ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity
19,553 Commits 589 Branches 805 Tags
a4bd85a00926c80fb16bee2d41bc82f5ce59eea5
Commit Graph
210 Commits
Author SHA1 Message Date
Tinderbox User e7c7209af8 regen v9_7 2012-03-07 01:49:52 +00:00
Automatic Updater c072541ca0 update copyright notice 2012-02-15 21:14:53 +00:00
Mark Andrews 246a5586f1 3285. [bug] val-frdataset was incorrectly disassociated in 
proveunsecure after calling startfinddlvsep.
                        [RT #27928]
 2012-02-15 21:04:21 +00:00
Evan Hunt 82b95385ef 3203. [bug] Increase log level to 'info' for validation failures 
from expired or not-yet-valid RRSIGs. [RT #21796]
 2011-11-04 05:34:16 +00:00
Automatic Updater 7ac50d49b3 update copyright notice 2011-10-20 23:46:05 +00:00
Mark Andrews d2f6d12a22 3175. [bug] Fix how DNSSEC positive wildcard responses from a 
NSEC3 signed zone are validated.  Stop sending a
                        unnecessary NSEC3 record when generating such
                        responses. [RT #26200]
 2011-10-20 21:46:17 +00:00
Mark Andrews 6a24616ccf 3173. [port] Correctly validate root DS responses. [RT #25726] 2011-10-15 05:12:04 +00:00
Evan Hunt b55dbfdc1e 3124. [bug] Use an rdataset attribute flag to indicate 
negative-cache records rather than using rrtype 0;
			this will prevent problems when that rrtype is
			used in actual DNS packets. [RT #24777]

3123.	[security]	Change #2912 exposed a latent flaw in
			dns_rdataset_totext() that could cause named to
			crash with an assertion failure. [RT #24777]
 2011-06-08 23:15:44 +00:00
Evan Hunt 6dd373ebab 3121. [security] An authoritative name server sending a negative 
response containing a very large RRset could
                        trigger an off-by-one error in the ncache code
                        and crash named. [RT #24650]

3120.	[bug]		Named could fail to validate zones listed in a DLV
			that validated insecure without using DLV and had
			DS records in the parent zone. [RT #24631]

