1. 14 Sep, 2018 1 commit
    • Marek Vavruša's avatar
      daemon/worker: fixes error handling from TLS writes · f52231b6
      Marek Vavruša authored
      The error handling loop for uncorking TLS data was wrong, as the
      underlying push function is asynchronous and there's no relationship
      between completed DNS packet writes and number of TLS message writes.
      In case of the asynchronous function, the buffered data must be valid
      until the write is complete, currently this is not guaranteed and
      loading the resolver with pipelined requests results in memory errors:
      
      ```
      $ getdns_query @127.0.0.1#853 -s -a -s -l L -B -F queries -q
      ...
      ==47111==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290040a1253 at pc 0x00010da960d3 bp 0x7ffee2628b30 sp 0x7ffee26282e0
      READ of size 499 at 0x6290040a1253 thread T0
          #0 0x10da960d2 in wrap_write (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x1f0d2)
          #1 0x10d855971 in uv__write (libuv.1.dylib:x86_64+0xf971)
          #2 0x10d85422e in uv__stream_io (libuv.1.dylib:x86_64+0xe22e)
          #3 0x10d85b35a in uv__io_poll (libuv.1.dylib:x86_64+0x1535a)
          #4 0x10d84c644 in uv_run (libuv.1.dylib:x86_64+0x6644)
          #5 0x10d602ddf in main main.c:422
          #6 0x7fff6a28a014 in start (libdyld.dylib:x86_64+0x1014)
      
      0x6290040a1253 is located 83 bytes inside of 16895-byte region [0x6290040a1200,0x6290040a53ff)
      freed by thread T0 here:
          #0 0x10dacdfdd in wrap_free (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56fdd)
          #1 0x10d913c2e in _mbuffer_head_remove_bytes (libgnutls.30.dylib:x86_64+0xbc2e)
          #2 0x10d915080 in _gnutls_io_write_flush (libgnutls.30.dylib:x86_64+0xd080)
          #3 0x10d90ca18 in _gnutls_send_tlen_int (libgnutls.30.dylib:x86_64+0x4a18)
          #4 0x10d90edde in gnutls_record_send2 (libgnutls.30.dylib:x86_64+0x6dde)
          #5 0x10d90f085 in gnutls_record_uncork (libgnutls.30.dylib:x86_64+0x7085)
          #6 0x10d5f6569 in tls_push tls.c:238
          #7 0x10d5e5b2a in qr_task_send worker.c:1002
          #8 0x10d5e2ea6 in qr_task_finalize worker.c:1562
          #9 0x10d5dab99 in qr_task_step worker.c
          #10 0x10d5e12fe in worker_process_tcp worker.c:2410
      ```
      
      The current implementation adds opportunistic uv_try_write which
      either writes the requested data, or returns UV_EAGAIN or an error,
      which then falls back to slower asynchronous write that copies the buffered data.
      
      The function signature is changed from simple write to vectorized write.
      
      This also enables TLS False Start to save 1RTT when possible.
      f52231b6
  2. 17 Aug, 2018 4 commits
  3. 14 Aug, 2018 1 commit
  4. 03 Aug, 2018 1 commit
    • Vladimír Čunát's avatar
      lua cache bindings: error out if cache isn't open yet · b1a16801
      Vladimír Čunát authored
      The catch is that during configuration file processing,
      no cache is open (yet), as kresd can't know if the config
      does open it in some later part (with non-default path or size).
      Now we just throw an error.  Exceptions:
       - cache.open() and cache.backends(), of course :-)
       - cache.ns_tout() - not required, it's not really inside cache
       - cache.close() - it sounds reasonable to allow "closing a closed cache"
      
      This immediately caught a typo in cache metatable.
      b1a16801
  5. 16 Jul, 2018 1 commit
  6. 13 Jun, 2018 3 commits
  7. 06 Jun, 2018 1 commit
  8. 31 May, 2018 1 commit
  9. 09 May, 2018 1 commit
  10. 19 Apr, 2018 1 commit
  11. 18 Apr, 2018 2 commits
  12. 04 Apr, 2018 1 commit
  13. 28 Mar, 2018 1 commit
  14. 13 Feb, 2018 1 commit
  15. 30 Jan, 2018 1 commit
  16. 18 Jan, 2018 2 commits
  17. 12 Jan, 2018 1 commit
  18. 08 Jan, 2018 5 commits
  19. 21 Dec, 2017 2 commits
  20. 08 Dec, 2017 1 commit
  21. 07 Dec, 2017 1 commit
  22. 16 Nov, 2017 1 commit
  23. 14 Nov, 2017 1 commit
  24. 10 Nov, 2017 1 commit
  25. 26 Oct, 2017 1 commit
  26. 12 Oct, 2017 1 commit
  27. 01 Sep, 2017 1 commit
    • Vladimír Čunát's avatar
      cache: rework reusing transactions (LMDB) · e2621d92
      Vladimír Čunát authored
      Previously a read transaction could be held open by each fork
      indefinitely.  That was done for better speed, but it had a downside
      of keeping old pages alive and potentially reading only old data,
      until some writes were attempted by that fork.
      
      Now kr_cache_ provides explicit API for suitable points where to break
      transactions, reusing the _sync command.  On LMDB side the read-only
      transaction is only reset and later renewed, supposedly giving better
      performance than aborting (see LMDB docs on reset+renew).
      
      Performance: preliminary testing with two forks, resperf on comcast
      query-set shows no noticeable difference in peak QPS.
      e2621d92
  28. 22 Aug, 2017 1 commit