Remi Gacogne [Thu, 14 Jan 2016 11:57:33 +0000 (12:57 +0100)]
dnsdist: Replace the Lua params with a DNSQuestion `dq` object
In order to:
1. Be able to add functions/member without breaking the API
2. Being as compatible as possible with the PowerDNS Lua API
To limit the parsing/copy to a minimum, this DNSQuestion differs
from the PowerDNS one. Most Lua members are properly wrapped,
but it currently lacks some advanced functions like `getRecords()`
or `setRecords()`, that we might add later.
In addition to the existing `tostring()`, this commit adds
`toString()` ones to match the PowerDNS syntax.
LuaWrapper is supposed to support read-only members, where you
only define the getter and no setter, but I can't find the right
syntax for that to work, so for now the setter are present for
read-only members, and just do nothing.
Remi Gacogne [Wed, 13 Jan 2016 16:54:54 +0000 (17:54 +0100)]
dnsdist: Remove remote images in the webserver index
- Remove the github link/image
- Add the powerdns logo to the html directory
- Add handling for PNG files in the webserver
- Edit the CSP policy to only allows local images
- Explicitely asks jQuery not to use JSONP while fetching the stats
Remi Gacogne [Tue, 12 Jan 2016 15:00:36 +0000 (16:00 +0100)]
dnsdist: Add basic CORS support in the webserver
Now that we have removed JSONP support, we need to support
Cross-Origin Resource Sharing (CORS) to allow web pages not served
by our webserver to access our JSON REST API (well, stats).
- Remove the jsonp callback, using simple json data instead (Fixes #3217)
We might need to add CORS if we want to be able to retrieve JSON
data from a webpage not stored on the embedded web server.
- Add several HTTP headers:
* X-Content-Type-Options: no-sniff to prevent browsers from guessing MIME type
* X-Frame-Options: deny to prevent clickjacking
* X-Permitted-Cross-Domain-Policies: none to keep flash from crossing boundaries
* X-XSS-Protection: 1; mode=block to mitigate XSS
* Content-Security-Policy: default-src 'self'; img-src *; style-src 'self' 'unsafe-inline',
a basic CSP policy to restrict which scripts and CSS can be loaded
Remi Gacogne [Mon, 11 Jan 2016 09:45:23 +0000 (10:45 +0100)]
dnsdist: More regression tests cleanups
- Add a timeout on all queue operations
- Give dnsdist more time to start in the DNSCrypt tests, since
the key material has to be generated
- Clear the response counters and the queues before every test
- Add a one-line description for tests, displayed in verbose mode
Remi Gacogne [Fri, 8 Jan 2016 16:04:07 +0000 (17:04 +0100)]
mbed ECDSA: Completely reset the key on from* calls
As noted by @mind04 in #3161, nothing guarantees the signer will
be used for a single task with a single key. This way we make
sure that there is nothing left behind.
In addition, we now consistently use getName() in error messages.
Remi Gacogne [Fri, 8 Jan 2016 08:51:38 +0000 (09:51 +0100)]
dnsdist: Minor fixes reported by coverity
- Handle connection error in client mode
- Prevent FPE in some top* functions when no queries were processed
- Close Downstream FD in the destructor (no that we really care)
bert hubert [Thu, 7 Jan 2016 22:13:43 +0000 (23:13 +0100)]
Introduce TSIGTriple struct, hook up IXFR config in recursor to TSIG code for IXFR
merge the triplet 'tsigname, tsigalgo, tsigsecret' into a handy TSIGTriplet, and move most of the TSIG apis to this struct.
bert hubert [Thu, 7 Jan 2016 13:01:47 +0000 (14:01 +0100)]
turns out we weren't gathering the local address for TCP at all, and for UDP we did not do the work for ipfilter except when bound to 0.0.0.0. Now we do it right in the other case too AND gather the port number.
Remi Gacogne [Thu, 7 Jan 2016 11:55:14 +0000 (12:55 +0100)]
dnsdist: Add a 'source' option to select the source addr/interface
It only supports one source address/interface per downstream server.
The more I tried to support more than one, the more I realized I was
in fact having grouping several DS into one, without the benefits
of separate stats and status checking. In particular, having several
sources adresses mean that we would get "random" failures if some
addresses are allowed on the backend and some others are not.
Simply adding the same backend several times with different source
addresses means that only the ones with faulty addresses will be
disabled.
Closes #3138.
Remi Gacogne [Wed, 6 Jan 2016 09:50:22 +0000 (10:50 +0100)]
dnsdist: Apply the TCP timeout _before_ trying to connect.
In addition to that, we are now more aggressive in stopping
dnsdist to avoid getting stuck. Hopefully we should get more useful
error messages when the tests fail.
Removing usage of the timeout parameter with the same value than
the default for clarity.
projects / pdns / log