Simon Kelley
a77cec8d58
Handle UDP packet loss when fragmentation of large packets is broken.
2015-05-08 16:25:38 +01:00
Simon Kelley
2ed162ac20
Don't remove RRSIG RR from answers to ANY queries when the do bit is not set.
2015-04-28 21:26:35 +01:00
Simon Kelley
b8f16556d3
Tweaks to previous, DNS label charset commit.
2015-04-22 21:14:31 +01:00
Simon Kelley
cbe379ad6b
Handle domain names with '.' or /000 within labels.
...
Only in DNSSEC mode, where we might need to validate or store
such names. In none-DNSSEC mode, simply don't cache these, as before.
2015-04-21 22:57:06 +01:00
Simon Kelley
ad4a8ff7d9
Fix crash on receipt of certain malformed DNS requests.
2015-04-09 21:48:00 +01:00
Simon Kelley
394ff492da
Allow control characters in names in the cache, handle when logging.
2015-03-29 22:17:14 +01:00
Simon Kelley
1e153945de
DNSSEC fix for non-ascii characters in labels.
2015-03-28 21:34:07 +00:00
Simon Kelley
aff3396280
Update copyrights for dawn of 2015.
2015-01-31 20:13:40 +00:00
Simon Kelley
ae4624bf46
Logs for DS records consistent.
2015-01-12 23:22:08 +00:00
Glen Huang
32fc6dbe03
Add --ignore-address option.
2014-12-27 15:28:12 +00:00
Simon Kelley
476693678e
Eliminate IPv6 privacy addresses from --interface-name answers.
2014-12-17 12:41:56 +00:00
Simon Kelley
288df49c96
Fix bug when resulted in NXDOMAIN answers instead of NODATA.
...
check_for_local_domain() was broken due to new code matching F_*
bits in cache entries for DNSSEC. Because F_DNSKEY | F_DS is
used to match RRSIG entries, cache_find_by_name() insists on an exact match
of those bits. So adding F_DS to the bits that check_for_local_domain()
sends to cache_find_by_name() won't result in DS records as well
as the others, it results in only DS records. Add a new bit, F_NSIGMATCH
which suitably changes the behaviour of cache_find_by_name().
2014-09-18 21:55:27 +01:00
Simon Kelley
b7639d5815
Fix ipsets logging patch.
2014-03-29 09:20:07 +00:00
Wang Jian
49752b90d5
Log IPSET actions.
2014-03-28 20:52:47 +00:00
Simon Kelley
fec216df32
Cache stats availble in CHAOS .bind domain.
2014-03-27 20:54:34 +00:00
Andy
3e21a1a6fa
Tidy uid defines.
2014-03-22 19:10:07 +00:00
Simon Kelley
03431d6373
Initialise uid when creating CNAME cache record.
2014-03-20 16:25:43 +00:00
Simon Kelley
3f7483e816
Handle integer overflow in uid counter. Fixes rare crashes in cache code.
2014-03-16 22:56:58 +00:00
Simon Kelley
29fe922b14
Can have local DS records (trust anchors).
2014-03-01 22:53:57 +00:00
Simon Kelley
d1fbb77e0f
Don't cache secure replies which we've messsed with.
2014-03-01 20:08:58 +00:00
Simon Kelley
1fbe4d2f5f
Tweak tuning params.
2014-03-01 20:03:47 +00:00
Simon Kelley
00a5b5d477
Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.
2014-02-28 18:10:55 +00:00
Simon Kelley
b8eac19177
Negative caching for DS records.
2014-02-27 14:30:03 +00:00
Simon Kelley
613ad15d02
Strip DNSSEC RRs when query doesn't have DO bit set.
2014-02-25 23:02:28 +00:00
Simon Kelley
5107ace14a
NSEC3 validation. First pass.
2014-02-23 10:48:32 +00:00
Simon Kelley
ee4158678a
Use DS records as trust anchors, not DNSKEYs.
...
This allows us to query for the root zone DNSKEY RRset and validate
it, thus automatically handling KSK rollover.
2014-02-11 11:07:22 +00:00
Simon Kelley
83349b8aa4
Further tidying of AD and DO bit handling.
2014-02-10 21:02:01 +00:00
Simon Kelley
c8ca33f810
Fix DNSSEC caching problems: incomplete RRSIG RRsets.
2014-02-10 10:35:42 +00:00
Simon Kelley
e243c072b5
AD bit in queries handled as RFC6840 p5.7
2014-02-06 18:14:09 +00:00
Simon Kelley
610e782a29
Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.
2014-02-06 14:45:17 +00:00
Simon Kelley
12fae49fff
Make RR work when returning A/AAAA records and an RRSIG.
2014-02-04 22:03:06 +00:00
Simon Kelley
5f938534a9
Return configured DNSKEYs even though we don't have RRSIGS for them.
2014-02-03 16:44:32 +00:00
Simon Kelley
7c28612a59
Trivial format fix.
2014-01-27 21:38:11 +00:00
Simon Kelley
6938f3476e
Don't mark answers as DNSEC validated if DNS-doctored.
2014-01-26 22:47:39 +00:00
Simon Kelley
17fb9ea763
Exclude CRC code in DNSSEC build - replaced with SHA1.
2014-01-26 09:36:54 +00:00
Simon Kelley
c92f0083a2
Get AA flag right in DNSSEC answers from cache.
2014-01-25 18:43:59 +00:00
Simon Kelley
b5dbfd142a
RRSIG answer logging.
2014-01-25 18:19:51 +00:00
Simon Kelley
5b3bf92101
--dnssec-debug
2014-01-25 17:03:07 +00:00
Simon Kelley
0744ca66ad
More DNSSEC caching logic, and avoid repeated validation of DS/DNSKEY
2014-01-25 16:40:15 +00:00
Simon Kelley
2d33bda2e6
RRSIGS for PTR records from cache.
2014-01-24 22:37:25 +00:00
Simon Kelley
32f90c0fad
Tweak.
2014-01-24 10:37:36 +00:00
Simon Kelley
bce6e1bc6d
RRSIGs in DS and DNSKEY cached answers.
2014-01-23 22:02:19 +00:00
Simon Kelley
824202ef54
More DNSSEC cache readout.
2014-01-23 20:59:46 +00:00
Simon Kelley
9ebfca1e84
Compiler warning.
2014-01-23 12:11:43 +00:00
Simon Kelley
51ea3ca254
Caching of DNSSEC records.
2014-01-22 19:31:38 +00:00
Simon Kelley
a25720a34a
protocol handling for DNSSEC
2014-01-14 23:13:55 +00:00
Simon Kelley
5f8e58f49b
DNSSEC consolidation.
2014-01-09 17:31:19 +00:00
Simon Kelley
0435d041ea
AD into cache fixes.
2014-01-08 18:22:37 +00:00
Simon Kelley
c47e3ba446
Update copyright for 2014.
2014-01-08 17:07:54 +00:00
Simon Kelley
0fc2f31368
First functional DNSSEC - highly alpha.
2014-01-08 10:26:58 +00:00
