637b374d8b
Numa becomes a true DNS resolver — resolves from root nameservers with complete DNSSEC chain-of-trust verification. Recursive resolution: - Iterative RFC 1034 from configurable root hints (13 default) - CNAME chasing (depth 8), referral following (depth 10) - A+AAAA glue extraction, IPv6 nameserver support - TLD priming: NS + DS + DNSKEY for 34 gTLDs + EU ccTLDs - Config: mode = "recursive" in [upstream], root_hints, prime_tlds DNSSEC (all 4 phases): - EDNS0 OPT pseudo-record (DO bit, 1232 payload per DNS Flag Day 2020) - DNSKEY, DS, RRSIG, NSEC, NSEC3 record types with wire read/write - Signature verification via ring: RSA/SHA-256, ECDSA P-256, Ed25519 - Chain-of-trust: zone DNSKEY → parent DS → root KSK (key tag 20326) - DNSKEY RRset self-signature verification (RRSIG(DNSKEY) by KSK) - RRSIG expiration/inception time validation - NSEC: NXDOMAIN gap proofs, NODATA type absence, wildcard denial - NSEC3: SHA-1 iterated hashing, closest encloser proof, hash range - Authority RRSIG verification for denial proofs - Config: [dnssec] enabled/strict (default false, opt-in) - AD bit on Secure, SERVFAIL on Bogus+strict - DnssecStatus cached per entry, ValidationStats logging Performance: - TLD chain pre-warmed on startup (root DNSKEY + TLD DS/DNSKEY) - Referral DS piggybacking from authority sections - DNSKEY prefetch before validation loop - Cold-cache validation: ~1 DNSKEY fetch (down from 5) - Benchmarks: RSA 10.9µs, ECDSA 174ns, DS verify 257ns Also: - write_qname fix for root domain "." (was producing malformed queries) - write_record_header() dedup, write_bytes() bulk writes - DnsRecord::domain() + query_type() accessors - UpstreamMode enum, DEFAULT_EDNS_PAYLOAD const - Real glue TTL (was hardcoded 3600) - DNSSEC restricted to recursive mode only Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
47 lines
982 B
Makefile
47 lines
982 B
Makefile
.PHONY: all build lint fmt check audit test bench clean deploy blog
|
|
|
|
all: lint build test
|
|
|
|
build:
|
|
cargo build
|
|
|
|
lint: fmt check audit
|
|
|
|
fmt:
|
|
cargo fmt --check
|
|
|
|
check:
|
|
cargo clippy -- -D warnings
|
|
|
|
audit:
|
|
cargo audit
|
|
|
|
test:
|
|
cargo test
|
|
|
|
bench:
|
|
cargo bench
|
|
|
|
blog:
|
|
@mkdir -p site/blog
|
|
@for f in blog/*.md; do \
|
|
name=$$(basename "$$f" .md); \
|
|
pandoc "$$f" --template=site/blog-template.html -o "site/blog/$$name.html"; \
|
|
echo " $$f → site/blog/$$name.html"; \
|
|
done
|
|
|
|
clean:
|
|
cargo clean
|
|
|
|
deploy:
|
|
cargo build --release
|
|
sudo cp target/release/numa /usr/local/bin/numa
|
|
ifeq ($(shell uname -s),Darwin)
|
|
sudo codesign -f -s - /usr/local/bin/numa
|
|
sudo kill $$(pgrep -f /usr/local/bin/numa) 2>/dev/null || true
|
|
else
|
|
sudo systemctl restart numa 2>/dev/null || sudo kill $$(pgrep -f /usr/local/bin/numa) 2>/dev/null || true
|
|
endif
|
|
@sleep 1
|
|
@dig @127.0.0.1 google.com +short +time=3 > /dev/null && echo "Service restarted successfully" || echo "Warning: DNS not responding yet"
|