Commit Graph
114 Commits
Author SHA1 Message Date
Yorgos ThessalonikefsandGitHub 2e398d51ba Fix cache update when serve expired is used (#1143)
- Fix cache update when serve expired is used in order to not evict
  still usable expired records. Modules are forbidden to update the
  cache if their answer is DNSSEC unchecked or bogus and a valid
  (expired) entry already exists. Bogus replies from the validator are
  also discarded in favor of existing (expired) valid replies.

- serve-expired-ttl-reset should try to keep expired records in the
  cache in case they are reset.
2024-09-24 16:47:04 +02:00
W.C.A. Wijngaards 6b37309705 - Fix #1130: Loads of logs: "validation failure: key for validation
<domain>. is marked as invalid because of a previous" for
  non-DNSSEC signed zone.
2024-08-27 17:00:27 +02:00
W.C.A. Wijngaards a335e601e4 ipset-pf-support, move startup and destartup to the front of the module
func block functions, modstack call deinit function names, and detect
module change when no startup functions are needed.
2024-07-03 13:53:44 +02:00
W.C.A. Wijngaards ff653a7ef8 Call module init init again, and new function startup and destartup.
NULL can be used if the function is not used. Open shared ports during
reload. Deinit is called during reload.
2024-07-01 16:10:07 +02:00
W.C.A. Wijngaards 3953f827fb Merge branch 'master' of https://github.com/madroach/unbound into ipset-pf-support 2024-07-01 14:36:33 +02:00
W.C.A. Wijngaards 1974732d19 - Fix typos for 'the the' in text. 2024-06-06 09:35:57 +02:00
W.C.A. Wijngaards 9abed3fc83 - Fix doxygen comment for errinf_to_str_bogus. 2024-04-29 13:42:26 +02:00
Yorgos Thessalonikefs 63a6b7b255 - Cleanup unnecessary strdup calls for EDE strings. 2024-04-29 10:15:19 +02:00
W.C.A. Wijngaards 7c5e765b3b - Fix cachedb with serve-expired-client-timeout disabled. The edns
subnet module deletes global cache and cachedb cache when it
  stores a result, and serve-expired is enabled, so that the global
  reply, that is older than the ecs reply, does not return after
  the ecs reply expires.
2024-04-26 13:32:15 +02:00
Wouter WijngaardsandGitHub ced9762b14 Merge pull request #1041 from NLnetLabs/stubfwd-unshare
Stub and Forward unshare
2024-04-25 11:11:00 +02:00
W.C.A. Wijngaards cccf5e73c0 - Fixup compile without cachedb. 2024-04-10 11:33:52 +02:00
W.C.A. Wijngaards f3f85e5a11 - Fixup compile without cachedb. 2024-04-10 11:29:10 +02:00
W.C.A. Wijngaards d98c7b9ae3 - Implement cachedb-check-when-serve-expired: yes option, default
is enabled. When serve expired is enabled with cachedb, it first
  checks cachedb before serving the expired response.
2024-04-10 11:21:28 +02:00
W.C.A. Wijngaards 48113cfaba - fast-reload, unshared stub hints, making the structure locked, with an rwlock. 2024-04-03 13:55:57 +02:00
W.C.A. Wijngaards f2fb498c69 - fast-reload, unshare forwards, making the structure locked, with an rwlock. 2024-04-03 13:55:54 +02:00
W.C.A. Wijngaards bd5dc855af - Fix rpz tcp-only action with rpz triggers nsdname and nsip. 2023-09-18 09:55:39 +02:00
W.C.A. Wijngaards fdd5f8ff83 - Fix to add EDE text when RRs have been removed due to length. 2023-09-07 14:44:48 +02:00
George Thessalonikefs 6487d6febe - For #759: fix doc string. 2023-07-30 11:43:06 +02:00
George Thessalonikefs 4f52be4db9 - Introduce num.query.cachedb to track cache hits for the external cache. 2023-05-30 17:49:50 +02:00
Philip Homburg 71e0ddc94a Improved comment 2023-02-21 09:27:03 +01:00
Philip Homburg d1f5ded1d9 ifdef CLIENT_SUBNET 2023-02-21 09:21:24 +01:00
Philip Homburg fb06364014 Fix issue #825: interaction between ECS and serve-expired. 2023-02-21 09:20:28 +01:00
W.C.A. Wijngaards f6753a0f10 - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. 2022-08-01 13:24:40 +02:00
tcarpayandGitHub 0ce36e8289 Add the basic EDE (RFC8914) cases (#604) 2022-05-06 12:48:53 +02:00
W.C.A. Wijngaards 2b90181d3a - Fix #628: A rpz-passthru action is not ending RPZ zone processing. 2022-02-15 16:20:12 +01:00
George Thessalonikefs f857af873e - Update ratelimit code for recent serviced_query changes and more
accurate ratelimit calculation.
2022-01-29 23:49:38 +01:00
Dimitris Apostolou c21d6af617 Fix typos 2021-11-13 16:56:15 +02:00
Tomasz Ziolkowski ae45f46b9e Add (stub|forward)-tcp-upstream options which enable using tcp transport only for specified stub/forward zones 2021-08-05 08:44:18 +02:00
Christopher Zimmermann 1d23e0c920 Merge remote-tracking branch 'upstream/master' 2021-02-03 13:19:19 +01:00
W.C.A. Wijngaards ee2545d939 - For #391: fix indentation. 2021-01-08 09:53:52 +01:00
W.C.A. Wijngaards 3e03e2c26d - For #391: use struct timeval* start_time for callback information. 2021-01-08 09:47:46 +01:00
Frank Riley e3abd772f7 Add start_time to reply callbacks so modules can compute the response time. 2021-01-01 15:44:21 -07:00
Ralph Dolmans eb799026ff Replace edns-client-tag with edns-client-string option 2020-09-30 23:17:53 +02:00
Ralph Dolmans 70c8d09edd - Process EDNS client tag review feedback 2020-08-05 15:56:45 +02:00
Ralph Dolmans 16029281a8 Start of EDNS client tags implementation. 2020-07-23 17:17:44 +02:00
Christopher Zimmermann c96e4ca121 allow privileged initialisation of modules 2020-05-10 22:30:25 +02:00
gthessandGitHub f7fe95ad7b Serve stale (#159)
- Added serve-stale functionality as described in
  draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used
  to configure the behavior.
- Updated cachedb to honor `serve-expired-ttl`; Fixes #107.
- Renamed statistic `num.zero_ttl` to `num.expired` as expired replies
  come with a configurable TTL value (`serve-expired-reply-ttl`).
- Fixed stats when replying with cached, cname-aliased records.
- Added missing default values for redis cachedb backend.
2020-02-05 14:20:27 +01:00
George Thessalonikefs 0171d06aa2 - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This
gives access to reply information for the client's communication
  point when the callback is called before the mesh state (modules).
  Changes to C and Python's inplace_callback signatures were also
  necessary.


