +02:00
Jan Hak
8c83a17d0b mod-onlinesign: refactor array access to mute gcc warning out of bounds access 2020-08-25 19:27:41 +02:00
Daniel Salzman
18bf35bb61 doc: add default policy value to module onlinesign 2020-08-23 20:36:16 +02:00
Daniel Salzman
bb4581c6a9 contents: remove obsolete note at zone_contents_get_nsec3_node() 2020-08-21 12:16:17 +02:00
Libor Peltan
9173bc89e7 dnssec validation: only take signing-threads from config policy 2020-08-21 12:16:17 +02:00
Libor Peltan
b737cee553 dnssec validation: always enable NSEC3 opt-out, but validate its correctness 2020-08-21 12:16:17 +02:00
Libor Peltan
75e9da52e8 dnssec validation: don't require configured policy 2020-08-21 09:30:42 +02:00
David Vašek
b936c6cc51 ctl: define an error code for multi-zone operation failure 2020-08-20 15:39:49 +02:00
David Vašek
a9dd82c289 ctl: allow joint error reporting when taking an action for all zones
Currently used for the "zone-flush" action only.
Note: an error code for this purpose is to be created when reordering error codes in libknot.
2020-08-19 21:13:20 +02:00
David Vašek
cafaf83045 ctl: improve logging of zone-flush errors when outdir is specified 2020-08-19 21:13:20 +02:00
Daniel Salzman
997f0c79fd kxdpgun: make TRANSACTION_ID random but constant per program execution 2020-08-18 20:11:26 +02:00
Daniel Salzman
505ef23844 kzonesign: fix warning about improper printf() formatter 2020-08-17 15:53:01 +02:00
Daniel Salzman
4356bd8da1 kzonesign: fix typo 2020-08-14 12:26:38 +02:00
Daniel Salzman
1e1a972b6c kzonesign: unify program parameters 2020-08-14 09:54:53 +02:00
David Vašek
07c4f3462a utils: properly initialize the time zone for libc functions where needed
The initialization is needed for localtime_r(3) libc function to work reliably on all platforms.
2020-08-14 09:20:46 +02:00
Daniel Salzman
99e99779ee sem check: fix memory leak 2020-08-11 19:25:46 +02:00
Daniel Salzman
7be944b5a0 Merge branch 'kzonecheck_optimize' into 'master'
sem check: skip crypto if keytag mismatch

Closes #688

See merge request knot/knot-dns!1166
2020-08-11 14:41:05 +02:00
Libor Peltan
6566324f8d sem check: skip crypto if keytag mismatch 2020-08-11 14:20:30 +02:00
Libor Peltan
bc0e5b25f1 catalog: add catalog-role option to distinguish 'generate' and 'member' roles in the future 2020-08-11 13:50:34 +02:00
Daniel Salzman
9d471ebb8a kxdpgun: improve traffic summary 2020-08-10 14:00:59 +02:00
Daniel Salzman
32860af546 tcp-handler: set CPU affinity 2020-08-09 18:05:30 +02:00
Daniel Salzman
416493fb44 knotd: add socket BFP filter to TCP sockets 2020-08-09 17:40:38 +02:00
Daniel Salzman
56dce5f162 server: mute Valgrind error "Syscall param socketcall.setsockopt(optval) points to uninitialised byte(s)", code cleanup 2020-08-09 17:40:38 +02:00
Daniel Salzman
8d8d149637 keymgr: update blank configuration to new schema 2020-08-07 21:37:06 +02:00
Daniel Salzman
41048099b6 log: add timezone to timestamp for non-syslog streams 2020-08-07 20:54:59 +02:00
Jan Hak
2277aef1b1 knotd: add socket BFP filter for perfect CPU locality 2020-08-07 20:48:49 +02:00
Daniel Salzman
87e4342138 kzonesign: complete help, tiny code unification 2020-08-07 16:08:58 +02:00
Daniel Salzman
58a3a5ae21 kzonesign: move from sbin to bin 2020-08-06 20:54:16 +02:00
Libor Peltan
b3107054c2 kzonesign: renamed from ksignzone 2020-08-06 20:54:16 +02:00
Libor Peltan
3c1928a5f6 kzonesign: support for fake timestamp 2020-08-06 20:54:16 +02:00
Libor Peltan
401521222e ksignzone implemented 2020-08-06 20:54:16 +02:00
Libor Peltan
de68c49765 kxdpgun: display response data rate 2020-08-05 14:27:20 +02:00
Libor Peltan
984932ff5f kxdpgun: fix units to pps...
...because qps makes no sense for responses
2020-08-05 13:09:09 +02:00
Libor Peltan
240e5a3fbc kxdpgun: renamed from knot-xdp-gun 2020-08-04 18:50:24 +02:00
Daniel Salzman
59d2b2960a dnssec validation: enable junk NSEC3 with...
...same salt, but different iterations count
2020-08-03 16:08:28 +02:00
Daniel Salzman
495fb8ea77 nsec-chain: remove NSEC3PARAM check from bitmap_add_node_rrsets()
The check seems obsolete.
2020-08-03 16:08:28 +02:00
Libor Peltan
3a51170795 dnssec validation: disable AXFR failover if validation failed 2020-08-03 16:08:28 +02:00
Libor Peltan
89b78370d3 bugfix: refresh: proper error code instead of KNOT_EPROCESSING 2020-08-03 16:08:28 +02:00
Libor Peltan
9f53bb6cd5 DNSSEC validation: allow garbage NSEC3 nodes...
...more precisely, if zone has NSEC3 tree, allow any NSEC3 records with different salt
this is useful for checking zones with slow-resalt
2020-08-03 16:08:28 +02:00
Libor Peltan
b8fe253f62 implemented dnssec validation of updates 2020-08-03 16:08:28 +02:00
Libor Peltan
7ad85976ab xdp gun: completely ignore different incomming traffic 2020-07-30 16:33:07 +02:00
Libor Peltan
d643fc7acf xdp-gun: parameter for CPU affinity setting 2020-07-30 14:37:35 +02:00
Libor Peltan
9e53ccb853 xdp gun: use constant trans id to distinguish junk traffic 2020-07-30 09:05:08 +02:00
Daniel Salzman
91110a34b9 xdp-gun: set CPU affinity of threads to first N CPUs 2020-07-28 15:08:58 +02:00
Libor Peltan
90c5d46bfe dnssec: fix setting revoked flag 2020-07-24 12:22:53 +02:00
Libor Peltan
b6c6194209 catalog: fix handling nonexistent catalog config option 2020-07-24 12:22:53 +02:00
Libor Peltan
c35ceb1d6a knotc reload: check for non-loaded zone when replanning after reload 2020-07-24 12:22:53 +02:00
Libor Peltan
42048df575 catalog: bugfix: save to catalog DB even reconf change 2020-07-20 13:32:55 +02:00
Daniel Salzman
46d91a7c53 conf: use static buffer instead of dynamic memory for catalog name 2020-07-19 19:35:30 +02:00
Libor Peltan
975cc4e472 nameserver: don't ignore parsing errors, answer FORMERR
the trick: decreasing 'parsed' throws FORMERR in process_query_out()

