ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity
27,156 Commits 589 Branches 805 Tags
af021f136e277a4eec00a1a31d159a17f3e3cd85
Commit Graph
111 Commits
Author SHA1 Message Date
Evan Hunt be8dfc7421 fix dnssec test 
- work around CR issues
- use UTC for time comparisons
- use $DIFF instead of cmp
 2019-01-25 15:38:50 -08:00
Matthijs MekkingandOndřej Surý 9f81119c02 Add dnssec-signzone tests with unsupported alg 
dnssec-signzone should sign a zonefile that contains a DNSKEY record
with an unsupported algorithm.

(cherry picked from commit 6d976b37c1)
(cherry picked from commit 8619318a1e6207e487438a93bd7a620967091347)
 2018-12-20 04:50:08 -05:00
Mark Andrews 637e3c4c4b check that DNSKEY and other occluded data are excluded from the delegating bitmap 
(cherry picked from commit 7e4b82103b)
 2018-12-14 14:44:18 +11:00
Mark Andrews 4731ee6ae1 verify that dnssec-signzone generates NSEC3 records with DNAME at the apex 
(cherry picked from commit 06e218c421)
 2018-12-10 17:29:29 +11:00
Ondřej Surý 188526f41c Remove $Id markers, Principal Author and Reviewed tags from the full source tree 
(cherry picked from commit 55a10b7acd)
 2018-05-11 14:25:15 +02:00
Evan Hunt 8b205089b7 update file headers to remove copyright years 2018-03-14 16:40:20 -07:00
Evan Hunt 442c1530a3 final cleanup 
- update Kyuafiles to match Atffiles
- copyrights
- CHANGES note

(cherry picked from commit 86e00cbb71)
(cherry picked from commit 80834b5b90)
 2018-03-09 16:17:56 -08:00
Evan Hunt 854f7846d8 tidying up after backport 2018-02-23 13:28:47 -08:00
Evan Hunt 167fa161d1 parallelize most system tests 
(cherry picked from commit c032c54dda)
(cherry picked from commit 2b81f322cb)
 2018-02-23 13:23:31 -08:00
Witold Krecicki cc51cd2d20 4487. [test] Make system tests work on Windows. [RT #42931] 2016-10-19 17:21:13 +02:00
Mark Andrews 0c27b3fe77 4401. [misc] Change LICENSE to MPL 2.0. 2016-06-27 14:56:38 +10:00
Evan Hunt 3cd204c4a4 [master] fixed revoked key regression 
4436.	[bug]		Fixed a regression introduced in change #4337 which
			caused signed domains with revoked KSKs to fail
			validation. [RT #42147]
 2016-04-14 18:52:52 -07:00
Tinderbox User 4a7004f3ce update copyright notice / whitespace 2016-03-10 23:45:16 +00:00
Mark Andrews 7c52595464 4331. [func] When loading managed signed zones detect if the 
RRSIG's inception time is in the future and regenerate
                        the RRSIG immediately. [RT #41808]
 2016-03-10 17:01:08 +11:00
Tinderbox User 431e5c81db update copyright notice / whitespace 2015-05-28 23:45:24 +00:00
Mark Andrews 598b502695 4127. [protocol] CDS and CDNSKEY need to be signed by the key signing 
key as per RFC 7344, Section 4.1. [RT #37215]
 2015-05-27 15:25:45 +10:00
Mark Andrews a5c7cfbac4 3990. [testing] Add tests for unknown DNSSEC algorithm handling. 
[RT #37541]
 2014-10-30 11:05:26 +11:00
Mark Andrews c83b91fb63 3960. [bug] 'dig +sigchase' could loop forever. [RT #37220] 2014-10-01 07:06:20 +10:00
Tinderbox User fea81a5e0e update copyright notice 2014-08-22 23:45:27 +00:00
Mark Andrews 840d6a4614 3925. [bug] DS lookup of RFC 1918 empty zones failed. [RT #36917 2014-08-22 16:32:19 +10:00
Tinderbox User 5a31767b09 update copyright notice 2014-06-19 23:45:23 +00:00
Evan Hunt b8a9632333 [master] complete NTA work 
3882.	[func]		By default, negative trust anchors will be tested
			periodically to see whether data below them can be
			validated, and if so, they will be allowed to
			expire early. The "rndc nta -force" option
			overrides this behvaior.  The default NTA lifetime
			and the recheck frequency can be configured by the
			"nta-lifetime" and "nta-recheck" options. [RT #36146]
 2014-06-18 16:50:38 -07:00
Evan Hunt 60988462e5 [master] use posix-compatible shell in system tests 
3839.	[test]		Use only posix-compatible shell in system tests.
