Updated cookie secrets management

[wtoorop]

This PR is in response to issue #196 (and thus also of interest to @anandb-ripencc )

• The cookie secret file's default location can be set with --with-cookiesecretsfile=path with configure
• The default cookie secrets file is changed to {dbdir}/cookiesecrets.txt
• When no cookie secrets file location is set with the cookie-secret-file option in the config file, and the new default location does not exist, cookie secrets will be read from the previous default location {configdir}/nsd_cookiesecrets.txt
• A staging cookie secret can also be provided in the config file with the cookie-staging-secret option.
• Explicitly configured cookie secrets in config file (with the cookie-secret and cookie-staging-secret option) take precedence over the ones from the cookie secret file
• All values of DNS cookie related settings from config file (answer-cookie, cookie-secret, cookie-staging-secret and cookie-secret-file) will be reevaluated and effectuated after nsd-control reconfig

[wtoorop]

It's ready for review (and merge if accepted). One thing to consider/discuss is that it has one thing that is not backwards compatible, which is that cookie secrets from config file now are preferred over cookies from the cookie secrets file. Before this was the other way around. But, this feels more logical to me as zones in the configuration file are also preferred over zones in the zone list file. I believe there will be a negligible number of people that have cookie secrets in both the config file and in the cookie secrets file and would depend on the earlier preference to pick the secrets file.

[anandb-ripencc]

Looks reasonable to me. I agree that despite the backwards-incompatible change, it is unlikely to affect anyone, because no-one would define cookies in both places.

[wcawijngaards]

The code looks all right. I saw some places where the cookie secrets could possibly be wiped after temporary variables are done being used, maybe that is nice to have.

[k0ekk0ek]

I agree with the changes in general, just some small remarks regarding use of enums and one related to falling back to the previous value.

[k0ekk0ek]

All possibilities are covered, so this is a panic situation(?)

[wtoorop]

I guess yes. Would you prefer a assert here?

[wtoorop]

Would you prefer an assert?

[anandb-ripencc]

I was reviewing the changes to the man pages and documentation, and it needs spelling and syntax fixes. Let me comment on the changes so you can fix them before merging this branch.

[wtoorop]

I was reviewing the changes to the man pages and documentation, and it needs spelling and syntax fixes. Let me comment on the changes so you can fix them before merging this branch.

Thanks! I'm also still addressing the last comment from @k0ekk0ek, which will simplify the code somewhat and also only does the fallback to the old default location for secrets (if there is nothing configured and nothing in the new default location), when nsd just started.

[wtoorop]

I was reviewing the changes to the man pages and documentation, and it needs spelling and syntax fixes. Let me comment on the changes so you can fix them before merging this branch.

@anandb-ripencc I am done with review feedback and will merge once you're finished your spelling corrections.

[anandb-ripencc]

Actually, just merge it. I will then submit a PR to update the documentation. Please don't make a new release before I've submitted documentation fixes.

[k0ekk0ek]

Looks good te me @wtoorop 👍

[wtoorop]

I accidentally committed along changes in simdzone. I'll force push the commit without the simdzone changes, and then merge.