WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-26 01:22:27 +02:00
Code Issues Packages Projects Releases Wiki Activity
7,863 Commits 29 Branches 215 Tags
f0e6c4fa2cd3dfdfafecdb2be2f7d0a464f14a89
Commit Graph
600 Commits
Author SHA1 Message Date
Yorgos Thessalonikefs f46acec35f - For #1189, homogenize the input buffer size for dname_str(). 2024-12-02 11:53:56 +01:00
W.C.A. Wijngaards d5e91d181b - Fix for the serve expired DNSSEC information fix, it would not allow 
current delegation information be updated in cache. The fix allows
  current delegation and validation recursion information to be
  updated, but as a consequence no longer has certain expired
  information around for later dnssec valid expired responses.
 2024-11-05 10:39:27 +01:00
W.C.A. Wijngaards 3a1b79f6a1 - Fix negative cache NSEC3 parameter compares for zero length NSEC3 
salt.
 2024-09-30 09:25:51 +02:00
Yorgos ThessalonikefsandGitHub 2e398d51ba Fix cache update when serve expired is used (#1143) 
- Fix cache update when serve expired is used in order to not evict
  still usable expired records. Modules are forbidden to update the
  cache if their answer is DNSSEC unchecked or bogus and a valid
  (expired) entry already exists. Bogus replies from the validator are
  also discarded in favor of existing (expired) valid replies.