			[RT #35625]
 2014-05-06 22:06:04 -07:00
Tinderbox User aa7b16ec2a update copyright notice 2014-01-21 23:46:16 +00:00
Evan Hunt d58e33bfab [master] testcrypto.sh in system tests 
3714.	[test]		System tests that need to test for cryptography
			support before running can now use a common
			"testcrypto.sh" script to do so. [RT #35213]
 2014-01-20 16:08:09 -08:00
Tinderbox User eade480b33 update copyright notice 2013-12-13 23:46:17 +00:00
Evan Hunt 9b895f30f1 [master] fix insecure delegation across static-stub zones 
3689.	[bug]		Fixed a bug causing an insecure delegation from one
			static-stub zone to another to fail with a broken
			trust chain. [RT #35081]
 2013-12-12 22:19:33 -08:00
ckb e7857b5ee0 3356. [bug] Cap the TTL of signed RRsets when RRSIGs are 
approaching their expiry, so they don't remain
			in caches after expiry. [RT #26429]
 2012-07-25 17:06:34 -05:00
Mark Andrews bf8267aa45 reverse bad copyright update 2012-06-29 11:39:47 +10:00
Tinderbox User 247bf37860 update copyright notice 2012-06-29 01:22:18 +00:00
Tinderbox User a847a4bcd6 update copyright notice 2012-05-17 23:46:03 +00:00
Evan Hunt 26833735d3 Handle RRSIG signer case consistently 
3329.	[bug]		Handle RRSIG signer-name case consistently: We
			generate RRSIG records with the signer-name in
			lower case.  We accept them with any case, but if
			they fail to validate, we try again in lower case.
			[RT #27451]
 2012-05-17 10:44:16 -07:00
Evan Hunt e41d5a00bc added gitignore, removed cvsignore 2012-03-03 23:10:05 -08:00
Evan Hunt 25845da41a 3203. [bug] Increase log level to 'info' for validation failures 
from expired or not-yet-valid RRSIGs. [RT #21796]
 2011-11-04 05:36:28 +00:00
Automatic Updater 6333ba02a5 update copyright notice 2011-03-21 23:47:21 +00:00
Mark Andrews c2265bd341 adjust rt23702 test to take less time 2011-03-21 20:31:22 +00:00
Mark Andrews 5095e72ac3 3083. [bug] NOTIFY messages were not being sent when generating 
a NSEC3 chain incrementally. [RT #23702]
 2011-03-21 01:02:39 +00:00
Mark Andrews eff7f78bc6 3061. [func] New option "dnssec-signzone -D", only write out 
generated DNSSEC records. [RT #22896]
 2011-03-05 06:35:41 +00:00
Francis Dupont 664917beda Use RRSIG original TTL in validated RRset TTL [RT #23332] 2011-02-28 14:21:35 +00:00
Mark Andrews 4f07b2b00c 3040. [bug] Named failed to validate insecure zones where a node 
with a CNAME existed between the trust anchor and the
                        top of the zone. [RT #23338]
 2011-02-23 11:30:35 +00:00
Automatic Updater c41b2924a5 update copyright notice 2011-02-15 23:47:36 +00:00
Mark Andrews b1b42b03b7 3020. [bug] auto-dnssec failed to correctly update the zone when changing the DNSKEY RRset. [RT #23232] 2011-02-15 22:02:36 +00:00
Mark Andrews c5fa370695 3019. [func] Test: check apex NSEC3 records after adding DNSKEY 
record via UPDATE. [RT #23229]
 2011-02-14 23:53:44 +00:00
Automatic Updater 33cc94f04c update copyright notice 2010-11-17 23:47:09 +00:00
Mark Andrews a27b3757fd 2968. [security] Named could fail to prove a data set was insecure 
before marking it as insecure.  One set of conditions
                        that can trigger this occurs naturally when rolling
                        DNSKEY algorithms.  [RT #22309]
 2010-11-16 01:14:51 +00:00
Mark Andrews 240a7dc59d 2951. [bug] named failed to generate a correct signed response 
in a optout, delegation only zone with no secure
                        delegations. [RT #22007]
 2010-09-07 00:58:36 +00:00
Automatic Updater 2b43d1d8c5 update copyright notice 2010-08-13 23:47:04 +00:00
Mark Andrews c73d8c1b72 2938. [bug] When skipping NSEC3 records that don't match the 
current NSEC3PARAM record in use for zone named
                        could dereference a uninitialised pointer attempting
                        to obtain a lock. [RT# 21868]
 2010-08-13 06:46:25 +00:00
Automatic Updater 6bb1560124 update copyright notice 2010-01-18 23:48:40 +00:00
Evan Hunt e11a0c114c 2841. [func] Added "smartsign" and improved "autosign" and 
"dnssec" regression tests. [RT #20865]
 2010-01-18 19:19:31 +00:00