Simon Kelley
c8a80487cd
--local-service. Default protection from DNS amplification attacks.
2014-03-05 14:29:54 +00:00
Simon Kelley
00a5b5d477
Check that unsigned replies come from unsigned zones if --dnssec-check-unsigned set.
2014-02-28 18:10:55 +00:00
Simon Kelley
613ad15d02
Strip DNSSEC RRs when query doesn't have DO bit set.
2014-02-25 23:02:28 +00:00
Simon Kelley
5107ace14a
NSEC3 validation. First pass.
2014-02-23 10:48:32 +00:00
Simon Kelley
7b1eae4f50
Add --servers-file option.
2014-02-20 13:43:28 +00:00
Simon Kelley
d68c2ca2b7
Cleanup of server reading code, preparation, for dynamic reading from files.
2014-02-18 22:30:30 +00:00
Simon Kelley
ee4158678a
Use DS records as trust anchors, not DNSKEYs.
...
This allows us to query for the root zone DNSKEY RRset and validate
it, thus automatically handling KSK rollover.
2014-02-11 11:07:22 +00:00
Simon Kelley
83349b8aa4
Further tidying of AD and DO bit handling.
2014-02-10 21:02:01 +00:00
Simon Kelley
7fa836e105
Handle validation when more one key is needed.
2014-02-10 20:11:24 +00:00
Simon Kelley
610e782a29
Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch.
2014-02-06 14:45:17 +00:00
Simon Kelley
12fae49fff
Make RR work when returning A/AAAA records and an RRSIG.
2014-02-04 22:03:06 +00:00
Simon Kelley
82e3f45a9f
Blockdata fixes and tuning.
2014-01-31 21:05:48 +00:00
Simon Kelley
6938f3476e
Don't mark answers as DNSEC validated if DNS-doctored.
2014-01-26 22:47:39 +00:00
Simon Kelley
8a9be9e493
Replace CRC32 with SHA1 for spoof detection in DNSSEC builds.
2014-01-25 23:17:21 +00:00
Simon Kelley
cbf13a2a6d
Class specifier in --dnskey, instead of hardwiring C_IN.
2014-01-25 17:59:14 +00:00
Simon Kelley
5b3bf92101
--dnssec-debug
2014-01-25 17:03:07 +00:00
Simon Kelley
824202ef54
More DNSSEC cache readout.
2014-01-23 20:59:46 +00:00
Simon Kelley
c9bfa948c3
remove redundant headerage
2014-01-22 22:32:33 +00:00
Simon Kelley
e7829aefd8
Cache RRSIGS.
2014-01-22 22:21:51 +00:00
Simon Kelley
51ea3ca254
Caching of DNSSEC records.
2014-01-22 19:31:38 +00:00
Simon Kelley
5d3b87a484
Better handling of truncated DNSSEC replies.
2014-01-20 11:57:23 +00:00
Simon Kelley
a25720a34a
protocol handling for DNSSEC
2014-01-14 23:13:55 +00:00
Simon Kelley
86bec2d399
Swap crypto library from openSSL to nettle.
2014-01-13 21:31:20 +00:00
Simon Kelley
c3a04081ff
[fd00::} and [fe80::] special addresses in DHCPv6 options.
2014-01-11 22:18:19 +00:00
Simon Kelley
5f8e58f49b
DNSSEC consolidation.
2014-01-09 17:31:19 +00:00
Simon Kelley
b6e9e7c32d
Handle digest lengths greater than 1 block.
2014-01-08 21:21:20 +00:00
Simon Kelley
c2207688c0
Memory stats for DNSSEC.
2014-01-08 18:04:20 +00:00
Simon Kelley
98c098bfc7
Move blockdata to it's own file.
2014-01-08 17:31:16 +00:00
Simon Kelley
c47e3ba446
Update copyright for 2014.
2014-01-08 17:07:54 +00:00
Simon Kelley
60b68069cf
Rationalise DNS packet-buffer size calculations.
2014-01-08 12:10:28 +00:00
Simon Kelley
0fc2f31368
First functional DNSSEC - highly alpha.
2014-01-08 10:26:58 +00:00
Simon Kelley
c3e0b9b6e7
backup
2013-12-31 13:50:39 +00:00
Simon Kelley
963c380d13
Merge branch 'master' into dnssec
2013-12-18 17:45:31 +00:00
Simon Kelley
875b8160f6
Remove unused code.
2013-12-17 17:40:32 +00:00
Simon Kelley
9d633048fe
Saving progress
2013-12-13 15:36:55 +00:00
Simon Kelley
a9b55837dc
Merge branch 'master' into dnssec
2013-12-12 14:53:46 +00:00
Simon Kelley
c352dd8f1a
Merge branch 'master' into dnssec
2013-12-12 12:16:17 +00:00
Simon Kelley
3a2371527f
Commit to allow master merge.
2013-12-12 12:15:50 +00:00
Simon Kelley
1ee9be4c3f
Implement dynamic interface discovery on *BSD
2013-12-09 16:50:19 +00:00
Simon Kelley
08619211f8
Garbage collect listening sockets when their address is deleted.
...
In --bind-dynamic mode, stop listening on an address when it's
removed from an interface. 6rd and 6to4 tunnels can go through
lots of addresses.
2013-12-02 14:43:48 +00:00
Simon Kelley
f7029f5c08
Extend /4 and /6 syntax to --interface-name
2013-11-21 15:10:02 +00:00
Simon Kelley
06e54b823e
Merge branch 'master' into dnssec
2013-11-14 10:39:40 +00:00
Simon Kelley
376d48c7f1
Allow interface name to specify subnets in --auth-zone.
2013-11-13 13:04:30 +00:00
Simon Kelley
6586e8352a
Use random address allocation for DHCPv6 temporary addresses.
2013-11-07 14:20:13 +00:00
Simon Kelley
3511a92869
Fix start-up order for making DHCPv6 DUID
...
Previously, if the DUID wasn't read from the lease-file or
script, a new one was created _after_ the helper process fork,
so for that first run, the script calls got an empty DUID.
Also, use a DUID_LL format DUID when there's no stable lease
storage, as well as when the RTC is broken. That has a chance of
evaluating to the same value on each startup.
2013-11-07 10:28:11 +00:00
Simon Kelley
5a4120dbfb
Merge branch 'master' into dnssec
...
Conflicts:
src/dnsmasq.h
src/forward.c
src/option.c
2013-10-25 13:16:27 +01:00
Simon Kelley
19b1689161
Don't filter by subnet when handling local queries for auth-zones.
2013-10-20 10:19:39 +01:00
Simon Kelley
b485ed97aa
Always answer queries for authoritative zones locally, never forward.
2013-10-18 22:00:39 +01:00
Simon Kelley
dc27e148a1
Warning when using --bind-interfaces and routeable addresses.
2013-10-16 14:33:23 +01:00
Simon Kelley
3b3f441189
Log SO_BINDTODEVICE use at startup.
2013-10-11 16:33:28 +01:00
Simon Kelley