ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity
15,840 Commits 589 Branches 805 Tags
57b09c9e4bd1bc91052fb86aea74e75ad4eef080
Commit Graph
163 Commits
Author SHA1 Message Date
Automatic Updater a02055f66b update copyright notice 2008-11-14 23:46:41 +00:00
Mark Andrews 56a3bb82db 2495. [bug] Tighten RRSIG checks. [RT #18795] 2008-11-14 22:57:29 +00:00
Mark Andrews 39f47ff683 2421. [bug] Handle the special return value of a empty node as 
if it was a NXRRSET in the validator. [RT #18447]
 2008-08-21 04:56:39 +00:00
Evan Hunt 54d79b7ee6 Fix build error: parameter type was changed in the prototype but not in 
the function header.
 2008-02-19 17:09:08 +00:00
Mark Andrews de4f3419d3 2238. [bug] check_ds() could be called with a non DS rdataset. 
[RT #17598]
 2008-02-18 23:09:31 +00:00
Automatic Updater ce09884de7 update copyright notice 2008-01-17 23:46:37 +00:00
Automatic Updater 4602a30928 update copyright notice 2008-01-15 23:46:32 +00:00
Mark Andrews d4c9827b5a 2304. [bug] Check returns from all dns_rdata_tostruct() calls. 
[RT #17460]
 2008-01-15 01:13:17 +00:00
Mark Andrews 8bedd9647f 2245. [bug] Validating lack of DS records at trust anchors wasn't 
working. [RT #17151]
 2007-09-19 03:38:56 +00:00
Mark Andrews e2c3f8059e 2238. [bug] It was possible to trigger a REQUIRE when a 
validation was cancelled. [RT #17106]
 2007-09-14 05:43:05 +00:00
Mark Andrews 3eab85ca54 2218. [bug] Remove unnecessary REQUIRE from dns_validator_create(). 
[RT #16976]
 2007-08-27 04:36:54 +00:00
Automatic Updater ec5347e2c7 update copyright notice 2007-06-18 23:47:57 +00:00
Mark Andrews a05f23d07e 2171. [bug] Handle breaks in DNSSEC trust chains where the parent 
servers are not DS aware (DS queries to the parent
                        return a referral to the child).
 2007-04-27 06:13:29 +00:00
Mark Andrews 394f4aec21 2145. [bug] Check DS/DLV digest lengths for known digests. 
[RT #16622]
 2007-02-26 01:20:44 +00:00
Mark Andrews f36c85c3ce update copyright notice 2007-01-08 02:45:04 +00:00
Mark Andrews 3052274767 2126. [bug] Serialise validation of type ANY responses. [RT #16555] 2007-01-08 01:13:38 +00:00
Mark Andrews 29747dfe5e 2123. [func] Use Doxygen to generate internal documention. 
[RT #11398]
 2006-12-22 01:46:19 +00:00
Mark Andrews 1ea2595e1b 2117. [bug] DNSSEC fixes: named could fail to cache NSEC records 
which could lead to validation failures.  named didn't
                        handle negative DS responses that were in the process
                        of being validated.  Check CNAME bit before accepting
                        NODATA proof. To be able to ignore a child NSEC there
                        must be SOA (and NS) set in the bitmap. [RT #16399]
 2006-12-07 06:47:36 +00:00
Mark Andrews cc7d91bd5c 2061. [bug] Accept expired wildcard message reversed. [RT #16296] 2006-07-24 22:41:59 +00:00
Mark Andrews d2ef84e07b 2008. [func] It is now posssible to enable/disable DNSSEC 
validation from rndc.  This is useful for the
                        mobile hosts where the current connection point
                        breaks DNSSEC (firewall/proxy).  [RT #15592]

                                rndc validation newstate [view]
 2006-03-09 23:39:00 +00:00
Mark Andrews 95b484c958 fix minor typos 2006-02-26 22:57:18 +00:00
Mark Andrews fcbc5d2353 post merge problem 2006-02-22 01:55:10 +00:00
Mark Andrews c5387e6942 1987. [func] DS/DLV SHA256 digest algorithm support. [RT #15608] 2006-02-21 23:49:51 +00:00
Mark Andrews acb4f52369 update copyright notice 2006-01-04 23:50:24 +00:00
Mark Andrews fabf2ee6b0 1947. [func] It is now possible to configure named to accept 
expired RRSIGs.  Default "dnssec-accept-expired no;".
                        Setting "dnssec-accept-expired yes;" leaves named
                        vulnerable to replay attacks.  [RT #14685]
 2006-01-04 02:35:49 +00:00
Mark Andrews cf224bbf7b 1942. [bug] If the name of a DNSKEY match that of one in 
trusted-keys do not attempt to validate the DNSKEY
                        using the parents DS RRset. [RT #15649]
 2005-12-04 23:54:01 +00:00
Mark Andrews 470c726bc8 silence dereferencing type-punned pointer will break strict-aliasing rules warning 2005-11-30 05:01:34 +00:00
Mark Andrews 2674e1a455 1940. [bug] Fixed a number of error conditions reported by 
Coverity.
 2005-11-30 03:33:49 +00:00
Mark Andrews 60ab03125c 1939. [bug] The resolver could dereference a null pointer after 
validation if all the queries have timed out.
                        [RT #15528]

