Simon Kelley
d3a8b39c7d
More EDNS0 packet-size tweaks.
2015-12-23 12:27:37 +00:00
Simon Kelley
15379ea1f2
Log signature algo with DNSKEY and DS, also digest with DS.
2015-12-21 18:31:55 +00:00
Simon Kelley
efef497b89
Fix build failure when DNSSEC code omitted.
2015-12-21 17:30:44 +00:00
Simon Kelley
5aa5f0ff2f
Truncate DNS replies >512 bytes that the client isn't expecting.
2015-12-21 17:20:35 +00:00
Simon Kelley
5bb88f0963
Handle extending EDNS0 OPT RR.
2015-12-21 16:23:47 +00:00
Simon Kelley
1d03016bbc
Split EDNS0 stuff into its own source file.
2015-12-21 14:17:06 +00:00
Simon Kelley
ce5732e84f
NSEC3 check: RFC5155 para 8.2
2015-12-20 21:39:19 +00:00
Simon Kelley
a86fdf437e
Minor tweak to previous commit.
2015-12-20 21:19:20 +00:00
Simon Kelley
3e86d316c4
Nasty, rare and obscure off-by-one in DNSSEC hostname_cmp().
2015-12-20 20:50:05 +00:00
Simon Kelley
d67ecac59d
More tweaks in handling unknown DNSSEC algorithms.
2015-12-20 20:44:23 +00:00
Simon Kelley
fa14bec83b
Major tidy up of EDNS0 handling and computation/use of udp packet size.
2015-12-20 17:12:16 +00:00
Simon Kelley
14a4ae883d
Do a better job of determining which DNSSEC sig algos are supported.
2015-12-17 17:29:57 +00:00
Simon Kelley
3b799c826d
Fix brace botch in dnssec_validate_ds()
...
Thanks to Michał Kępień for spotting this.
2015-12-17 16:58:04 +00:00
Simon Kelley
b40f26c019
Tidy up DNSSEC non-existence code. Check zone status is NSEC proof bad.
2015-12-17 11:57:26 +00:00
Simon Kelley
dd4ad9ac7e
Tweaks to EDNS0 handling in DNS replies.
2015-12-17 10:44:58 +00:00
Simon Kelley
2dbba34b2c
DNSSEC validation tweak.
...
A zone which has at least one key with an algorithm we don't
support should be considered as insecure.
2015-12-16 13:41:58 +00:00
Simon Kelley
c2bcd1e183
Generalise RR-filtering code, for use with EDNS0.
2015-12-15 17:25:21 +00:00
Simon Kelley
d64c81fff7
Move code which caches DS records to a more logical place.
2015-12-15 16:11:06 +00:00
Simon Kelley
93be5b1e02
Abandon caching RRSIGs and returning them from cache.
...
The list of exceptions to being able to locally answer
cached data for validated records when DNSSEC data is requested
was getting too long, so don't ever do that. This means
that the cache no longer has to hold RRSIGS and allows
us to lose lots of code. Note that cached validated
answers are still returned as long as do=0
2015-12-15 12:04:40 +00:00
Simon Kelley
9a31b68b59
Major rationalisation of DNSSEC validation.
...
Much gnarly special-case code removed and replaced with correct
general implementaion. Checking of zone-status moved to DNSSEC code,
where it should be, vastly simplifying query-forwarding code.
2015-12-15 10:20:39 +00:00
Simon Kelley
0007ee9064
Fix crash at start up with conf-dir=/path,*
...
Thanks to Brian Carpenter and American Fuzzy Lop for finding the bug.
2015-11-21 21:47:41 +00:00
Simon Kelley
67ab3285b5
Handle unknown DS hash algos correctly.
...
When we can validate a DS RRset, but don't speak the hash algo it
contains, treat that the same as an NSEC/3 proving that the DS
doesn't exist. 4025 5.2
2015-11-20 23:20:47 +00:00
Edwin Török
41a8d9e99b
Fix crash when empty address from DNS overlays A record from hosts.
2015-11-14 17:55:41 +00:00
Simon Kelley
90477fb794
Update list of subnet for --bogus-priv
...
RFC6303 specifies & recommends following zones not be forwarded
to globally facing servers.
