1015 Commits

Author	SHA1	Message	Date
Simon Kelley	a857daa351	Code cleanup.	2014-02-24 21:01:09 +00:00
Simon Kelley	f01d7be6c6	An NSEC record cannot attest to its own non-existance!	2014-02-24 20:20:00 +00:00
Simon Kelley	d387380a25	Check signer name in RRSIGs.	2014-02-23 16:20:46 +00:00
Simon Kelley	f2e4c277c4	Bugfix for last commit.	2014-02-23 15:24:26 +00:00
Simon Kelley	5107ace14a	NSEC3 validation. First pass.	2014-02-23 10:48:32 +00:00
Simon Kelley	7b1eae4f50	Add --servers-file option.	2014-02-20 13:43:28 +00:00
Simon Kelley	c152dc8492	Omit ECC from DNSSEC if nettle library is old.	2014-02-19 18:14:33 +00:00
Simon Kelley	7bcca0060f	More server cleanup.	2014-02-19 17:45:17 +00:00
Simon Kelley	d68c2ca2b7	Cleanup of server reading code, preparation, for dynamic reading from files.	2014-02-18 22:30:30 +00:00
Simon Kelley	de73a497ca	--rev-server option. Syntactic sugar for PTR queries.	2014-02-17 21:43:27 +00:00
Simon Kelley	e3ec15af10	Log BOGUS validation result when upstream sends SERVFAIL.	2014-02-13 16:56:30 +00:00
Simon Kelley	dac74312da	TYpo.	2014-02-13 16:43:49 +00:00
Simon Kelley	2ecd9bd5c0	No CD in forwarded queries unless dnssec-debug for TCP too.	2014-02-13 16:42:02 +00:00
Simon Kelley	a0ab18f6eb	Don't mess with the TTL of DNSSEC RRs.	2014-02-13 16:38:23 +00:00
Simon Kelley	ebe95a831f	Add RFC-6605 ECDSA DNSSEC verification.	2014-02-13 14:56:10 +00:00
Simon Kelley	ee4158678a	Use DS records as trust anchors, not DNSKEYs. ... This allows us to query for the root zone DNSKEY RRset and validate it, thus automatically handling KSK rollover.	2014-02-11 11:07:22 +00:00
Simon Kelley	83349b8aa4	Further tidying of AD and DO bit handling.	2014-02-10 21:02:01 +00:00
Simon Kelley	7fa836e105	Handle validation when more one key is needed.	2014-02-10 20:11:24 +00:00
Simon Kelley	1633e30834	Fix Byte-order botch: broke DNSSEC on big-endian platforms.	2014-02-10 16:42:46 +00:00
Simon Kelley	c8ca33f810	Fix DNSSEC caching problems: incomplete RRSIG RRsets.	2014-02-10 10:35:42 +00:00
Simon Kelley	e243c072b5	AD bit in queries handled as RFC6840 p5.7	2014-02-06 18:14:09 +00:00
Simon Kelley	610e782a29	Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.	2014-02-06 14:45:17 +00:00
Simon Kelley	bb201c211a	Protect against malicious DNS replies with very large RRsets.	2014-02-06 12:01:05 +00:00
Simon Kelley	12fae49fff	Make RR work when returning A/AAAA records and an RRSIG.	2014-02-04 22:03:06 +00:00
Simon Kelley	b98d22c191	Linking stuff. Latest Debian/Ubuntu don't automatically link gmp.	2014-02-04 18:09:30 +00:00
Simon Kelley	81a883fda3	Format tweak.	2014-02-03 21:17:04 +00:00
Simon Kelley	40b695c1f1	Log NXDOMAIN correctly.	2014-02-03 17:07:51 +00:00
Simon Kelley	5f938534a9	Return configured DNSKEYs even though we don't have RRSIGS for them.	2014-02-03 16:44:32 +00:00
Simon Kelley	8d718cbb3e	Nasty cache failure and memory leak with DNSSEC.	2014-02-03 16:27:37 +00:00
Simon Kelley	f6a2b79310	Validate Ooops.	2014-02-01 14:54:26 +00:00
Simon Kelley	82e3f45a9f	Blockdata fixes and tuning.	2014-01-31 21:05:48 +00:00
Simon Kelley	072e81b3c5	Blockdata leak.	2014-01-31 12:42:54 +00:00
Simon Kelley	1d97ac4fd2	copy-n-paste error.	2014-01-31 11:12:27 +00:00
Simon Kelley	db73746620	Anounce DNSSEC at startup.	2014-01-31 10:32:45 +00:00
Simon Kelley	97bc798b05	Init ->dependent field in frec allocation.	2014-01-31 10:19:52 +00:00
Simon Kelley	edc231bc58	Compiler warning.	2014-01-31 09:52:50 +00:00
Simon Kelley	583043f527	Crash in cache code when compiled with HAVE_DNSSEC.	2014-01-28 14:54:46 +00:00
Simon Kelley	7c28612a59	Trivial format fix.	2014-01-27 21:38:11 +00:00
Simon Kelley	6f4681034e	Code tidy.	2014-01-26 23:39:17 +00:00
Simon Kelley	6938f3476e	Don't mark answers as DNSEC validated if DNS-doctored.	2014-01-26 22:47:39 +00:00
Simon Kelley	17fb9ea763	Exclude CRC code in DNSSEC build - replaced with SHA1.	2014-01-26 09:36:54 +00:00
Simon Kelley	7d23a66ff0	Remove --dnssec-permissive, pointless if we don't set CD upstream.	2014-01-26 09:33:21 +00:00
Simon Kelley	703c7ff429	Fix to last commit.	2014-01-25 23:46:23 +00:00
Simon Kelley	8a9be9e493	Replace CRC32 with SHA1 for spoof detection in DNSSEC builds.	2014-01-25 23:17:21 +00:00
Simon Kelley	c92f0083a2	Get AA flag right in DNSSEC answers from cache.	2014-01-25 18:43:59 +00:00
Simon Kelley	b5dbfd142a	RRSIG answer logging.	2014-01-25 18:19:51 +00:00
Simon Kelley	cbf13a2a6d	Class specifier in --dnskey, instead of hardwiring C_IN.	2014-01-25 17:59:14 +00:00
Simon Kelley	5b3bf92101	--dnssec-debug	2014-01-25 17:03:07 +00:00
Simon Kelley	0744ca66ad	More DNSSEC caching logic, and avoid repeated validation of DS/DNSKEY	2014-01-25 16:40:15 +00:00
Simon Kelley	2d33bda2e6	RRSIGS for PTR records from cache.	2014-01-24 22:37:25 +00:00