1938.   [bug]           The validator was not correctly handling unsecure
                        negative responses at or below a SEP. [RT #15528]
 2005-11-03 00:51:55 +00:00
Mark Andrews 7d116211ec 1936. [bug] The validator could leak memory. [RT #5544] 2005-11-02 01:46:31 +00:00
Mark Andrews 216030f284 1930. [port] HPUX: ia64 support. [RT #15473] 
1929.   [port]          FreeBSD: extend use of PTHREAD_SCOPE_SYSTEM.
 2005-10-14 01:18:47 +00:00
Mark Andrews 676619a22f win32 fixes 2005-09-05 02:54:38 +00:00
Mark Andrews 5be3685b0e 1919. [bug] dig's +sigchase code overhauled. [RT #14933] 
1918.   [bug]           The DLV code has been re-worked to make no longer
                        query order sensitive. [RT #14933]
 2005-08-25 00:56:08 +00:00
Mark Andrews 116e6b4257 1867. [bug] It was possible to trigger a INSIST in 
dlv_validatezonekey(). [RT #14846]
 2005-06-07 00:39:05 +00:00
Mark Andrews 9840a0767d 1853. [bug] Rework how DLV interacts with proveunsecure(). 
[RT #13605]
 2005-05-06 01:59:38 +00:00
Rob Austein ab023a6556 1851. [doc] Doxygen comment markup. [RT #11398] 2005-04-27 04:57:32 +00:00
Mark Andrews c941e32d22 1819. [bug] The validator needed to check both the algorithm and 
digest types of the DS to determine if it could be
                        used to introduce a secure zone. [RT #13593]
 2005-03-04 03:53:22 +00:00
Mark Andrews 2d7fc01cb3 update copyright notice 2005-02-09 05:19:30 +00:00
Mark Andrews 0ad024cc42 1806. [bug] The resolver returned the wrong result when a CNAME / 
DNAME was encountered when fetching glue from a
                        secure namespace. [RT #13501]

1805.   [bug]           Pending status was not being cleared when DLV was
                        active. [RT #13501]
 2005-02-08 23:51:32 +00:00
Mark Andrews 4e259c5a23 1768. [bug] nsecnoexistnodata() could be called with a non-NSEC 
rdataset. [RT #12907]
 2004-11-17 23:52:31 +00:00
Mark Andrews cc3aafe737 1659. [cleanup] Cleanup some messages that were referring to KEY vs 
DNSKEY, NXT vs NSEC and SIG vs RRSIG.

1658.   [func]          Update dnssec-keygen to default to KEY for HMAC-MD5
                        and DH.  Tighten which options apply to KEY and
                        DNSKEY records.
 2004-06-11 01:12:40 +00:00
Mark Andrews 6fac7ff1f9 1606. [bug] DVL insecurity proof was failing. 
1605.   [func]          New dns_db_find() option DNS_DBFIND_COVERINGNSEC.
 2004-05-14 04:45:58 +00:00
Mark Andrews 8d414d1559 1600. [bug] Duplicate zone pre-load checks were not case 
insensitive.

1599.   [bug]           Fix memory leak on error path when checking named.conf.

1598.   [func]          Specify that certain parts of the namespace must
                        be secure (dnssec-must-be-secure).
 2004-04-15 23:40:27 +00:00
Mark Andrews 42b48d11ca hide ((isc_event_t **) (void *)) cast using a macro, ISC_EVENT_PTR. 2004-04-15 01:58:25 +00:00
Mark Andrews 50105afc55 1589. [func] DNSSEC lookaside validation. 
enable-dnssec -> dnssec-enable
 2004-03-10 02:19:58 +00:00
Mark Andrews dafcb997e3 update copyright notice 2004-03-05 05:14:21 +00:00
Mark Andrews daa73eae70 silence punned messages 2004-02-03 00:59:05 +00:00
Mark Andrews 519b239fc4 #include <isc/string.h> 2004-01-20 14:19:42 +00:00
Mark Andrews 35541328a8 1558. [func] New DNSSEC 'disable-algorithms'. Support entry into 
child zones for which we don't have a supported
                        algorithm.  Such child zones are treated as unsigned.

1557.   [func]          Implement missing DNSSEC tests for
                        * NOQNAME proof with wildcard answers.
                        * NOWILDARD proof with NXDOMAIN.
                        Cache and return NOQNAME with wildcard answers.
 2004-01-14 02:06:51 +00:00
Tatuya JINMEI 神明達哉 e407562a75 1528. [cleanup] Simplify some dns_name_ functions based on the 
deprecation of bitstring labels.
 2003-10-25 00:31:12 +00:00