upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-07-11 07:00:57 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/bin/dnssec
History
Evan Hunt 9eeb8bde5a Check wildcard signer and NOQNAME signer match 
A positive wildcard answer, and the NSEC3 proof that the requested
name doesn't exist in the zone, must both be from the same zone.
Otherwise, an NSEC3 from an ancestor zone could be used to interfere
with validation.

We now retrieve the signer name from a wildcard response's signature.
An NSEC3 record cannot be used as a NOQNAME proof for the wildcard
unless it exactly matches the name one level above the NSEC3.

Fixes: isc-projects/bind9#5971

(cherry picked from commit 45c9bd2603)
2026-06-18 10:58:11 -07:00
..
.gitignore Introduce new DNSSEC tool dnssec-ksr 2024-04-19 10:41:04 +02:00
dnssec-cds.c Check wildcard signer and NOQNAME signer match 2026-06-18 10:58:11 -07:00
dnssec-cds.rst Add internal hyperlinks to See Also section of manual pages 2022-03-14 10:46:36 +01:00
dnssec-dsfromkey.c dnssec-verify now returns failure on bad arguments 2025-10-22 13:48:22 +11:00
dnssec-dsfromkey.rst Update man pages for deprecated algorithms 2025-07-16 01:40:00 +10:00
dnssec-importkey.c dnssec-verify now returns failure on bad arguments 2025-10-22 13:48:22 +11:00
dnssec-importkey.rst Add dnssec-policy text for dnssec-importkey 2025-10-10 17:35:59 +00:00
dnssec-keyfromlabel.c dnssec-verify now returns failure on bad arguments 2025-10-22 13:48:22 +11:00
dnssec-keyfromlabel.rst Update man pages for deprecated algorithms 2025-07-16 01:40:00 +10:00
dnssec-keygen.c Fix spelling typos in comments and code 2026-06-01 15:04:31 +00:00
dnssec-keygen.rst Update man pages for deprecated algorithms 2025-07-16 01:40:00 +10:00
dnssec-ksr.c Fix off by one error in dnssec-ksr sign 2026-04-07 08:32:58 +00:00
dnssec-ksr.rst dnssec-ksr keygen -o to create KSKs 2024-11-04 01:10:34 +00:00
dnssec-revoke.c dnssec-verify now returns failure on bad arguments 2025-10-22 13:48:22 +11:00
dnssec-revoke.rst Add internal hyperlinks to See Also section of manual pages 2022-03-14 10:46:36 +01:00
dnssec-settime.c dnssec-verify now returns failure on bad arguments 2025-10-22 13:48:22 +11:00
dnssec-settime.rst Remove trailing whitespace from all text files 2023-06-13 15:05:40 +02:00
dnssec-signzone.c Check wildcard signer and NOQNAME signer match 2026-06-18 10:58:11 -07:00
dnssec-signzone.rst Fix broken links in documentation 2025-01-27 09:42:47 +00:00
dnssec-verify.c use the zone file's basename as origin in dnssec tools 2026-04-01 20:48:09 +00:00
dnssec-verify.rst Document new -J option for dnssec-signzone and dnssec-verify 2024-07-08 14:53:01 +02:00
dnssectool.c dnssec-verify now returns failure on bad arguments 2025-10-22 13:48:22 +11:00
dnssectool.h dnssec-verify now returns failure on bad arguments 2025-10-22 13:48:22 +11:00
Makefile.am Move common create key functions to dnssectool.c 2024-04-19 10:41:04 +02:00