 Simon Kelley
|
c8a80487cd
|
--local-service. Default protection from DNS amplification attacks.
|
2014-03-05 14:29:54 +00:00 |
|
|
Simon Kelley
|
4ea8e80dd9
|
Add --static to pkg-config command when appropriate.
|
2014-03-05 11:01:23 +00:00 |
|
|
Simon Kelley
|
c07d30dcb1
|
Compiler warning.
|
2014-03-03 14:19:19 +00:00 |
|
|
Simon Kelley
|
d588ab54d4
|
Man page updates for DNSSEC.
|
2014-03-02 14:30:05 +00:00 |
|
|
Simon Kelley
|
f8b422a7b6
|
KEYBLOCK LEN better as a multiple of 8.
|
2014-03-02 12:46:51 +00:00 |
|
|
Simon Kelley
|
29fe922b14
|
Can have local DS records (trust anchors).
v2.69test11
|
2014-03-01 22:53:57 +00:00 |
|
|
Simon Kelley
|
8707019237
|
Mass edit of INSECURE->BOGUS returns for server failure/bad input.
v2.69test10
|
2014-03-01 20:48:24 +00:00 |
|
|
Simon Kelley
|
d1fbb77e0f
|
Don't cache secure replies which we've messsed with.
|
2014-03-01 20:08:58 +00:00 |
|
|
Simon Kelley
|
1fbe4d2f5f
|
Tweak tuning params.
|
2014-03-01 20:03:47 +00:00 |
|
|
Simon Kelley
|
0575610fa1
|
Handle replies with no answers and no NS in validate_reply.
|
2014-03-01 18:07:57 +00:00 |
|
|
Simon Kelley
|
e3f1455850
|
Don't free blockdata for negative DS cache entries.
|
2014-03-01 17:58:28 +00:00 |
|
|
Simon Kelley
|
bd9b3cf55b
|
Fix off-by-one overwrite.
|
2014-03-01 16:12:28 +00:00 |
|
|
Simon Kelley
|
14db4212ab
|
Tidy.
|
2014-03-01 15:35:50 +00:00 |
|
|
Simon Kelley
|
00a5b5d477
|
Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.
|
2014-02-28 18:10:55 +00:00 |
|
|
Simon Kelley
|
b8eac19177
|
Negative caching for DS records.
|
2014-02-27 14:30:03 +00:00 |
|
|
Simon Kelley
|
b47b04c846
|
Return INSECURE when validation fails with proved non-existent DS.
|
2014-02-25 23:13:28 +00:00 |
|
|
Simon Kelley
|
613ad15d02
|
Strip DNSSEC RRs when query doesn't have DO bit set.
|
2014-02-25 23:02:28 +00:00 |
|
|
Simon Kelley
|
24187530fb
|
Speeling.
|
2014-02-24 21:46:44 +00:00 |
|
|
Simon Kelley
|
a857daa351
|
Code cleanup.
v2.69test9
|
2014-02-24 21:01:09 +00:00 |
|
|
Simon Kelley
|
f01d7be6c6
|
An NSEC record cannot attest to its own non-existance!
|
2014-02-24 20:20:00 +00:00 |
|
|
Simon Kelley
|
d387380a25
|
Check signer name in RRSIGs.
|
2014-02-23 16:20:46 +00:00 |
|
|
Simon Kelley
|
f2e4c277c4
|
Bugfix for last commit.
|
2014-02-23 15:24:26 +00:00 |
|
|
Simon Kelley
|
5107ace14a
|
NSEC3 validation. First pass.
|
2014-02-23 10:48:32 +00:00 |
|
|
Simon Kelley
|
7b1eae4f50
|
Add --servers-file option.
|
2014-02-20 13:43:28 +00:00 |
|
|
Simon Kelley
|
c152dc8492
|
Omit ECC from DNSSEC if nettle library is old.
|
2014-02-19 18:14:33 +00:00 |
|
|
Simon Kelley
|
7bcca0060f
|
More server cleanup.
|
2014-02-19 17:45:17 +00:00 |
|
|
Simon Kelley
|
d68c2ca2b7
|
Cleanup of server reading code, preparation, for dynamic reading from files.
