157 Commits

Author	SHA1	Message	Date
Simon Kelley	14db4212ab	Tidy.	2014-03-01 15:35:50 +00:00
Simon Kelley	00a5b5d477	Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.	2014-02-28 18:10:55 +00:00
Simon Kelley	b8eac19177	Negative caching for DS records.	2014-02-27 14:30:03 +00:00
Simon Kelley	b47b04c846	Return INSECURE when validation fails with proved non-existent DS.	2014-02-25 23:13:28 +00:00
Simon Kelley	613ad15d02	Strip DNSSEC RRs when query doesn't have DO bit set.	2014-02-25 23:02:28 +00:00
Simon Kelley	24187530fb	Speeling.	2014-02-24 21:46:44 +00:00
Simon Kelley	a857daa351	Code cleanup.	2014-02-24 21:01:09 +00:00
Simon Kelley	f01d7be6c6	An NSEC record cannot attest to its own non-existance!	2014-02-24 20:20:00 +00:00
Simon Kelley	d387380a25	Check signer name in RRSIGs.	2014-02-23 16:20:46 +00:00
Simon Kelley	f2e4c277c4	Bugfix for last commit.	2014-02-23 15:24:26 +00:00
Simon Kelley	5107ace14a	NSEC3 validation. First pass.	2014-02-23 10:48:32 +00:00
Simon Kelley	7b1eae4f50	Add --servers-file option.	2014-02-20 13:43:28 +00:00
Simon Kelley	c152dc8492	Omit ECC from DNSSEC if nettle library is old.	2014-02-19 18:14:33 +00:00
Simon Kelley	e3ec15af10	Log BOGUS validation result when upstream sends SERVFAIL.	2014-02-13 16:56:30 +00:00
Simon Kelley	ebe95a831f	Add RFC-6605 ECDSA DNSSEC verification.	2014-02-13 14:56:10 +00:00
Simon Kelley	1633e30834	Fix Byte-order botch: broke DNSSEC on big-endian platforms.	2014-02-10 16:42:46 +00:00
Simon Kelley	c8ca33f810	Fix DNSSEC caching problems: incomplete RRSIG RRsets.	2014-02-10 10:35:42 +00:00
Simon Kelley	610e782a29	Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.	2014-02-06 14:45:17 +00:00
Simon Kelley	bb201c211a	Protect against malicious DNS replies with very large RRsets.	2014-02-06 12:01:05 +00:00
Simon Kelley	b98d22c191	Linking stuff. Latest Debian/Ubuntu don't automatically link gmp.	2014-02-04 18:09:30 +00:00
Simon Kelley	8d718cbb3e	Nasty cache failure and memory leak with DNSSEC.	2014-02-03 16:27:37 +00:00
Simon Kelley	f6a2b79310	Validate Ooops.	2014-02-01 14:54:26 +00:00
Simon Kelley	6f4681034e	Code tidy.	2014-01-26 23:39:17 +00:00
Simon Kelley	7d23a66ff0	Remove --dnssec-permissive, pointless if we don't set CD upstream.	2014-01-26 09:33:21 +00:00
Simon Kelley	703c7ff429	Fix to last commit.	2014-01-25 23:46:23 +00:00
Simon Kelley	8a9be9e493	Replace CRC32 with SHA1 for spoof detection in DNSSEC builds.	2014-01-25 23:17:21 +00:00
Simon Kelley	b5dbfd142a	RRSIG answer logging.	2014-01-25 18:19:51 +00:00
Simon Kelley	5b3bf92101	--dnssec-debug	2014-01-25 17:03:07 +00:00
Simon Kelley	0744ca66ad	More DNSSEC caching logic, and avoid repeated validation of DS/DNSKEY	2014-01-25 16:40:15 +00:00
Simon Kelley	2d33bda2e6	RRSIGS for PTR records from cache.	2014-01-24 22:37:25 +00:00
Simon Kelley	824202ef54	More DNSSEC cache readout.	2014-01-23 20:59:46 +00:00
Simon Kelley	e7829aefd8	Cache RRSIGS.	2014-01-22 22:21:51 +00:00
Simon Kelley	51ea3ca254	Caching of DNSSEC records.	2014-01-22 19:31:38 +00:00
Simon Kelley	6fd6dacb39	Fix loop in RR sort.	2014-01-21 20:17:40 +00:00
Simon Kelley	979cdf9b64	Fix to hostname_cmp, and update to canonicalisation table. RFC 4034 LIES.	2014-01-21 16:26:41 +00:00
Simon Kelley	dbf721235b	Rationalise hostname_cmp()	2014-01-21 14:28:02 +00:00
Simon Kelley	c5f4ec7d23	NSEC proof-of-non-existence.	2014-01-20 22:37:55 +00:00
Simon Kelley	72ae2f3d56	Don't validate error returns.	2014-01-19 09:54:16 +00:00
Simon Kelley	e0c0ad3b5e	UDP retries for DNSSEC	2014-01-16 22:42:07 +00:00
Simon Kelley	4619d94622	Fix SEGV and failure to validate on x86_64.	2014-01-16 19:53:06 +00:00
Simon Kelley	86bec2d399	Swap crypto library from openSSL to nettle.	2014-01-13 21:31:20 +00:00
Simon Kelley	1486a9c7f2	Furthet tweak to RRset sort.	2014-01-10 11:44:26 +00:00
Simon Kelley	5ada888507	RFC 4035 5.3.2 wildcard label rules.	2014-01-09 22:25:03 +00:00
Simon Kelley	5f8e58f49b	DNSSEC consolidation.	2014-01-09 17:31:19 +00:00
Simon Kelley	b6e9e7c32d	Handle digest lengths greater than 1 block.	2014-01-08 21:21:20 +00:00
Simon Kelley	60b68069cf	Rationalise DNS packet-buffer size calculations.	2014-01-08 12:10:28 +00:00
Simon Kelley	0fc2f31368	First functional DNSSEC - highly alpha.	2014-01-08 10:26:58 +00:00
Simon Kelley	c3e0b9b6e7	backup	2013-12-31 13:50:39 +00:00
Simon Kelley	3a2371527f	Commit to allow master merge.	2013-12-12 12:15:50 +00:00
Giovanni Bajo	8d41ebd8a3	Add copyright banners	2013-08-20 15:41:26 +01:00