Andreas Gustafsson
34aa790937
reverted 994.
2001-09-14 20:53:33 +00:00
Mark Andrews
56d69016f4
994. [bug] If the unsecure proof fails for unsigned NS records
...
attempt a secure proof using the NS records found as
glue to find the NS records from the zone's servers
along with associated glue rather than from parent
servers. [RT #1706 ]
2001-09-13 07:23:39 +00:00
Andreas Gustafsson
76c8294c81
format string bugs and improved format string checking [RT #1578 ]
2001-08-08 22:54:55 +00:00
David Lawrence
92ef1a9b9d
use ISC_MAGIC for all magic numbers, for our friends in EBCDIC land
2001-06-04 19:33:39 +00:00
Brian Wellington
26e5029fd5
Added a cast. [RT #899 ]
2001-02-21 19:57:38 +00:00
Brian Wellington
499b34cea0
copyright update
2001-01-09 22:01:04 +00:00
Brian Wellington
78838d3e0c
8 space -> tab conversion
2000-12-11 19:24:30 +00:00
Brian Wellington
c70908209e
replace some INSISTs that theoretically could occur with normal failures
2000-12-05 18:53:43 +00:00
Brian Wellington
f439363eeb
minor code simplification
2000-11-08 00:51:24 +00:00
Mark Andrews
368b37b616
dns_rdata_invalidate -> dns_rdata_reset
2000-10-31 03:22:05 +00:00
Mark Andrews
c03bb27f06
532. [func] Implement DNS UPDATE pseudo records using
...
DNS_RDATA_UPDATE flag.
531. [func] Rdata really should be initalized before being
assigned to (dns_rdata_fromwire(), dns_rdata_fromtext(),
dns_rdata_clone(), dns_rdata_fromregion()),
check that it is.
2000-10-25 04:26:57 +00:00
Brian Wellington
d1cbf71409
clean up suspicious looking and incorrect uses of dns_name_fromregion
2000-10-07 00:09:28 +00:00
Brian Wellington
a9ba7e6564
Allow a keyset to be self-signed if the signing key is a trusted-key.
2000-09-12 12:01:50 +00:00
Brian Wellington
d6be55c63f
comment the infinite loop fix
2000-09-12 10:21:45 +00:00
Brian Wellington
5c29047792
minor dst api change
2000-09-12 09:59:28 +00:00
Brian Wellington
c38cf70db1
Fix an assertion failure and a case where an rdataset's trust wasn't set.
2000-09-08 14:18:17 +00:00
Brian Wellington
32b2cdf212
427. [bug] Avoid going into an infinite loop when the validator
...
gets a negative response to a key query where the
records are signed by the missing key.
2000-09-07 19:46:52 +00:00
Brian Wellington
5e387b9ce6
and more calls to DESTROYLOCK
2000-08-26 01:37:00 +00:00
Brian Wellington
6f071989da
cancellation fixes
2000-08-15 01:22:33 +00:00
Brian Wellington
2a123ac026
remove unused variable
2000-08-15 00:52:49 +00:00
Brian Wellington
9cd6710f91
validators can now be cancelled.
2000-08-15 00:21:05 +00:00
Andreas Gustafsson
ef97e09e20
make the validator attach to the view only weakly, so that
...
the view can start shutting down even though a validation is in progress.
2000-08-14 22:17:40 +00:00
David Lawrence
40f53fa8d9
Trailing whitespace trimmed. Perhaps running "perl util/spacewhack.pl in your
...
own CVS tree will help minimize CVS conflicts. Maybe not.
Blame Graff for getting me to trim all trailing whitespace.
2000-08-01 01:33:37 +00:00
Brian Wellington
f15af68028
negative responses to cd queries should work now.
2000-07-27 18:42:08 +00:00
David Lawrence
15a4474541
word wrap copyright notice at column 70
2000-07-27 09:55:03 +00:00
Brian Wellington
98d010a24a
If a negative insecurity proof succeeds, set all of the rdatasets in the
...
authority section of the message to non-pending, so that the response
has the ad bit set.
