Simon Kelley
10068600f8
Fix NXDOMAIN RCODE in auth PTR replies.
2014-04-03 21:16:40 +01:00
Simon Kelley
b7639d5815
Fix ipsets logging patch.
2014-03-29 09:20:07 +00:00
Wang Jian
49752b90d5
Log IPSET actions.
2014-03-28 20:52:47 +00:00
Simon Kelley
e98bd52e25
Add --dnssec-no-timecheck
2014-03-28 20:41:23 +00:00
Simon Kelley
8a8bbad0cf
Ensure ->sentto is valid for DNSSEC forwards. Otherwise retries SEGV.
2014-03-27 22:02:17 +00:00
Simon Kelley
fec216df32
Cache stats availble in CHAOS .bind domain.
2014-03-27 20:54:34 +00:00
Simon Kelley
4e1fe44428
Terminate DS-search when reaching the root via cache entries.
2014-03-26 12:24:19 +00:00
Simon Kelley
51967f9807
SERVFAIL is an expected error return, don't try all servers.
2014-03-25 21:07:00 +00:00
Tomas Hozza
b37f8b99ae
Handle failure of hash_questions()
2014-03-25 20:52:28 +00:00
Tomas Hozza
fc2833f172
Memory leak in error path.
2014-03-25 20:43:21 +00:00
Simon Kelley
490f90758d
Reorder sanity checks on UDP packet reception, to cope with failed recvfrom()
2014-03-24 22:04:42 +00:00
Simon Kelley
56618c31f6
Add dnssec-check-unsigned to example config file.
2014-03-24 21:13:49 +00:00
Simon Kelley
604f7598c2
CHANGELOG update.
2014-03-22 19:33:43 +00:00
Simon Kelley
2a7a2b84ec
Ignore DNS queries from port 0: http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html
2014-03-22 19:18:06 +00:00
Andy
3e21a1a6fa
Tidy uid defines.
2014-03-22 19:10:07 +00:00
Simon Kelley
2b29191e7c
Fix DNSSEC crash retrying to IPv6 server.
2014-03-21 11:13:55 +00:00
Simon Kelley
03431d6373
Initialise uid when creating CNAME cache record.
2014-03-20 16:25:43 +00:00
Simon Kelley
cc1a29e250
Make --quiet-dhcp apply to DHCPDISCOVER when client ignored.
2014-03-20 15:47:18 +00:00
Moritz Warning
e62e9b6187
Manpage typos.
2014-03-20 15:32:22 +00:00
Simon Kelley
19c51cfa49
Tidy and fix cache->uid handling.
...
Some CNAMES left the value of ->uid undefined.
Since there are now special values if this, for CNAMES
to interface names, that could cause a crash
if the undefined value hit the special value.
Also ensure that the special value can't arise
when the uid is encoding the source of an F_CONFIG
record, in case there's a CNAME to it.
2014-03-18 22:38:30 +00:00
Andy
d5082158ee
Ensure next_uid() can never return 0.
2014-03-17 19:50:29 +00:00
Simon Kelley
3f7483e816
Handle integer overflow in uid counter. Fixes rare crashes in cache code.
2014-03-16 22:56:58 +00:00
Simon Kelley
0c8584eabc
Warn about non-local queries once only for UDP.
2014-03-12 20:12:56 +00:00
Simon Kelley
f00690f93e
Typo
2014-03-12 20:07:12 +00:00
Simon Kelley
89b12ed35b
OPT_LOCAL_SERVICE needs up-to-date interface list too.
2014-03-06 13:27:57 +00:00
Simon Kelley
1a9a3489ec
Set --local-service in Debian package startup.
2014-03-05 15:01:08 +00:00
Simon Kelley
c8a80487cd
--local-service. Default protection from DNS amplification attacks.
2014-03-05 14:29:54 +00:00
Simon Kelley
4ea8e80dd9
Add --static to pkg-config command when appropriate.
2014-03-05 11:01:23 +00:00
Simon Kelley
c07d30dcb1
Compiler warning.
2014-03-03 14:19:19 +00:00
Simon Kelley
d588ab54d4
Man page updates for DNSSEC.
2014-03-02 14:30:05 +00:00
Simon Kelley
f8b422a7b6
KEYBLOCK LEN better as a multiple of 8.
2014-03-02 12:46:51 +00:00
Simon Kelley
29fe922b14
Can have local DS records (trust anchors).
2014-03-01 22:53:57 +00:00
Simon Kelley
8707019237
Mass edit of INSECURE->BOGUS returns for server failure/bad input.
2014-03-01 20:48:24 +00:00
Simon Kelley
d1fbb77e0f
Don't cache secure replies which we've messsed with.
2014-03-01 20:08:58 +00:00
Simon Kelley
1fbe4d2f5f
Tweak tuning params.
2014-03-01 20:03:47 +00:00
Simon Kelley
0575610fa1
Handle replies with no answers and no NS in validate_reply.
2014-03-01 18:07:57 +00:00
Simon Kelley
e3f1455850
Don't free blockdata for negative DS cache entries.
2014-03-01 17:58:28 +00:00
Simon Kelley
bd9b3cf55b
Fix off-by-one overwrite.
2014-03-01 16:12:28 +00:00
Simon Kelley
14db4212ab
Tidy.
2014-03-01 15:35:50 +00:00
Simon Kelley
00a5b5d477
Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.
2014-02-28 18:10:55 +00:00
Simon Kelley
b8eac19177
Negative caching for DS records.
2014-02-27 14:30:03 +00:00
Simon Kelley
b47b04c846
Return INSECURE when validation fails with proved non-existent DS.
2014-02-25 23:13:28 +00:00
Simon Kelley
613ad15d02
Strip DNSSEC RRs when query doesn't have DO bit set.
2014-02-25 23:02:28 +00:00
Simon Kelley
24187530fb
Speeling.
2014-02-24 21:46:44 +00:00
Simon Kelley
a857daa351
Code cleanup.
2014-02-24 21:01:09 +00:00
Simon Kelley
f01d7be6c6
An NSEC record cannot attest to its own non-existance!
2014-02-24 20:20:00 +00:00
Simon Kelley
d387380a25
Check signer name in RRSIGs.
2014-02-23 16:20:46 +00:00
Simon Kelley
f2e4c277c4
Bugfix for last commit.
2014-02-23 15:24:26 +00:00
Simon Kelley
5107ace14a
NSEC3 validation. First pass.
2014-02-23 10:48:32 +00:00
Simon Kelley
7b1eae4f50
Add --servers-file option.
2014-02-20 13:43:28 +00:00