- serve-expired-ttl-reset should try to keep expired records in the
  cache in case they are reset.
 2024-09-24 16:47:04 +02:00
TochusandGitHub 819764663b Fix spelling mistake in comments (#1140) 
I noticed a spelling mistake in the comments. The term “chain of trust” was incorrectly written as “chainoftrust”. This change corrects the spelling to “chain of trust” which is the correct term used in English.
 2024-09-16 12:14:28 +02:00
Yorgos Thessalonikefs c36ce2a390 - Fix alloc-size and calloc-transposed-args compiler warnings. 2024-09-06 16:01:30 +02:00
W.C.A. Wijngaards b5951ce1fa - Fix that when rpz is applied the message does not get picked up by 
the validator. That stops validation failures for the message.
 2024-08-28 10:51:22 +02:00
W.C.A. Wijngaards 6b37309705 - Fix #1130: Loads of logs: "validation failure: key for validation 
<domain>. is marked as invalid because of a previous" for
  non-DNSSEC signed zone.
 2024-08-27 17:00:27 +02:00
W.C.A. Wijngaards 5bea29b01c - For #1110: Test for fallthrough attribute in configure and add 
fallthrough attribute annotations.
 2024-07-23 09:47:42 +02:00
W.C.A. Wijngaards be09350eca - Fix shadowed error string variable in validator dnskey handling. 2024-07-08 16:50:16 +02:00
W.C.A. Wijngaards 169acfc546 - Fixup algo_needs_reason string buffer length. 2024-07-08 15:38:27 +02:00
W.C.A. Wijngaards bed7cc2a90 - Fix that validation reason failure that uses string print uses 
separate buffer that is passed, from the scratch validation buffer.
 2024-07-08 15:29:20 +02:00
W.C.A. Wijngaards 978b0696d3 - Fix neater printout. 2024-07-05 14:11:26 +02:00
W.C.A. Wijngaards ec5f86b4eb - Fix for neater printout for error for missing DS response. 2024-07-05 08:49:52 +02:00
W.C.A. Wijngaards ec2f45c6fd - Fix to print details about the failure to lookup a DNSKEY record 
when validation fails due to the missing DNSKEY. Also for key prime
  and DS lookups.
 2024-07-04 14:51:18 +02:00
Wouter WijngaardsandGitHub 92b6c2a7b9 Merge pull request #1098 from NLnetLabs/ipset-pf-support 
Ipset pf support
 2024-07-03 14:49:16 +02:00
W.C.A. Wijngaards a335e601e4 ipset-pf-support, move startup and destartup to the front of the module 
func block functions, modstack call deinit function names, and detect
module change when no startup functions are needed.
 2024-07-03 13:53:44 +02:00
Yorgos Thessalonikefs 96f8a94c19 - Fix for repeated use of a DNAME record: first overallocate and then 
move the exact size of the init value to avoid false positive heap
  overflow reads from address sanitizers.
 2024-07-03 10:08:44 +02:00
W.C.A. Wijngaards ff653a7ef8 Call module init init again, and new function startup and destartup. 
NULL can be used if the function is not used. Open shared ports during
reload. Deinit is called during reload.
 2024-07-01 16:10:07 +02:00
W.C.A. Wijngaards 3953f827fb Merge branch 'master' of https://github.com/madroach/unbound into ipset-pf-support 2024-07-01 14:36:33 +02:00
W.C.A. Wijngaards 4c2da2b979 - Fix validation for repeated use of a DNAME record. 2024-06-06 15:28:21 +02:00
W.C.A. Wijngaards 3cad5818a1 - Fix memory leak in setup of dsa sig. 2024-06-06 09:30:09 +02:00
Yorgos Thessalonikefs 63a6b7b255 - Cleanup unnecessary strdup calls for EDE strings. 2024-04-29 10:15:19 +02:00
W.C.A. Wijngaards 2a255076f5 - Fix validator classification of qtype DNAME for positive and 
redirection answers, and fix validator signature routine for dealing
  with the synthesized CNAME for a DNAME without previously
  encountering it and also for when the qtype is DNAME.
 2024-03-08 14:10:06 +01:00
Yorgos Thessalonikefs 33bdf44a04 - Document the suspend argument for process_ds_response(). 2024-02-23 14:34:33 +01:00
W.C.A. Wijngaards 56a2b564ef Merge commit '92f2a1ca690a44880f4c4fa70a4b5a4b029aaf1c' 2024-02-13 13:58:09 +01:00
W.C.A. Wijngaards 9a00877af9 Merge commit '882903f2fa800c4cb6f5e225b728e2887bb7b9ae' 2024-02-13 13:57:56 +01:00
W.C.A. Wijngaards 92f2a1ca69 - Fix CVE-2023-50868, NSEC3 closest encloser proof can exhaust CPU. 2024-02-13 13:02:43 +01:00
W.C.A. Wijngaards 882903f2fa - Fix CVE-2023-50387, DNSSEC verification complexity can be exploited to 
exhaust CPU resources and stall DNS resolvers.
 2024-02-13 13:02:08 +01:00
Yorgos Thessalonikefs fe03bacd6c - Update error printout for duplicate trust anchors to include the 
trust anchor name (relates to #920).
 2024-01-22 15:54:36 +01:00
W.C.A. Wijngaards 9a2d0238a8 - Fix #983: Sha1 runtime insecure change was incomplete. 2024-01-03 13:33:43 +01:00
Wouter WijngaardsGitHubYorgos Thessalonikefs
 		c8ae3de610 Update validator/validator.c 
Co-authored-by: Yorgos Thessalonikefs <george@nlnetlabs.nl>
 2023-10-06 16:39:33 +02:00
W.C.A. Wijngaards b624ed5050 - disable-edns-do, validator init prints warning when disable-edns-do is 
turned on, but there are trust anchors, and then turns off disable-edns-do.
 2023-10-05 14:33:22 +02:00
George Thessalonikefs 4ccb613396 Merge branch 'master' into features/downstream-cookies 2023-08-05 20:37:48 +02:00
George Thessalonikefs 6e47c1e05b - For #762: remove relocated code. 2023-08-02 15:51:05 +02:00
George Thessalonikefs 5b55a46550 - For #762: relocate RFC 1982 serial number arithmetic functions to their own 
file in util/rfc_1982.[ch].
 2023-08-01 17:26:14 +02:00
George Thessalonikefs 843fc69927 Address review comments for #759: 
- Clear error text when an expected signature is missing.
 2023-07-28 14:05:25 +02:00
George Thessalonikefs 95604a90e8 Review for #759: 
- Keep EDE information for keys close to key creation.
- Fix inconsistencies between reply and cached EDEs.
- Incorporate EDE caching checks in EDE tests.
- Fix some EDE cases where missing DNSKEY was wrongly reported.
 2023-07-19 15:20:44 +02:00
George Thessalonikefs f5a2a58ce3 Review for #759: 
- Fix SEGFAULT in load_cache control command.
- Change reason_bogus_str to an explicit NULL-terminated string.
- Fix potential memory leak when discarding a message for referrals and
  0 TTL answers.
- Fix reason_bogus initialization in localzone answers.
- reply_info creation in validator is always regional.
 2023-07-17 17:26:31 +02:00
George Thessalonikefs 15b8d8b96a Merge branch 'master' into features/ede-caching 2023-07-13 11:25:59 +02:00
W.C.A. Wijngaards a97d7175a6 - Fix ssl.h include brackets, instead of quotes. 2023-03-16 15:40:43 +01:00
W.C.A. Wijngaards ba6325f24f - Fix #823: Response change to NODATA for some ANY queries since 
1.12, tested on 1.16.1.
 2023-01-06 09:16:59 +01:00
Willem Toorop 75f3fbdd65 Downstream DNS Cookies a la RFC7873 and RFC9018 
Create server cookies for clients that send client cookies.
Needs to be turned on in the config file with:

	answer-cookie: yes

A cookie-secret can be configured for anycast setups.
Also adds an access control list that will allow queries with
either a valid cookie or over a stateful transport.
 2022-09-28 10:28:19 +02:00
TCY16 0b176750bd add @wcawijngaards' review comments 2022-09-26 12:14:17 +02:00
TCY16 dcfcde2ec8 add cached EDE strings 2022-09-21 11:21:33 +02:00
W.C.A. Wijngaards f6753a0f10 - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. 2022-08-01 13:24:40 +02:00
George Thessalonikefs efdd70c7b5 - Cleanup some comments and TODO text. 2022-07-23 19:55:15 +02:00
George Thessalonikefs eda0c0c194 - Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing for 
one loop pass'.
 2022-07-04 09:34:45 +02:00
George Thessalonikefs 309b1d368b - Reintroduce documentation and more EDE support for 
val_sigcrypt.c::dnskeyset_verify_rrset_sig.
 2022-07-04 00:06:26 +02:00
George Thessalonikefs c513119bba - Improve val_sigcrypt.c::algo_needs_missing for one loop pass. 2022-07-03 23:32:18 +02:00