2000-07-27 01:26:15 +00:00
Brian Wellington
5b0413f993
Call isc_log_wouldlog to potentially avoid extra work in validator_log.
2000-07-26 00:50:02 +00:00
Brian Wellington
60783293cc
If a failed positive validation led us to try an insecurity proof, and the
...
insecurity proof also failed, the validator event should normally contain
the error from the positive validation.
2000-07-25 01:24:18 +00:00
Brian Wellington
6bc1a64561
If a positive validation fails and it looks like the reason is that there
...
are no material DNSSEC signatures, try an insecurity proof.
2000-07-13 23:52:04 +00:00
Brian Wellington
25496cebad
If trying to validate a key set that happens to be a security root, the
...
validation should only consist of checking that each key in the key set
is also in the list of security root keys.
Strangeness occurs when the key set is signed, since the key set is marked
as secure, but the sig set is not, since it wasn't used in the validation
process. This means that a query for a key set at a security root will
have the AD bit set if the key set is unsigned and not if the key set is signed.
2000-07-07 00:44:01 +00:00
David Lawrence
9c3531d72a
add RCS id string
2000-06-22 22:00:42 +00:00
Andreas Gustafsson
6036112f48
more detailed logging during insecurity proofs
2000-06-22 21:14:48 +00:00
Brian Wellington
77c67dfb26
Repeatedly querying for nonexistant data could lead to a crash.
2000-06-07 01:32:47 +00:00
Brian Wellington
e27021ee1f
Certain negative responses could crash the validator.
...
The insecurity proof code didn't check to see if the name was below a security
root.
2000-06-03 00:18:43 +00:00
Brian Wellington
75f6c57d95
When an rdataset is signed, its ttl is normalized based on the signature
...
validity period.
2000-05-31 22:01:39 +00:00
Brian Wellington
9a4a878733
removed debugging code
2000-05-26 22:03:47 +00:00
Brian Wellington
ca9af3aaf7
Lots of restructuring to make code easier to follow. Also a few bugs fixed,
...
and hopefully not too many new ones introduced.
2000-05-26 21:45:53 +00:00
Andreas Gustafsson
115635379a
style
2000-05-26 17:46:16 +00:00
Brian Wellington
a9bc95f22e
dst now stores the key name as a dns_name_t, not a char *.
2000-05-24 23:13:32 +00:00
David Lawrence
ed019cabc1
fixed lines > 79 columns wide
2000-05-24 05:10:00 +00:00
David Lawrence
1d198e8a6b
removed unused stack variable sigrdataset from authvalidated()
2000-05-24 02:47:15 +00:00
Brian Wellington
feb40fc5f9
keytag collision handling was broken and a memory leak existed in the error
...
handling code.
2000-05-22 21:17:05 +00:00
Brian Wellington
17a3fcecd0
Propagate errors out of the validator in all cases. This means that if there
...
are any problems in a validation, a SERVFAIL will be returned. This may not
be correct in all cases (and will be fixed), but it leaves the server in a
much more consistent state after failures.
2000-05-19 23:04:14 +00:00
Brian Wellington
e49c834de8
Replaced dns_keynode_next by the more correct dns_keytable_findnextkeynode
2000-05-19 20:25:55 +00:00
Andreas Gustafsson
e755d59880
validator.c failed to compile on many platforms because
...
a label was not followed by a statement. Added a null statement.
2000-05-19 18:48:27 +00:00
Brian Wellington
ba393f380e
better keytag collision handling with trusted keys
2000-05-19 18:39:49 +00:00
Brian Wellington
187604c1ad
accidentally removed an assignment to NULL before; added a note to look
...
back at keytag collisions later
2000-05-19 01:23:12 +00:00
Brian Wellington
c50936eb40
changed dst_key_free() prototype, misc. dst cleanup
2000-05-19 00:20:59 +00:00
Brian Wellington
d6643ef587
snapshot - support for keytag collision, better support for signed subdomains
...
of insecure domains.
2000-05-18 23:22:14 +00:00
Brian Wellington
aa863b2d1e
insecurity proof wasn't correctly setting the rdataset trust level;
...
added more debug output
2000-05-18 18:29:29 +00:00
