Simon Kelley
ee4158678a
Use DS records as trust anchors, not DNSKEYs.
...
This allows us to query for the root zone DNSKEY RRset and validate
it, thus automatically handling KSK rollover.
2014-02-11 11:07:22 +00:00
Simon Kelley
83349b8aa4
Further tidying of AD and DO bit handling.
2014-02-10 21:02:01 +00:00
Simon Kelley
7fa836e105
Handle validation when more one key is needed.
2014-02-10 20:11:24 +00:00
Simon Kelley
1633e30834
Fix Byte-order botch: broke DNSSEC on big-endian platforms.
2014-02-10 16:42:46 +00:00
Simon Kelley
c8ca33f810
Fix DNSSEC caching problems: incomplete RRSIG RRsets.
2014-02-10 10:35:42 +00:00
Simon Kelley
e243c072b5
AD bit in queries handled as RFC6840 p5.7
2014-02-06 18:14:09 +00:00
Simon Kelley
610e782a29
Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.
2014-02-06 14:45:17 +00:00
Simon Kelley
bb201c211a
Protect against malicious DNS replies with very large RRsets.
2014-02-06 12:01:05 +00:00
Simon Kelley
12fae49fff
Make RR work when returning A/AAAA records and an RRSIG.
2014-02-04 22:03:06 +00:00
Simon Kelley
b98d22c191
Linking stuff. Latest Debian/Ubuntu don't automatically link gmp.
2014-02-04 18:09:30 +00:00
Simon Kelley
81a883fda3
Format tweak.
2014-02-03 21:17:04 +00:00
Simon Kelley
40b695c1f1
Log NXDOMAIN correctly.
2014-02-03 17:07:51 +00:00
Simon Kelley
5f938534a9
Return configured DNSKEYs even though we don't have RRSIGS for them.
2014-02-03 16:44:32 +00:00
Simon Kelley
8d718cbb3e
Nasty cache failure and memory leak with DNSSEC.
2014-02-03 16:27:37 +00:00
Simon Kelley
f6a2b79310
Validate Ooops.
2014-02-01 14:54:26 +00:00
Simon Kelley
82e3f45a9f
Blockdata fixes and tuning.
2014-01-31 21:05:48 +00:00
Simon Kelley
072e81b3c5
Blockdata leak.
2014-01-31 12:42:54 +00:00
Simon Kelley
1d97ac4fd2
copy-n-paste error.
2014-01-31 11:12:27 +00:00
Simon Kelley
db73746620
Anounce DNSSEC at startup.
2014-01-31 10:32:45 +00:00
Simon Kelley
97bc798b05
Init ->dependent field in frec allocation.
2014-01-31 10:19:52 +00:00
Simon Kelley
edc231bc58
Compiler warning.
2014-01-31 09:52:50 +00:00
Simon Kelley
583043f527
Crash in cache code when compiled with HAVE_DNSSEC.
2014-01-28 14:54:46 +00:00
Simon Kelley
7c28612a59
Trivial format fix.
2014-01-27 21:38:11 +00:00
Simon Kelley
6f4681034e
Code tidy.
2014-01-26 23:39:17 +00:00
Simon Kelley
6938f3476e
Don't mark answers as DNSEC validated if DNS-doctored.
2014-01-26 22:47:39 +00:00
Simon Kelley
17fb9ea763
Exclude CRC code in DNSSEC build - replaced with SHA1.
2014-01-26 09:36:54 +00:00
Simon Kelley
7d23a66ff0
Remove --dnssec-permissive, pointless if we don't set CD upstream.
2014-01-26 09:33:21 +00:00
Simon Kelley
703c7ff429
Fix to last commit.
2014-01-25 23:46:23 +00:00
Simon Kelley
8a9be9e493
Replace CRC32 with SHA1 for spoof detection in DNSSEC builds.
2014-01-25 23:17:21 +00:00
Simon Kelley
c92f0083a2
Get AA flag right in DNSSEC answers from cache.
2014-01-25 18:43:59 +00:00
Simon Kelley
b5dbfd142a
RRSIG answer logging.
2014-01-25 18:19:51 +00:00
Simon Kelley
cbf13a2a6d
Class specifier in --dnskey, instead of hardwiring C_IN.
2014-01-25 17:59:14 +00:00
Simon Kelley
5b3bf92101
--dnssec-debug
2014-01-25 17:03:07 +00:00
Simon Kelley
0744ca66ad
More DNSSEC caching logic, and avoid repeated validation of DS/DNSKEY
2014-01-25 16:40:15 +00:00
Simon Kelley
2d33bda2e6
RRSIGS for PTR records from cache.
2014-01-24 22:37:25 +00:00
Simon Kelley
32f90c0fad
Tweak.
2014-01-24 10:37:36 +00:00
Simon Kelley
bce6e1bc6d
RRSIGs in DS and DNSKEY cached answers.
2014-01-23 22:02:19 +00:00
Simon Kelley
824202ef54
More DNSSEC cache readout.
2014-01-23 20:59:46 +00:00
Simon Kelley
9ebfca1e84
Compiler warning.
2014-01-23 12:11:43 +00:00
Simon Kelley
6429e421b3
Compiler warning.
2014-01-23 12:09:36 +00:00
Simon Kelley
c9bfa948c3
remove redundant headerage
2014-01-22 22:32:33 +00:00
Simon Kelley
e7829aefd8
Cache RRSIGS.
2014-01-22 22:21:51 +00:00
Simon Kelley
51ea3ca254
Caching of DNSSEC records.
2014-01-22 19:31:38 +00:00
Jonas Gorski
57ab36e77d
Tweak definition of a permanent IPv6 address on Linux.
...
The linux kernel treats all addresses with a limited lifetime as being
non permanent, but when taking over the prefix livetimes from
upstream assigned prefixes through DHCP, addresses will always have a limited
lifetime.
Still reject temporary addresses, as they indicate autoconfigured
interfaces.
Contributed by T-Labs, Deutsche Telekom Innovation Laboratories
Signed-off-by: Jonas Gorski<jogo@openwrt.org >
2014-01-22 11:34:16 +00:00
Simon Kelley
dd0e0a3995
Handle time_t wraparound more sanely.
2014-01-22 11:16:59 +00:00
Simon Kelley
6fd6dacb39
Fix loop in RR sort.
2014-01-21 20:17:40 +00:00
Simon Kelley
39048ad10b
bug fix, avoids infinite loop in forwarding code.
2014-01-21 17:33:58 +00:00
Simon Kelley
979cdf9b64
Fix to hostname_cmp, and update to canonicalisation table. RFC 4034 LIES.
2014-01-21 16:26:41 +00:00
Simon Kelley
dbf721235b
Rationalise hostname_cmp()
2014-01-21 14:28:02 +00:00
Simon Kelley
c979fa04a4
Provide for static library linking.
2014-01-21 13:45:17 +00:00
Simon Kelley