3119.	[bug]		When rolling to a new DNSSEC key, a private-type
			record could be created and never marked complete.
			[RT #23253]
 2011-05-26 23:10:13 +00:00
Mark Andrews 526b51ec93 3069. [cleanup] Silence warnings messages from clang static analysis. 
[RT #20256]
 2011-03-11 07:12:03 +00:00
Scott Mann a8ab505429 Fixed DNSKEY NODATA responses not cached and added tests [RT #22908]. 2011-03-01 16:47:13 +00:00
Francis Dupont fcf1934be8 Use RRSIG original TTL in validated RRset TTL [RT #23332] 2011-02-28 14:28:01 +00:00
Automatic Updater 0f1c24fec6 update copyright notice 2011-02-28 01:19:28 +00:00
Mark Andrews d1828d831e 3040. [bug] Named failed to validate insecure zones where a node 
with a CNAME existed between the trust anchor and the
                        top of the zone. [RT #23338]
 2011-02-23 12:08:40 +00:00
Mark Andrews 8bdc865433 2968. [security] Named could fail to prove a data set was insecure 
before marking it as insecure.  One set of conditions
                        that can trigger this occurs naturally when rolling
                        DNSKEY algorithms.  [RT #22309]
 2010-11-16 01:21:49 +00:00
Mark Andrews 5a7f05ee3c 2925. [bug] Named failed to accept uncachable negative responses 
from insecure zones. [RT# 21555]
 2010-06-25 23:52:09 +00:00
Mark Andrews d544482827 2904. [bug] When using DLV, sub-zones of the zones in the DLV, 
could be incorrectly marked as insecure instead of
                        secure leading to negative proofs failing.  This was
                        a unintended outcome from change 2890. [RT# 21392]
 2010-05-26 06:30:43 +00:00
Automatic Updater 71324ae046 update copyright notice 2010-05-14 23:49:21 +00:00
Mark Andrews d133eb632a 2892. [bug] Handle REVOKED keys better. [RT #20961] 2010-05-14 04:41:12 +00:00
Mark Andrews 0463ffd804 2890. [bug] Handle the introduction of new trusted-keys and 
DS, DLV RRsets better. [RT #21097]
 2010-05-14 00:16:32 +00:00
Mark Andrews 05addc4e62 2877. [bug] The validator failed to skip obviously mismatching 
RRSIGs. [RT #21138]
 2010-04-21 05:47:29 +00:00
Mark Andrews 7005c5aa84 2876. [bug] Named could return SERVFAIL for negative responses 
from unsigned zones. [RT #21131]
 2010-04-21 04:20:22 +00:00
Mark Andrews 314b6614cb 2869. [bug] Fix arguments to dns_keytable_findnextkeynode() call. 
[RT #20877]
 2010-03-26 17:18:05 +00:00
Automatic Updater f51de9fb15 update copyright notice 2010-03-04 23:49:20 +00:00
Mark Andrews 40b08512c4 2958. [bug] When canceling validation it was possible to leak 
memory. [RT #20800]
 2010-03-04 22:28:40 +00:00
Automatic Updater e1bd9f2ed3 update copyright notice 2010-02-25 05:25:53 +00:00
Mark Andrews 8a98023414 2852. [bug] Handle broken DNSSEC trust chains better. [RT #15619] 2010-02-25 05:05:09 +00:00
Evan Hunt a2ba550880 2827. [security] Bogus NXDOMAIN could be cached as if valid. [RT #20712] 2009-12-30 06:46:36 +00:00
Mark Andrews a39a5f4d81 2772. [security] When validating, track whether pending data was from 
the additional section or not and only return it if
                        validates as secure. [RT #20438]
 2009-11-17 23:55:18 +00:00
Evan Hunt 7048af0a55 2769. [cleanup] Change #2742 was incomplete. [RT #19589] 2009-11-16 07:56:06 +00:00
Evan Hunt be69d48443 2742. [cleanup] Clarify some DNSSEC-related log messages in 
validator.c. [RT #19589]
 2009-10-28 05:34:21 +00:00
Evan Hunt 95f2377b4f 2739. [cleanup] Clean up API for initializing and clearing trust 
anchors for a view. [RT #20211]
 2009-10-27 22:46:13 +00:00
Evan Hunt cfb1587eb9 2619. [func] Add support for RFC 5011, automatic trust anchor 
maintenance.  The new "managed-keys" statement can
			be used in place of "trusted-keys" for zones which
			support this protocol.  (Note: this syntax is
			expected to change prior to 9.7.0 final.) [RT #19248]
 2009-06-30 02:53:46 +00:00
Mark Andrews afbe695de3 "got insecure response; parent indicates it should be secure" wrongly emitted [RT #19800] 2009-06-09 22:57:09 +00:00
Automatic Updater 54cdd2b307 update copyright notice 2009-05-07 23:47:44 +00:00
Francis Dupont ff380b05fe comment fixes (rt19624) 2009-05-07 09:41:23 +00:00
Mark Andrews e7eede965d 2597. [bug] Handle a validation failure with a insecure delegation 
from a NSEC3 signed master/slave zone.  [RT #19464]
 2009-05-07 02:34:19 +00:00
Evan Hunt 6b9728dde7 ARM and log message changes to clarify "insecure response". [rt19400] 2009-03-23 22:30:57 +00:00
Automatic Updater 8e3d340655 update copyright notice 2009-03-17 23:48:02 +00:00
Mark Andrews 72dbc7216a 2579. [bug] DNSSEC lookaside validation failed to handle unknown 
algorithms. [RT #19479]
 2009-03-17 01:34:28 +00:00
Evan Hunt bfe0517fdc Clarify logged message when an insecure DNSSEC response arrives from a zone 
thought to be secure: "insecurity proof failed" instead of "not insecure".
[RT #19400]
 2009-03-01 02:45:38 +00:00
Mark Andrews 7d211b458f 2554. [bug] Validation of uppercase queries from NSEC3 zones could 
fail. [RT #19297]
 2009-02-15 23:46:23 +00:00
Mark Andrews d2ef5b3c5c 2553. [bug] Reference leak on DNSSEC validation errors. [RT #19291] 2009-02-15 23:37:29 +00:00
Francis Dupont 708383382f spelling 2009-01-17 15:12:26 +00:00
Automatic Updater 5569e7de51 update copyright notice 2009-01-05 23:47:54 +00:00
Tatuya JINMEI 神明達哉 3fb1637c92 trivial comment cleanups (RT#19118) 2009-01-05 23:20:22 +00:00
Automatic Updater 49960a74b5 update copyright notice 2008-11-14 23:47:33 +00:00
Mark Andrews 50df1ec60a 2495. [bug] Tighten RRSIG checks. [RT #18795] 2008-11-14 22:53:46 +00:00
Mark Andrews 6098d364b6 2448. [func] Add NSEC3 support. [RT #15452] 2008-09-24 02:46:23 +00:00
Mark Andrews 1bfe8851c0 2421. [bug] Handle the special return value of a empty node as 
if it was a NXRRSET in the validator. [RT #18447]
 2008-08-21 04:43:49 +00:00