Previously, kdig's write_dnstap() function passed net->srv->ai_protocol
as dt_message_fill()'s 'protocol' parameter, but net->srv->ai_protocol
is not actually guaranteed to be the socket protocol used for the
query/response.
When kdig's process_query_packet() retries over TCP, it only sets
net->socktype to SOCK_STREAM in an already initialized net_t and calls
itself. The addrinfo's in the net_t aren't updated, so they have the
original values from the first invocation of process_query_packet(),
i.e., the lookup that occurred over UDP. However, net->socktype is
actually what controls whether TCP or UDP is ultimately used in
net_connect().
Instead of passing net->srv->ai_protocol to dt_message_fill(), map
net->socktype to an IPPROTO_* value. (Which is what kdig does elsewhere
via get_sockname(), which is why the formatted output written to stdout
at the same time, e.g. "127.0.0.1@53(TCP)" doesn't have a similiar bug.)
---
src/utils/kdig/kdig_exec.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/src/utils/kdig/kdig_exec.c b/src/utils/kdig/kdig_exec.c
index b91a958..1f6a64d 100644
--- a/src/utils/kdig/kdig_exec.c
+++ b/src/utils/kdig/kdig_exec.c
@@ -44,6 +44,7 @@ static int write_dnstap(dt_writer_t *writer,
Dnstap__Message msg;
Dnstap__Message__Type msg_type;
int ret;
+ int protocol = 0;
if (writer == NULL) {
return KNOT_EOK;
@@ -54,8 +55,14 @@ static int write_dnstap(dt_writer_t *writer,
msg_type = is_response ? DNSTAP__MESSAGE__TYPE__TOOL_RESPONSE
: DNSTAP__MESSAGE__TYPE__TOOL_QUERY;
+ if (net->socktype == SOCK_DGRAM) {
+ protocol = IPPROTO_UDP;
+ } else if (net->socktype == SOCK_STREAM) {
+ protocol = IPPROTO_TCP;
+ }
+
ret = dt_message_fill(&msg, msg_type, net->local_info->ai_addr,
- net->srv->ai_addr, net->srv->ai_protocol,
+ net->srv->ai_addr, protocol,
wire, wire_len, qtime, rtime);
if (ret != KNOT_EOK) {
return ret;
--
2.1.4
Hello list,
anyone can point me to documentation or manual what is right way to update
slaves. What I want to is when I change record X on master that slaves also
pick that change without me manualy have to do this.
My configuration is OK as on initial zone transfers slaves got data/zones
OK.
I tried
knotc reload
knotc flush
knotc refresh
and restarting knotc service.
On all this there was nothing in syslog and slaves are not updating
ty.
--
Amar Ćosić
amar.cosic(a)gmail.com
amar(a)amar.ba
Hello list,
CZ.NIC Labs just released Knot DNS 1.6.3. This patch release contains a few
rather serious bug fixes and some minor improvements. Update is highly
recommended.
When performing our internal benchmarking, we discovered a serious performance
drop for large NSEC-signed zones (not NSEC3). In construction of NSEC proofs
for NXDOMAIN responses, the server got into a loop possibly causing iteration
over all domain names in the zone. The problem was present in Knot DNS since
the beginning of the project. We are sorry for not noticing this earlier.
The new version also handles TCP short-writes properly. Prior to this fix,
sending a response over TCP could fail if the socket send buffer was small
(e.g., in default configuration on FreeBSD). In addition, if the buffers are
too small, we increase their size on server initialization to make fast-path
processing more likely.
We also fixed possible out-of-bound memory accesses revealed by American Fuzzy
Lop fuzzer. One such an access was in the zone parser (long domain names in
zone origin) and two in the packet parser (TSIG with empty RDATA and malformed
NAPTR).
As for the improvements: The zone parser now supports CDS and CDNSKEY RR
types, the documentation now includes default values for TCP config options,
and more detailed message is emitted when a zone reload fails.
Full changelog:
https://gitlab.labs.nic.cz/labs/knot/blob/v1.6.3/NEWS
Sources:
https://secure.nic.cz/files/knot-dns/knot-1.6.3.tar.xzhttps://secure.nic.cz/files/knot-dns/knot-1.6.3.tar.gz
GPG signatures:
https://secure.nic.cz/files/knot-dns/knot-1.6.3.tar.xz.aschttps://secure.nic.cz/files/knot-dns/knot-1.6.3.tar.gz.asc
Best Regards,
Jan
--
Jan Včelák, Knot DNS
CZ.NIC Labs https://www.knot-dns.cz
--------------------------------------------
Milešovská 5, 130 00 Praha 3, Czech Republic
WWW: https://labs.nic.czhttps://www.nic.cz
