Simon Kelley
fe3992f9fa
Return INSECURE, rather than BOGUS when DS proved not to exist.
...
Return INSECURE when validating DNS replies which have RRSIGs, but
when a needed DS record in the trust chain is proved not to exist.
It's allowed for a zone to set up DNSKEY and RRSIG records first, then
add a DS later, completing the chain of trust.
Also, since we don't have the infrastructure to track that these
non-validated replies have RRSIGS, don't cache them, so we don't
provide answers with missing RRSIGS from the cache.
2015-04-03 21:25:05 +01:00
Simon Kelley
394ff492da
Allow control characters in names in the cache, handle when logging.
2015-03-29 22:17:14 +01:00
Simon Kelley
1e153945de
DNSSEC fix for non-ascii characters in labels.
2015-03-28 21:34:07 +00:00
Simon Kelley
0b8a5a30a7
Protect against broken DNSSEC upstreams.
2015-03-27 11:44:55 +00:00
Simon Kelley
8805283088
Don't fail DNSSEC when a signed CNAME dangles into an unsigned zone.
2015-03-26 21:15:43 +00:00
Simon Kelley
360f2513ab
Tweak DNSSEC timestamp code to create file later, removing need to chown it.
2015-03-07 18:28:06 +00:00
Simon Kelley
9003b50b13
Fix last commit to not crash if uid changing not configured.
2015-03-02 22:47:23 +00:00
Simon Kelley
f6e62e2af9
Add --dnssec-timestamp option and facility.
2015-03-01 18:17:54 +00:00
Simon Kelley
6ef15b34ca
Fix broken ECDSA DNSSEC signatures.
2015-01-31 22:44:26 +00:00
Simon Kelley
aff3396280
Update copyrights for dawn of 2015.
2015-01-31 20:13:40 +00:00
Simon Kelley
5e321739db
Don't answer from cache RRsets from wildcards, as we don't have NSECs.
2015-01-12 23:16:56 +00:00
Simon Kelley
25cf5e373e
Add --log-queries=extra option for more complete logging.
2015-01-09 15:53:03 +00:00
Simon Kelley
97e618a0e3
DNSSEC: do top-down search for limit of secure delegation.
2015-01-07 21:55:43 +00:00
Simon Kelley
0b1008d367
Bad packet protection.
2014-12-27 15:33:32 +00:00
Simon Kelley
83d2ed09fc
Initialise return value.
2014-12-23 18:42:38 +00:00
Simon Kelley
fbc5205702
Fix problems validating NSEC3 and wildcards.
2014-12-23 15:46:08 +00:00
Simon Kelley
094b5c3d90
Fix crash in DNSSEC code when attempting to verify large RRs.
2014-12-21 16:11:52 +00:00
Simon Kelley
cdb755c5f1
Fix FTBFS with Nettle-3.0.
2014-06-18 20:52:53 +01:00
Simon Kelley
063efb330a
Build config: add -DNO_GMP for use with nettle/mini-gmp
2014-06-17 19:49:31 +01:00
Simon Kelley
e6096e643a
Another filter_rrsigs fix.
2014-05-01 18:19:12 +01:00
Simon Kelley
9d1b22aac2
Fix DNSSEC validation of ANY queries.
2014-04-29 13:02:41 +01:00
Simon Kelley
50f86ce8e4
Need to fixup records in the additional section when removing DNSSEC stuff.
2014-04-24 17:59:58 +01:00
Simon Kelley
e98bd52e25
Add --dnssec-no-timecheck
2014-03-28 20:41:23 +00:00
Simon Kelley
3f7483e816
Handle integer overflow in uid counter. Fixes rare crashes in cache code.
2014-03-16 22:56:58 +00:00
Simon Kelley
c07d30dcb1
Compiler warning.
2014-03-03 14:19:19 +00:00
Simon Kelley
8707019237
Mass edit of INSECURE->BOGUS returns for server failure/bad input.
2014-03-01 20:48:24 +00:00
Simon Kelley
1fbe4d2f5f
Tweak tuning params.
2014-03-01 20:03:47 +00:00
Simon Kelley
0575610fa1
Handle replies with no answers and no NS in validate_reply.
2014-03-01 18:07:57 +00:00
Simon Kelley
e3f1455850
Don't free blockdata for negative DS cache entries.
2014-03-01 17:58:28 +00:00
Simon Kelley
bd9b3cf55b
Fix off-by-one overwrite.
2014-03-01 16:12:28 +00:00
Simon Kelley
14db4212ab
Tidy.
2014-03-01 15:35:50 +00:00
Simon Kelley
00a5b5d477
Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.
2014-02-28 18:10:55 +00:00
Simon Kelley
b8eac19177
Negative caching for DS records.
2014-02-27 14:30:03 +00:00
Simon Kelley
b47b04c846
Return INSECURE when validation fails with proved non-existent DS.
2014-02-25 23:13:28 +00:00
Simon Kelley
613ad15d02
Strip DNSSEC RRs when query doesn't have DO bit set.
2014-02-25 23:02:28 +00:00
Simon Kelley
24187530fb
Speeling.
2014-02-24 21:46:44 +00:00
Simon Kelley
a857daa351
Code cleanup.
2014-02-24 21:01:09 +00:00
Simon Kelley
f01d7be6c6
An NSEC record cannot attest to its own non-existance!
2014-02-24 20:20:00 +00:00
Simon Kelley
d387380a25
Check signer name in RRSIGs.
2014-02-23 16:20:46 +00:00
Simon Kelley
f2e4c277c4
Bugfix for last commit.
2014-02-23 15:24:26 +00:00
Simon Kelley
5107ace14a
NSEC3 validation. First pass.
2014-02-23 10:48:32 +00:00
Simon Kelley
7b1eae4f50
Add --servers-file option.
2014-02-20 13:43:28 +00:00
Simon Kelley
c152dc8492
Omit ECC from DNSSEC if nettle library is old.
2014-02-19 18:14:33 +00:00
Simon Kelley
e3ec15af10
Log BOGUS validation result when upstream sends SERVFAIL.
2014-02-13 16:56:30 +00:00
Simon Kelley
ebe95a831f
Add RFC-6605 ECDSA DNSSEC verification.
2014-02-13 14:56:10 +00:00
Simon Kelley
1633e30834
Fix Byte-order botch: broke DNSSEC on big-endian platforms.
2014-02-10 16:42:46 +00:00
Simon Kelley
c8ca33f810
Fix DNSSEC caching problems: incomplete RRSIG RRsets.
2014-02-10 10:35:42 +00:00
Simon Kelley
610e782a29
Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.
2014-02-06 14:45:17 +00:00
Simon Kelley
bb201c211a
Protect against malicious DNS replies with very large RRsets.
2014-02-06 12:01:05 +00:00
Simon Kelley
b98d22c191
Linking stuff. Latest Debian/Ubuntu don't automatically link gmp.
2014-02-04 18:09:30 +00:00