+------------------------------+-----------------------+
| Zone | Description |
+------------------------------+-----------------------+
| 0.IN-ADDR.ARPA | IPv4 "THIS" NETWORK |
| 127.IN-ADDR.ARPA | IPv4 Loopback NETWORK |
| 254.169.IN-ADDR.ARPA | IPv4 LINK LOCAL |
| 2.0.192.IN-ADDR.ARPA | IPv4 TEST-NET-1 |
| 100.51.198.IN-ADDR.ARPA | IPv4 TEST-NET-2 |
| 113.0.203.IN-ADDR.ARPA | IPv4 TEST-NET-3 |
| 255.255.255.255.IN-ADDR.ARPA | IPv4 BROADCAST |
+------------------------------+-----------------------+
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk >
2015-10-20 21:21:32 +01:00
Simon Kelley
98079ea898
Catch errors from sendmsg in DHCP code.
...
Logs, eg, iptables DROPS of dest 255.255.255.255
2015-10-13 20:32:21 +01:00
Simon Kelley
27b78d990b
Rationalise 5e3e464ac4
2015-09-26 21:40:45 +01:00
Simon Kelley
77607cbea0
Respect the --no-resolv flag in inotify code.
2015-09-10 23:08:43 +01:00
Simon Kelley
102208df69
DHCPv6 option 56 does not hold an address list. (RFC 5908).
2015-09-10 21:50:00 +01:00
Simon Kelley
6de81f1250
Handle signed dangling CNAME replies to DS queries.
2015-09-09 22:51:13 +01:00
Simon Kelley
9cdcfe9f19
Suggest solution to ENOMEM error with IPv6 multicast.
2015-08-26 22:38:08 +01:00
Simon Kelley
5e3e464ac4
Fix behaviour of empty dhcp-option=option6:dns-server, which should inhibit sending option.
2015-08-25 23:08:39 +01:00
Simon Kelley
3a3965ac21
Don't answer non-auth queries for auth zones locally when --localise-queries set.
2015-08-09 17:45:06 +01:00
Ed Bardsley
a7369bef8a
Enhance --add-subnet to allow arbitary subnet addresses.
2015-08-05 21:17:18 +01:00
Simon Kelley
d2aa7dfbb6
Include 0.0.0.0/8 in DNS rebind checks.
2015-08-03 21:52:12 +01:00
Simon Kelley
63ec5d1264
Fix new poll() code for helper pipe. Removed CPU-spin.
2015-07-30 20:59:07 +01:00
Simon Kelley
f6381cf482
Declare utime().
2015-07-27 19:48:43 +01:00
Kevin Darbyshire-Bryant
34b5d19488
Update DNSSEC timestamp file on process TERM.
2015-07-27 19:34:23 +01:00
Simon Kelley
d389e0191b
DNSSEC fix: correct logic for signed records in unsigned DNS space.
2015-07-27 18:56:43 +01:00
Simon Kelley
d3699bb6bc
Small tweak to DNSSEC fix.
2015-07-16 22:37:37 +01:00
Simon Kelley
13480e8c2a
DNSSEC fix, signed wildcard CNAME to unsigned domain.
2015-07-16 22:23:13 +01:00
Simon Kelley
90c3822bfa
Grow pollfds array exponentially.
2015-07-13 12:47:52 +01:00
Simon Kelley
b842bc97bb
Use poll() instead of select() to remove limits on open file descriptors.
2015-07-12 21:09:11 +01:00
Simon Kelley
0f38fa05a6
Log message typo.
2015-07-08 22:42:14 +01:00
Simon Kelley
45c5cb1f8f
Fix compilation warning.
2015-07-08 22:40:57 +01:00
Simon Kelley
f6d6956261
Test for overflowing platform FD_SET size.
2015-07-08 22:38:13 +01:00
Simon Kelley
362c9303da
Fix inotify code to handle dangling symlinks better.
2015-07-06 21:48:49 +01:00
Simon Kelley
5e95a552ee
Avoid hanngs in DHCP ping code when system time goes backwards.
2015-07-05 22:31:30 +01:00
Simon Kelley
90cb222551
--conf-file should read no file, not try and read the default file.
2015-07-05 21:59:10 +01:00
Simon Kelley
e3ec6f0bd7
Handle CNAMEs to DS records when confirming absence of DS for DNSSEC.
2015-06-12 21:39:11 +01:00
Neil Jerram
4918bd5505
Documenation updates for --bridge-interface and "off-link".
2015-06-10 22:23:20 +01:00
