1. 18 Apr, 2016 2 commits
    • Marek Vavrusa's avatar
      daemon: mode(strict|normal|permissive) · e61c48ef
      Marek Vavrusa authored
      the daemon has now three modes of strictness
      checking from strict to permissive.
      it reflects the tradeoff between resolving the
      query in as few steps as possible and security
      for insecure zones
      e61c48ef
    • Marek Vavrusa's avatar
      engine: clear bad scorers from RTT every 5 minutes · b64d6ce7
      Marek Vavrusa authored
      an internal timer walks RTT timer periodically and
      clears entries with bad results every 5 minutes.
      this means that a timeouted entry penalty is 
      capped to that interval, making sure that the
      bad reputation doesn't last forever
      b64d6ce7
  2. 15 Apr, 2016 2 commits
  3. 14 Apr, 2016 6 commits
  4. 10 Mar, 2016 2 commits
  5. 24 Feb, 2016 1 commit
  6. 23 Feb, 2016 1 commit
  7. 22 Feb, 2016 1 commit
  8. 17 Feb, 2016 1 commit
  9. 12 Feb, 2016 2 commits
  10. 11 Feb, 2016 1 commit
  11. 08 Feb, 2016 1 commit
    • Marek Vavrusa's avatar
      lib/validate: scrubbed extra rrs in NS were checked · 78cb3f07
      Marek Vavrusa authored
      the validator module should ignore any data that
      will be scrubbed, that includes non-authoritative
      data outside current bailiwick. previously, 
      validator attempted to ignore these records only
      for answer section and had a special case for NS
      records.
      
      cache: non-authoritative NS records are always
      unchecked and must be treated as insecure
      
      affected: www.iana.org trying to provide
      delegation information for CNAME target, which is
      moot with CNAME target explicit-fetch policy unless
      the the resolver already knows DNSKEY with which
      is could verify the records
      78cb3f07
  12. 30 Jan, 2016 1 commit
  13. 29 Jan, 2016 2 commits
  14. 22 Jan, 2016 1 commit
    • Marek Vavrusa's avatar
      lib/resolve: new flag ALWAYS_CUT · adaed4ba
      Marek Vavrusa authored
      when raised, a response zone cut will be recovered
      even if the response came from cache. this is
      normally not needed (and incurs additional cache
      lookups), but it may be useful for
      inspection
      adaed4ba
  15. 20 Jan, 2016 1 commit
    • Marek Vavrusa's avatar
      lib/iterate: ignore out-of-bailiwick NSs for positive answers · 18e2771b
      Marek Vavrusa authored
      there are broken resolution chains where a zone cut is advertised,
      but it doesn't exist and the final NS answers from its parent's
      zone cut, which is an attempt to escape bailiwick
      
      example:
      
      resolving A ab.cd.ef
      NS ef responds:
       - ab.cd.ef NS X ; adverises ab.cd.ef zone cut
      X responds:
       - A ab.cd.ef A 1.2.3.4
       - cd.ef NS X ; escapes previously advertised cut
      
      on the other hand, it is important to fail early for referrals as
      it signifies a lame answer
      18e2771b
  16. 19 Jan, 2016 1 commit
    • Marek Vavrusa's avatar
      lib/iterate: ignore out-of-bailiwick NSs for positive answers · 2800e375
      Marek Vavrusa authored
      there are broken resolution chains where a zone cut is advertised,
      but it doesn't exist and the final NS answers from its parent's
      zone cut, which is an attempt to escape bailiwick
      
      example:
      
      resolving A ab.cd.ef
      NS ef responds:
       - ab.cd.ef NS X ; adverises ab.cd.ef zone cut
      X responds:
       - A ab.cd.ef A 1.2.3.4
       - cd.ef NS X ; escapes previously advertised cut
      
      on the other hand, it is important to fail early for referrals as
      it signifies a lame answer
      2800e375
  17. 18 Jan, 2016 1 commit
  18. 15 Jan, 2016 1 commit
  19. 11 Jan, 2016 2 commits
  20. 23 Dec, 2015 1 commit
  21. 17 Dec, 2015 1 commit
  22. 11 Dec, 2015 2 commits
  23. 10 Dec, 2015 3 commits
  24. 09 Dec, 2015 3 commits