1. 18 Apr, 2016 1 commit
    • Marek Vavrusa's avatar
      daemon: mode(strict|normal|permissive) · e61c48ef
      Marek Vavrusa authored
      the daemon has now three modes of strictness
      checking from strict to permissive.
      it reflects the tradeoff between resolving the
      query in as few steps as possible and security
      for insecure zones
      e61c48ef
  2. 15 Apr, 2016 2 commits
  3. 14 Apr, 2016 5 commits
  4. 10 Mar, 2016 1 commit
  5. 24 Feb, 2016 1 commit
  6. 23 Feb, 2016 1 commit
  7. 17 Feb, 2016 1 commit
  8. 12 Feb, 2016 1 commit
  9. 11 Feb, 2016 1 commit
  10. 08 Feb, 2016 1 commit
    • Marek Vavrusa's avatar
      lib/validate: scrubbed extra rrs in NS were checked · 78cb3f07
      Marek Vavrusa authored
      the validator module should ignore any data that
      will be scrubbed, that includes non-authoritative
      data outside current bailiwick. previously, 
      validator attempted to ignore these records only
      for answer section and had a special case for NS
      records.
      
      cache: non-authoritative NS records are always
      unchecked and must be treated as insecure
      
      affected: www.iana.org trying to provide
      delegation information for CNAME target, which is
      moot with CNAME target explicit-fetch policy unless
      the the resolver already knows DNSKEY with which
      is could verify the records
      78cb3f07
  11. 29 Jan, 2016 1 commit
  12. 20 Jan, 2016 1 commit
    • Marek Vavrusa's avatar
      lib/iterate: ignore out-of-bailiwick NSs for positive answers · 18e2771b
      Marek Vavrusa authored
      there are broken resolution chains where a zone cut is advertised,
      but it doesn't exist and the final NS answers from its parent's
      zone cut, which is an attempt to escape bailiwick
      
      example:
      
      resolving A ab.cd.ef
      NS ef responds:
       - ab.cd.ef NS X ; adverises ab.cd.ef zone cut
      X responds:
       - A ab.cd.ef A 1.2.3.4
       - cd.ef NS X ; escapes previously advertised cut
      
      on the other hand, it is important to fail early for referrals as
      it signifies a lame answer
      18e2771b
  13. 19 Jan, 2016 1 commit
    • Marek Vavrusa's avatar
      lib/iterate: ignore out-of-bailiwick NSs for positive answers · 2800e375
      Marek Vavrusa authored
      there are broken resolution chains where a zone cut is advertised,
      but it doesn't exist and the final NS answers from its parent's
      zone cut, which is an attempt to escape bailiwick
      
      example:
      
      resolving A ab.cd.ef
      NS ef responds:
       - ab.cd.ef NS X ; adverises ab.cd.ef zone cut
      X responds:
       - A ab.cd.ef A 1.2.3.4
       - cd.ef NS X ; escapes previously advertised cut
      
      on the other hand, it is important to fail early for referrals as
      it signifies a lame answer
      2800e375
  14. 17 Dec, 2015 1 commit
  15. 11 Dec, 2015 1 commit
  16. 08 Dec, 2015 1 commit
  17. 25 Nov, 2015 1 commit
    • Marek Vavruša's avatar
      build: amalgamated build support with AMALG=1 · af4254d1
      Marek Vavruša authored
      amalgamated build concatenates all files into a single .c file to
      allow compiler see all symbols and produce possibly smaller code.
      for binary distributions this is what you want, as it's faster but
      may consume more memory during compilation.
      it however cannot do incremental builds.
      af4254d1
  18. 19 Nov, 2015 2 commits
  19. 13 Nov, 2015 2 commits
  20. 03 Nov, 2015 1 commit
  21. 28 Oct, 2015 2 commits
  22. 27 Oct, 2015 1 commit
  23. 23 Oct, 2015 1 commit
    • Marek Vavruša's avatar
      lib/cache: more granular control for rank check on insertion · a2b9d06d
      Marek Vavruša authored
      for pktcache same or better rank is required (because it’s a direct answer)
      for rrcache better rank is required (unless doing write-through)
      
      for both cases, no cache rank check is needed when inserting secure data
      
      security note: this mitigates possible non-auth NS hijacking
      a2b9d06d
  24. 22 Oct, 2015 1 commit
  25. 19 Oct, 2015 1 commit
  26. 15 Oct, 2015 1 commit
  27. 14 Oct, 2015 1 commit
  28. 13 Oct, 2015 2 commits
  29. 12 Oct, 2015 2 commits
  30. 11 Oct, 2015 1 commit