wt/dnsmasq
1
0 Fork 0
mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-16 10:49:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
782 Commits 1 Branch 397 Tags
ebe95a831fe8f0cd27ca5aef428fbc5552f6cc80
Commit Graph
782 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Simon Kelley ebe95a831f Add RFC-6605 ECDSA DNSSEC verification. 2014-02-13 14:56:10 +00:00
Simon Kelley ee4158678a Use DS records as trust anchors, not DNSKEYs. 
This allows us to query for the root zone DNSKEY RRset and validate
it, thus automatically handling KSK rollover.
v2.69test8 		2014-02-11 11:07:22 +00:00
Simon Kelley 83349b8aa4 Further tidying of AD and DO bit handling. 2014-02-10 21:02:01 +00:00
Simon Kelley 7fa836e105 Handle validation when more one key is needed. 2014-02-10 20:11:24 +00:00
Simon Kelley 1633e30834 Fix Byte-order botch: broke DNSSEC on big-endian platforms. 2014-02-10 16:42:46 +00:00
Simon Kelley c8ca33f810 Fix DNSSEC caching problems: incomplete RRSIG RRsets. 2014-02-10 10:35:42 +00:00
Simon Kelley e243c072b5 AD bit in queries handled as RFC6840 p5.7 2014-02-06 18:14:09 +00:00
Simon Kelley da4f372271 Add trust-anchors file to Debian package. v2.69test7 2014-02-06 15:21:37 +00:00
Simon Kelley 610e782a29 Fix stack-smashing crash in DNSSEC. Thanks to Henk Jan Agteresch. 2014-02-06 14:45:17 +00:00
Simon Kelley 854cf26907 DNSSEC config in example file. 2014-02-06 12:07:10 +00:00
Simon Kelley bb201c211a Protect against malicious DNS replies with very large RRsets. 2014-02-06 12:01:05 +00:00
Simon Kelley 12fae49fff Make RR work when returning A/AAAA records and an RRSIG. 2014-02-04 22:03:06 +00:00
Jesse Glick fd372273bd Updated version of contrib/try-all-ns v2.69test6 2014-02-04 20:20:35 +00:00
Simon Kelley b98d22c191 Linking stuff. Latest Debian/Ubuntu don't automatically link gmp. 2014-02-04 18:09:30 +00:00
Simon Kelley 160f6507c3 Make DNSEC default, add build-depends for same, bump version. 2014-02-04 16:49:41 +00:00
Simon Kelley 613d6c5249 CHANGLEOG for DNSSEC. v2.69test5 2014-02-04 11:50:11 +00:00
Simon Kelley 81a883fda3 Format tweak. v2.69test4 2014-02-03 21:17:04 +00:00
Simon Kelley 40b695c1f1 Log NXDOMAIN correctly. 2014-02-03 17:07:51 +00:00
Simon Kelley 5f938534a9 Return configured DNSKEYs even though we don't have RRSIGS for them. 2014-02-03 16:44:32 +00:00
Simon Kelley 8d718cbb3e Nasty cache failure and memory leak with DNSSEC. 2014-02-03 16:27:37 +00:00
Simon Kelley f6a2b79310 Validate Ooops. 2014-02-01 14:54:26 +00:00
Simon Kelley 82e3f45a9f Blockdata fixes and tuning. 2014-01-31 21:05:48 +00:00
Simon Kelley 072e81b3c5 Blockdata leak. 2014-01-31 12:42:54 +00:00
Simon Kelley 1d97ac4fd2 copy-n-paste error. 2014-01-31 11:12:27 +00:00
Simon Kelley db73746620 Anounce DNSSEC at startup. 2014-01-31 10:32:45 +00:00
Simon Kelley 97bc798b05 Init ->dependent field in frec allocation. 2014-01-31 10:19:52 +00:00
Simon Kelley edc231bc58 Compiler warning. 2014-01-31 09:52:50 +00:00
Simon Kelley b85e092e23 Add a file containing current root trust anchors, for convenience. 2014-01-30 09:49:28 +00:00
Simon Kelley 583043f527 Crash in cache code when compiled with HAVE_DNSSEC. 2014-01-28 14:54:46 +00:00
Simon Kelley 8f6213cce9 Allow use of COPTS in Debian rules invokation for nefarious purposes. 2014-01-28 11:16:49 +00:00
Simon Kelley 00ec693db8 Debian package with DNSSEC now possible. 
DNSSEC will eventually become opt-out and when that happens
I'll add libnettle build-depends. For now, build with

fakeroot debian/rules DEB_BUILD_OPTIONS=usednssec

to get DNSSEC support.
 2014-01-28 11:08:57 +00:00
Simon Kelley 70b4a818ef Man page entries for DNSSEC flags. 2014-01-27 22:38:48 +00:00
Simon Kelley 7c28612a59 Trivial format fix. 2014-01-27 21:38:11 +00:00
Simon Kelley 6f4681034e Code tidy. 2014-01-26 23:39:17 +00:00
Simon Kelley 6938f3476e Don't mark answers as DNSEC validated if DNS-doctored. 2014-01-26 22:47:39 +00:00
Simon Kelley 17fb9ea763 Exclude CRC code in DNSSEC build - replaced with SHA1. 2014-01-26 09:36:54 +00:00
Simon Kelley 7d23a66ff0 Remove --dnssec-permissive, pointless if we don't set CD upstream. 2014-01-26 09:33:21 +00:00
Simon Kelley 703c7ff429 Fix to last commit. 2014-01-25 23:46:23 +00:00
Simon Kelley 8a9be9e493 Replace CRC32 with SHA1 for spoof detection in DNSSEC builds. 2014-01-25 23:17:21 +00:00
Simon Kelley c92f0083a2 Get AA flag right in DNSSEC answers from cache. 2014-01-25 18:43:59 +00:00
Simon Kelley b5dbfd142a RRSIG answer logging. 2014-01-25 18:19:51 +00:00
Simon Kelley cbf13a2a6d Class specifier in --dnskey, instead of hardwiring C_IN. 2014-01-25 17:59:14 +00:00
Simon Kelley 5b3bf92101 --dnssec-debug 2014-01-25 17:03:07 +00:00
Simon Kelley 0744ca66ad More DNSSEC caching logic, and avoid repeated validation of DS/DNSKEY 2014-01-25 16:40:15 +00:00
Simon Kelley 2d33bda2e6 RRSIGS for PTR records from cache. 2014-01-24 22:37:25 +00:00
Simon Kelley 32f90c0fad Tweak. 2014-01-24 10:37:36 +00:00
Simon Kelley bce6e1bc6d RRSIGs in DS and DNSKEY cached answers. 2014-01-23 22:02:19 +00:00
Simon Kelley 824202ef54 More DNSSEC cache readout. 2014-01-23 20:59:46 +00:00
Simon Kelley 9ebfca1e84 Compiler warning. 2014-01-23 12:11:43 +00:00
Simon Kelley 6429e421b3 Compiler warning. 2014-01-23 12:09:36 +00:00