Simon Kelley
604f7598c2
CHANGELOG update.
2014-03-22 19:33:43 +00:00
Simon Kelley
2a7a2b84ec
Ignore DNS queries from port 0: http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html
2014-03-22 19:18:06 +00:00
Andy
3e21a1a6fa
Tidy uid defines.
2014-03-22 19:10:07 +00:00
Simon Kelley
2b29191e7c
Fix DNSSEC crash retrying to IPv6 server.
2014-03-21 11:13:55 +00:00
Simon Kelley
03431d6373
Initialise uid when creating CNAME cache record.
2014-03-20 16:25:43 +00:00
Simon Kelley
cc1a29e250
Make --quiet-dhcp apply to DHCPDISCOVER when client ignored.
2014-03-20 15:47:18 +00:00
Moritz Warning
e62e9b6187
Manpage typos.
2014-03-20 15:32:22 +00:00
Simon Kelley
19c51cfa49
Tidy and fix cache->uid handling.
...
Some CNAMES left the value of ->uid undefined.
Since there are now special values if this, for CNAMES
to interface names, that could cause a crash
if the undefined value hit the special value.
Also ensure that the special value can't arise
when the uid is encoding the source of an F_CONFIG
record, in case there's a CNAME to it.
2014-03-18 22:38:30 +00:00
Andy
d5082158ee
Ensure next_uid() can never return 0.
2014-03-17 19:50:29 +00:00
Simon Kelley
3f7483e816
Handle integer overflow in uid counter. Fixes rare crashes in cache code.
2014-03-16 22:56:58 +00:00
Simon Kelley
0c8584eabc
Warn about non-local queries once only for UDP.
2014-03-12 20:12:56 +00:00
Simon Kelley
f00690f93e
Typo
2014-03-12 20:07:12 +00:00
Simon Kelley
89b12ed35b
OPT_LOCAL_SERVICE needs up-to-date interface list too.
2014-03-06 13:27:57 +00:00
Simon Kelley
1a9a3489ec
Set --local-service in Debian package startup.
2014-03-05 15:01:08 +00:00
Simon Kelley
c8a80487cd
--local-service. Default protection from DNS amplification attacks.
2014-03-05 14:29:54 +00:00
Simon Kelley
4ea8e80dd9
Add --static to pkg-config command when appropriate.
2014-03-05 11:01:23 +00:00
Simon Kelley
c07d30dcb1
Compiler warning.
2014-03-03 14:19:19 +00:00
Simon Kelley
d588ab54d4
Man page updates for DNSSEC.
2014-03-02 14:30:05 +00:00
Simon Kelley
f8b422a7b6
KEYBLOCK LEN better as a multiple of 8.
2014-03-02 12:46:51 +00:00
Simon Kelley
29fe922b14
Can have local DS records (trust anchors).
2014-03-01 22:53:57 +00:00
Simon Kelley
8707019237
Mass edit of INSECURE->BOGUS returns for server failure/bad input.
2014-03-01 20:48:24 +00:00
Simon Kelley
d1fbb77e0f
Don't cache secure replies which we've messsed with.
2014-03-01 20:08:58 +00:00
Simon Kelley
1fbe4d2f5f
Tweak tuning params.
2014-03-01 20:03:47 +00:00
Simon Kelley
0575610fa1
Handle replies with no answers and no NS in validate_reply.
2014-03-01 18:07:57 +00:00
Simon Kelley
e3f1455850
Don't free blockdata for negative DS cache entries.
2014-03-01 17:58:28 +00:00
Simon Kelley
bd9b3cf55b
Fix off-by-one overwrite.
2014-03-01 16:12:28 +00:00
Simon Kelley
14db4212ab
Tidy.
2014-03-01 15:35:50 +00:00
Simon Kelley
00a5b5d477
Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.
2014-02-28 18:10:55 +00:00
Simon Kelley
b8eac19177
Negative caching for DS records.
2014-02-27 14:30:03 +00:00
Simon Kelley
b47b04c846
Return INSECURE when validation fails with proved non-existent DS.
2014-02-25 23:13:28 +00:00
Simon Kelley
613ad15d02
Strip DNSSEC RRs when query doesn't have DO bit set.
2014-02-25 23:02:28 +00:00
Simon Kelley
24187530fb
Speeling.
2014-02-24 21:46:44 +00:00
Simon Kelley
a857daa351
Code cleanup.
2014-02-24 21:01:09 +00:00
Simon Kelley
f01d7be6c6
An NSEC record cannot attest to its own non-existance!
2014-02-24 20:20:00 +00:00
Simon Kelley
d387380a25
Check signer name in RRSIGs.
2014-02-23 16:20:46 +00:00
Simon Kelley
f2e4c277c4
Bugfix for last commit.
2014-02-23 15:24:26 +00:00
Simon Kelley
5107ace14a
NSEC3 validation. First pass.
2014-02-23 10:48:32 +00:00
Simon Kelley
7b1eae4f50
Add --servers-file option.
2014-02-20 13:43:28 +00:00
Simon Kelley
c152dc8492
Omit ECC from DNSSEC if nettle library is old.
2014-02-19 18:14:33 +00:00
Simon Kelley
7bcca0060f
More server cleanup.
2014-02-19 17:45:17 +00:00
Simon Kelley
d68c2ca2b7
Cleanup of server reading code, preparation, for dynamic reading from files.
2014-02-18 22:30:30 +00:00
Simon Kelley
de73a497ca
--rev-server option. Syntactic sugar for PTR queries.
2014-02-17 21:43:27 +00:00
Simon Kelley
e3ec15af10
Log BOGUS validation result when upstream sends SERVFAIL.
2014-02-13 16:56:30 +00:00
Simon Kelley
dac74312da
TYpo.
2014-02-13 16:43:49 +00:00
Simon Kelley
2ecd9bd5c0
No CD in forwarded queries unless dnssec-debug for TCP too.
2014-02-13 16:42:02 +00:00
Simon Kelley
a0ab18f6eb
Don't mess with the TTL of DNSSEC RRs.
2014-02-13 16:38:23 +00:00
Simon Kelley
ebe95a831f
Add RFC-6605 ECDSA DNSSEC verification.
2014-02-13 14:56:10 +00:00
Simon Kelley
ee4158678a
Use DS records as trust anchors, not DNSKEYs.
...
This allows us to query for the root zone DNSKEY RRset and validate
it, thus automatically handling KSK rollover.
2014-02-11 11:07:22 +00:00
Simon Kelley
83349b8aa4
Further tidying of AD and DO bit handling.
2014-02-10 21:02:01 +00:00
Simon Kelley
7fa836e105
Handle validation when more one key is needed.
2014-02-10 20:11:24 +00:00
Simon Kelley