185 Commits

Author	SHA1	Message	Date
Simon Kelley	1e153945de	DNSSEC fix for non-ascii characters in labels.	2015-03-28 21:34:07 +00:00
Simon Kelley	0b8a5a30a7	Protect against broken DNSSEC upstreams.	2015-03-27 11:44:55 +00:00
Simon Kelley	8805283088	Don't fail DNSSEC when a signed CNAME dangles into an unsigned zone.	2015-03-26 21:15:43 +00:00
Simon Kelley	360f2513ab	Tweak DNSSEC timestamp code to create file later, removing need to chown it.	2015-03-07 18:28:06 +00:00
Simon Kelley	9003b50b13	Fix last commit to not crash if uid changing not configured.	2015-03-02 22:47:23 +00:00
Simon Kelley	f6e62e2af9	Add --dnssec-timestamp option and facility.	2015-03-01 18:17:54 +00:00
Simon Kelley	6ef15b34ca	Fix broken ECDSA DNSSEC signatures.	2015-01-31 22:44:26 +00:00
Simon Kelley	aff3396280	Update copyrights for dawn of 2015.	2015-01-31 20:13:40 +00:00
Simon Kelley	5e321739db	Don't answer from cache RRsets from wildcards, as we don't have NSECs.	2015-01-12 23:16:56 +00:00
Simon Kelley	25cf5e373e	Add --log-queries=extra option for more complete logging.	2015-01-09 15:53:03 +00:00
Simon Kelley	97e618a0e3	DNSSEC: do top-down search for limit of secure delegation.	2015-01-07 21:55:43 +00:00
Simon Kelley	0b1008d367	Bad packet protection.	2014-12-27 15:33:32 +00:00
Simon Kelley	83d2ed09fc	Initialise return value.	2014-12-23 18:42:38 +00:00
Simon Kelley	fbc5205702	Fix problems validating NSEC3 and wildcards.	2014-12-23 15:46:08 +00:00
Simon Kelley	094b5c3d90	Fix crash in DNSSEC code when attempting to verify large RRs.	2014-12-21 16:11:52 +00:00
Simon Kelley	cdb755c5f1	Fix FTBFS with Nettle-3.0.	2014-06-18 20:52:53 +01:00
Simon Kelley	063efb330a	Build config: add -DNO_GMP for use with nettle/mini-gmp	2014-06-17 19:49:31 +01:00
Simon Kelley	e6096e643a	Another filter_rrsigs fix.	2014-05-01 18:19:12 +01:00
Simon Kelley	9d1b22aac2	Fix DNSSEC validation of ANY queries.	2014-04-29 13:02:41 +01:00
Simon Kelley	50f86ce8e4	Need to fixup records in the additional section when removing DNSSEC stuff.	2014-04-24 17:59:58 +01:00
Simon Kelley	e98bd52e25	Add --dnssec-no-timecheck	2014-03-28 20:41:23 +00:00
Simon Kelley	3f7483e816	Handle integer overflow in uid counter. Fixes rare crashes in cache code.	2014-03-16 22:56:58 +00:00
Simon Kelley	c07d30dcb1	Compiler warning.	2014-03-03 14:19:19 +00:00
Simon Kelley	8707019237	Mass edit of INSECURE->BOGUS returns for server failure/bad input.	2014-03-01 20:48:24 +00:00
Simon Kelley	1fbe4d2f5f	Tweak tuning params.	2014-03-01 20:03:47 +00:00
Simon Kelley	0575610fa1	Handle replies with no answers and no NS in validate_reply.	2014-03-01 18:07:57 +00:00
Simon Kelley	e3f1455850	Don't free blockdata for negative DS cache entries.	2014-03-01 17:58:28 +00:00
Simon Kelley	bd9b3cf55b	Fix off-by-one overwrite.	2014-03-01 16:12:28 +00:00
Simon Kelley	14db4212ab	Tidy.	2014-03-01 15:35:50 +00:00
Simon Kelley	00a5b5d477	Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.	2014-02-28 18:10:55 +00:00
Simon Kelley	b8eac19177	Negative caching for DS records.	2014-02-27 14:30:03 +00:00
Simon Kelley	b47b04c846	Return INSECURE when validation fails with proved non-existent DS.	2014-02-25 23:13:28 +00:00
Simon Kelley	613ad15d02	Strip DNSSEC RRs when query doesn't have DO bit set.	2014-02-25 23:02:28 +00:00
Simon Kelley	24187530fb	Speeling.	2014-02-24 21:46:44 +00:00
Simon Kelley	a857daa351	Code cleanup.	2014-02-24 21:01:09 +00:00
Simon Kelley	f01d7be6c6	An NSEC record cannot attest to its own non-existance!	2014-02-24 20:20:00 +00:00
Simon Kelley	d387380a25	Check signer name in RRSIGs.	2014-02-23 16:20:46 +00:00
Simon Kelley	f2e4c277c4	Bugfix for last commit.	2014-02-23 15:24:26 +00:00
Simon Kelley	5107ace14a	NSEC3 validation. First pass.	2014-02-23 10:48:32 +00:00
Simon Kelley	7b1eae4f50	Add --servers-file option.	2014-02-20 13:43:28 +00:00
Simon Kelley	c152dc8492	Omit ECC from DNSSEC if nettle library is old.	2014-02-19 18:14:33 +00:00
Simon Kelley	e3ec15af10	Log BOGUS validation result when upstream sends SERVFAIL.	2014-02-13 16:56:30 +00:00
Simon Kelley	ebe95a831f	Add RFC-6605 ECDSA DNSSEC verification.	2014-02-13 14:56:10 +00:00
Simon Kelley	1633e30834	Fix Byte-order botch: broke DNSSEC on big-endian platforms.	2014-02-10 16:42:46 +00:00
Simon Kelley	c8ca33f810	Fix DNSSEC caching problems: incomplete RRSIG RRsets.	2014-02-10 10:35:42 +00:00
Simon Kelley	610e782a29	Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.	2014-02-06 14:45:17 +00:00
Simon Kelley	bb201c211a	Protect against malicious DNS replies with very large RRsets.	2014-02-06 12:01:05 +00:00
Simon Kelley	b98d22c191	Linking stuff. Latest Debian/Ubuntu don't automatically link gmp.	2014-02-04 18:09:30 +00:00
Simon Kelley	8d718cbb3e	Nasty cache failure and memory leak with DNSSEC.	2014-02-03 16:27:37 +00:00
Simon Kelley	f6a2b79310	Validate Ooops.	2014-02-01 14:54:26 +00:00