the issue: Knot answered NOERROR on query with 2x OPT
2020-07-17 17:15:53 +02:00
Daniel Salzman
76129f8071 Merge branch 'requestor_error_reporting' into 'master'
Requestor and other error reporting, XFR failover logic, document needed file descriptors

See merge request knot/knot-dns!1152
2020-07-17 10:49:48 +02:00
David Vašek
981dd27bb8 refresh: more detailed IXFR-to-AXFR failover logic 2020-07-17 10:29:10 +02:00
Daniel Salzman
9bd6564b21 Merge branch 'ksk_state_revoked' into 'master'
Ksk state revoked

See merge request knot/knot-dns!1153
2020-07-17 10:23:03 +02:00
Libor Peltan
ac8fb6450e DS push: bugfix: cleanup timers after successful push 2020-07-17 10:12:52 +02:00
Libor Peltan
1ad6ddf0d0 dnssec: implemented RFC 5011 KSK revoked state
...only for manual key management
2020-07-17 10:12:52 +02:00
David Vašek
ee351882aa libknot/error: allow to set a default error for knot_map_errno*() function calls
Also, change the default Knot error (for errnos not in the mapping table) from
KNOT_ERROR (-1000) to a new value KNOT_ERRNO_ERROR (-500). The aim is to distinguish
between DNS logic errors and the underlying OS (syscall and library) errors.
2020-07-17 10:08:49 +02:00
David Vašek
8742bb7f1b libknot/error: add support for more system errors 2020-07-17 10:08:49 +02:00
David Vašek
83e07d9262 requestor: report real error when creating and connecting a socket 2020-07-17 10:08:49 +02:00
Daniel Salzman
5f3d563e27 https: mute some warnings about printf argument mismatch 2020-07-16 15:45:22 +02:00
Libor Peltan
2d19b4099c catalog: fixed handling of catDB transactions 2020-07-16 13:06:07 +02:00
Daniel Salzman
36794204c5 keymgr: improve error message from import-bind if a file error
The primary problem is that zs_set_input_file() always returns ZS_FILE_OPEN
for open() error, so it's impossible to distinguish between file name
and permission errors for example.

closes #683
2020-07-15 18:41:17 +02:00
Libor Peltan
9ca1a4e083 keymgr: fake configuration quoting kasp_db path
...this was found when running tests-extra in a loop,
having a hashtag in server path
2020-07-13 20:07:09 +02:00