|
2014-02-18 22:30:30 +00:00 |
|
|
Simon Kelley
|
de73a497ca
|
--rev-server option. Syntactic sugar for PTR queries.
|
2014-02-17 21:43:27 +00:00 |
|
|
Simon Kelley
|
e3ec15af10
|
Log BOGUS validation result when upstream sends SERVFAIL.
|
2014-02-13 16:56:30 +00:00 |
|
|
Simon Kelley
|
dac74312da
|
TYpo.
|
2014-02-13 16:43:49 +00:00 |
|
|
Simon Kelley
|
2ecd9bd5c0
|
No CD in forwarded queries unless dnssec-debug for TCP too.
|
2014-02-13 16:42:02 +00:00 |
|
|
Simon Kelley
|
a0ab18f6eb
|
Don't mess with the TTL of DNSSEC RRs.
|
2014-02-13 16:38:23 +00:00 |
|
|
Simon Kelley
|
ebe95a831f
|
Add RFC-6605 ECDSA DNSSEC verification.
|
2014-02-13 14:56:10 +00:00 |
|
|
Simon Kelley
|
ee4158678a
|
Use DS records as trust anchors, not DNSKEYs.
This allows us to query for the root zone DNSKEY RRset and validate
it, thus automatically handling KSK rollover.
v2.69test8
|
2014-02-11 11:07:22 +00:00 |
|
|
Simon Kelley
|
83349b8aa4
|
Further tidying of AD and DO bit handling.
|
2014-02-10 21:02:01 +00:00 |
|
|
Simon Kelley
|
7fa836e105
|
Handle validation when more one key is needed.
|
2014-02-10 20:11:24 +00:00 |
|
|
Simon Kelley
|
1633e30834
|
Fix Byte-order botch: broke DNSSEC on big-endian platforms.
|
2014-02-10 16:42:46 +00:00 |
|
|
Simon Kelley
|
c8ca33f810
|
Fix DNSSEC caching problems: incomplete RRSIG RRsets.
|
2014-02-10 10:35:42 +00:00 |
|
|
Simon Kelley
|
e243c072b5
|
AD bit in queries handled as RFC6840 p5.7
|
2014-02-06 18:14:09 +00:00 |
|
|
Simon Kelley
|
da4f372271
|
Add trust-anchors file to Debian package.
v2.69test7
|
2014-02-06 15:21:37 +00:00 |
|
|
Simon Kelley
|
610e782a29
|
Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.
|
2014-02-06 14:45:17 +00:00 |
|
|
Simon Kelley
|
854cf26907
|
DNSSEC config in example file.
|
2014-02-06 12:07:10 +00:00 |
|
|
Simon Kelley
|
bb201c211a
|
Protect against malicious DNS replies with very large RRsets.
|
2014-02-06 12:01:05 +00:00 |
|
|
Simon Kelley
|
12fae49fff
|
Make RR work when returning A/AAAA records and an RRSIG.
|
2014-02-04 22:03:06 +00:00 |
|
|
Jesse Glick
|
fd372273bd
|
Updated version of contrib/try-all-ns
v2.69test6
|
2014-02-04 20:20:35 +00:00 |
|
|
Simon Kelley
|
b98d22c191
|
Linking stuff. Latest Debian/Ubuntu don't automatically link gmp.
|
2014-02-04 18:09:30 +00:00 |
|
|
Simon Kelley
|
160f6507c3
|
Make DNSEC default, add build-depends for same, bump version.
|
2014-02-04 16:49:41 +00:00 |
|
|
Simon Kelley
|
613d6c5249
|
CHANGLEOG for DNSSEC.
v2.69test5
|
2014-02-04 11:50:11 +00:00 |
|
|
Simon Kelley
|
81a883fda3
|
Format tweak.
v2.69test4
|
2014-02-03 21:17:04 +00:00 |
|
|
Simon Kelley
|
40b695c1f1
|
Log NXDOMAIN correctly.
|
2014-02-03 17:07:51 +00:00 |
|