From 13cef2ee090ce122e960761e2a26113b6300a722 Mon Sep 17 00:00:00 2001 From: Miek Gieben Date: Mon, 5 Apr 2021 15:45:28 +0200 Subject: plugin/dnssec: use entire RRset as key input (#4537) * plugin/dnssec: use entire RRset as key input This uses the entire rrset as input for the hash key; this is to detect differences in the RRset and generate the correct signature. As this would then lead to unbounded growth, we periodically (every 8h) prune the cache of old entries. In theory we could rely on the random eviction, but it seems nicer to do this in a maintannce loop so that we remove the unused ones. This required adding a Walk function to the plugin/pkg/cache. Signed-off-by: Miek Gieben * Update plugin/dnssec/cache.go Co-authored-by: Chris O'Haver Co-authored-by: Chris O'Haver --- plugin/dnssec/setup.go | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'plugin/dnssec/setup.go') diff --git a/plugin/dnssec/setup.go b/plugin/dnssec/setup.go index d3056dc19..2bf321857 100644 --- a/plugin/dnssec/setup.go +++ b/plugin/dnssec/setup.go @@ -24,6 +24,17 @@ func setup(c *caddy.Controller) error { } ca := cache.New(capacity) + stop := make(chan struct{}) + + c.OnShutdown(func() error { + close(stop) + return nil + }) + c.OnStartup(func() error { + go periodicClean(ca, stop) + return nil + }) + dnsserver.GetConfig(c).AddPlugin(func(next plugin.Handler) plugin.Handler { return New(zones, keys, splitkeys, next, ca) }) -- cgit v1.2.3