218 Commits

Author	SHA1	Message	Date
Simon Kelley	e6096e643a	Another filter_rrsigs fix.	2014-05-01 18:19:12 +01:00
Simon Kelley	9d1b22aac2	Fix DNSSEC validation of ANY queries.	2014-04-29 13:02:41 +01:00
Simon Kelley	50f86ce8e4	Need to fixup records in the additional section when removing DNSSEC stuff.	2014-04-24 17:59:58 +01:00
Simon Kelley	e98bd52e25	Add --dnssec-no-timecheck	2014-03-28 20:41:23 +00:00
Simon Kelley	3f7483e816	Handle integer overflow in uid counter. Fixes rare crashes in cache code.	2014-03-16 22:56:58 +00:00
Simon Kelley	c07d30dcb1	Compiler warning.	2014-03-03 14:19:19 +00:00
Simon Kelley	8707019237	Mass edit of INSECURE->BOGUS returns for server failure/bad input.	2014-03-01 20:48:24 +00:00
Simon Kelley	1fbe4d2f5f	Tweak tuning params.	2014-03-01 20:03:47 +00:00
Simon Kelley	0575610fa1	Handle replies with no answers and no NS in validate_reply.	2014-03-01 18:07:57 +00:00
Simon Kelley	e3f1455850	Don't free blockdata for negative DS cache entries.	2014-03-01 17:58:28 +00:00
Simon Kelley	bd9b3cf55b	Fix off-by-one overwrite.	2014-03-01 16:12:28 +00:00
Simon Kelley	14db4212ab	Tidy.	2014-03-01 15:35:50 +00:00
Simon Kelley	00a5b5d477	Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.	2014-02-28 18:10:55 +00:00
Simon Kelley	b8eac19177	Negative caching for DS records.	2014-02-27 14:30:03 +00:00
Simon Kelley	b47b04c846	Return INSECURE when validation fails with proved non-existent DS.	2014-02-25 23:13:28 +00:00
Simon Kelley	613ad15d02	Strip DNSSEC RRs when query doesn't have DO bit set.	2014-02-25 23:02:28 +00:00
Simon Kelley	24187530fb	Speeling.	2014-02-24 21:46:44 +00:00
Simon Kelley	a857daa351	Code cleanup.	2014-02-24 21:01:09 +00:00
Simon Kelley	f01d7be6c6	An NSEC record cannot attest to its own non-existance!	2014-02-24 20:20:00 +00:00
Simon Kelley	d387380a25	Check signer name in RRSIGs.	2014-02-23 16:20:46 +00:00
Simon Kelley	f2e4c277c4	Bugfix for last commit.	2014-02-23 15:24:26 +00:00
Simon Kelley	5107ace14a	NSEC3 validation. First pass.	2014-02-23 10:48:32 +00:00
Simon Kelley	7b1eae4f50	Add --servers-file option.	2014-02-20 13:43:28 +00:00
Simon Kelley	c152dc8492	Omit ECC from DNSSEC if nettle library is old.	2014-02-19 18:14:33 +00:00
Simon Kelley	e3ec15af10	Log BOGUS validation result when upstream sends SERVFAIL.	2014-02-13 16:56:30 +00:00
Simon Kelley	ebe95a831f	Add RFC-6605 ECDSA DNSSEC verification.	2014-02-13 14:56:10 +00:00
Simon Kelley	1633e30834	Fix Byte-order botch: broke DNSSEC on big-endian platforms.	2014-02-10 16:42:46 +00:00
Simon Kelley	c8ca33f810	Fix DNSSEC caching problems: incomplete RRSIG RRsets.	2014-02-10 10:35:42 +00:00
Simon Kelley	610e782a29	Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.	2014-02-06 14:45:17 +00:00
Simon Kelley	bb201c211a	Protect against malicious DNS replies with very large RRsets.	2014-02-06 12:01:05 +00:00
Simon Kelley	b98d22c191	Linking stuff. Latest Debian/Ubuntu don't automatically link gmp.	2014-02-04 18:09:30 +00:00
Simon Kelley	8d718cbb3e	Nasty cache failure and memory leak with DNSSEC.	2014-02-03 16:27:37 +00:00
Simon Kelley	f6a2b79310	Validate Ooops.	2014-02-01 14:54:26 +00:00
Simon Kelley	6f4681034e	Code tidy.	2014-01-26 23:39:17 +00:00
Simon Kelley	7d23a66ff0	Remove --dnssec-permissive, pointless if we don't set CD upstream.	2014-01-26 09:33:21 +00:00
Simon Kelley	703c7ff429	Fix to last commit.	2014-01-25 23:46:23 +00:00
Simon Kelley	8a9be9e493	Replace CRC32 with SHA1 for spoof detection in DNSSEC builds.	2014-01-25 23:17:21 +00:00
Simon Kelley	b5dbfd142a	RRSIG answer logging.	2014-01-25 18:19:51 +00:00
Simon Kelley	5b3bf92101	--dnssec-debug	2014-01-25 17:03:07 +00:00
Simon Kelley	0744ca66ad	More DNSSEC caching logic, and avoid repeated validation of DS/DNSKEY	2014-01-25 16:40:15 +00:00
Simon Kelley	2d33bda2e6	RRSIGS for PTR records from cache.	2014-01-24 22:37:25 +00:00
Simon Kelley	824202ef54	More DNSSEC cache readout.	2014-01-23 20:59:46 +00:00
Simon Kelley	e7829aefd8	Cache RRSIGS.	2014-01-22 22:21:51 +00:00
Simon Kelley	51ea3ca254	Caching of DNSSEC records.	2014-01-22 19:31:38 +00:00
Simon Kelley	6fd6dacb39	Fix loop in RR sort.	2014-01-21 20:17:40 +00:00
Simon Kelley	979cdf9b64	Fix to hostname_cmp, and update to canonicalisation table. RFC 4034 LIES.	2014-01-21 16:26:41 +00:00
Simon Kelley	dbf721235b	Rationalise hostname_cmp()	2014-01-21 14:28:02 +00:00
Simon Kelley	c5f4ec7d23	NSEC proof-of-non-existence.	2014-01-20 22:37:55 +00:00
Simon Kelley	72ae2f3d56	Don't validate error returns.	2014-01-19 09:54:16 +00:00
Simon Kelley	e0c0ad3b5e	UDP retries for DNSSEC	2014-01-16 22:42:07 +00:00