git-svn-id: file:///svn/unbound/trunk@4870 be551aaa-1e26-0410-a405-d3ace91eadb9
2018-08-22 10:51:13 +00:00
George Thessalonikefs 749d1b9ebc - Expose if a query (or a subquery) was ratelimited (not src IP
ratelimiting) to libunbound under 'ub_result.was_ratelimited'.
  This also introduces a change to 'ub_event_callback_type' in
  libunbound/unbound-event.h.
- Tidy pylib tests.


git-svn-id: file:///svn/unbound/trunk@4828 be551aaa-1e26-0410-a405-d3ace91eadb9
2018-08-03 14:00:46 +00:00
Wouter Wijngaards 9d28279475 - Can set tls authentication with forward-addr: IP#tls.auth.name
And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem".


git-svn-id: file:///svn/unbound/trunk@4631 be551aaa-1e26-0410-a405-d3ace91eadb9
2018-04-19 12:10:05 +00:00
Wouter Wijngaards 6f88df1fc8 authzone work.
git-svn-id: file:///svn/unbound/trunk@4380 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-10-19 15:11:20 +00:00
Wouter Wijngaards bdb6a5501a - authzone work, probe timer setup.
git-svn-id: file:///svn/unbound/trunk@4378 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-10-19 09:03:36 +00:00
Wouter Wijngaards 55d8fe2837 - use a cachedb answer even if it's "expired" when serve-expired is yes
(patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes


git-svn-id: file:///svn/unbound/trunk@4353 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-09-19 09:08:29 +00:00
Wouter Wijngaards 7d17a926ac - Spelling fixes, from Phil Porada.
git-svn-id: file:///svn/unbound/trunk@4344 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-09-15 14:29:28 +00:00
Ralph Dolmans 657948dd0c - Added mesh_add_sub to add detached mesh entries.
- Use mesh_add_sub for key tag signaling queries.


git-svn-id: file:///svn/unbound/trunk@4144 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-05-02 13:17:56 +00:00
Ralph Dolmans a5c7c469ee - Remove ECS option after REFUSED answer
- Fix small memory leak in edns_opt_copy_alloc



git-svn-id: file:///svn/unbound/trunk@4100 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-04-10 09:12:04 +00:00
Ralph Dolmans ae31233b19 - remove malloc from inplace_cb_register
git-svn-id: file:///svn/unbound/trunk@4095 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-04-06 13:41:49 +00:00
Ralph Dolmans a2bc93547f - Generalise inplace callback (de)registration
- (de)register inplace callbacks for module id
- No unbound-control set_option for ECS options
- Deprecated client-subnet-opcode config option
- Introduced client-subnet-always-forward config option
- Changed max-client-subnet-ipv6 default to 56 (as in RFC)
- Removed extern ECS config options
- module_restart_next now calls clear on all following modules
- Also create ECS module qstate on module_event_pass event


git-svn-id: file:///svn/unbound/trunk@4092 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-04-06 13:13:06 +00:00
Ralph Dolmans b0fd814975 - Merge EDNS Client subnet implementation from feature branch into main branch,
using new EDNS processing framework.


git-svn-id: file:///svn/unbound/trunk@4074 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-03-21 12:08:17 +00:00
Wouter Wijngaards cae9809e11 - Response actions based on IP address from Jinmei Tatuya (Infoblox).
git-svn-id: file:///svn/unbound/trunk@4035 be551aaa-1e26-0410-a405-d3ace91eadb9
2017-03-07 14:58:51 +00:00