upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-07-07 00:50:56 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/bin/dnssec
History
Evan Hunt 45c9bd2603 Check wildcard signer and NOQNAME signer match 
A positive wildcard answer, and the NSEC3 proof that the requested
name doesn't exist in the zone, must both be from the same zone.
Otherwise, an NSEC3 from an ancestor zone could be used to interfere
with validation.

We now retrieve the signer name from a wildcard response's signature.
An NSEC3 record cannot be used as a NOQNAME proof for the wildcard
unless it exactly matches the name one level above the NSEC3.

Fixes: isc-projects/bind9#5971
2026-06-18 10:01:29 -07:00
..
.gitignore Introduce new DNSSEC tool dnssec-ksr 2024-04-19 10:41:04 +02:00
dnssec-cds.c Check wildcard signer and NOQNAME signer match 2026-06-18 10:01:29 -07:00
dnssec-cds.rst Add internal hyperlinks to See Also section of manual pages 2022-03-14 10:46:36 +01:00
dnssec-dsfromkey.c Apply the dns_rdataset_cleanup patch through the codebase 2025-12-17 15:19:55 +01:00
dnssec-dsfromkey.rst Update man pages for deprecated algorithms 2025-07-15 23:53:57 +10:00
dnssec-importkey.c Apply the dns_rdataset_cleanup patch through the codebase 2025-12-17 15:19:55 +01:00
dnssec-importkey.rst Add dnssec-policy text for dnssec-importkey 2025-10-10 16:49:55 +02:00
dnssec-keyfromlabel.c Remove remaining RFC 3445 KEY flags 2026-05-05 10:17:31 +02:00
dnssec-keyfromlabel.rst remove -C option from dnssec-keygen and dnssec-keyfromlabel 2026-03-24 02:17:57 -07:00
dnssec-keygen.c Fix spelling typos in comments and code 2026-06-01 16:58:16 +02:00
dnssec-keygen.rst remove -C option from dnssec-keygen and dnssec-keyfromlabel 2026-03-24 02:17:57 -07:00
dnssec-ksr.c Replace INSIST in KSR DNSKEY parser with a structured error 2026-05-05 21:06:30 +02:00
dnssec-ksr.rst dnssec-ksr keygen -o to create KSKs 2024-11-01 15:50:16 +01:00
dnssec-revoke.c remove -C option from dnssec-keygen and dnssec-keyfromlabel 2026-03-24 02:17:57 -07:00
dnssec-revoke.rst Remove OpenSSL Engine support 2024-08-06 15:17:48 +02:00
dnssec-settime.c remove -C option from dnssec-keygen and dnssec-keyfromlabel 2026-03-24 02:17:57 -07:00
dnssec-settime.rst remove -C option from dnssec-keygen and dnssec-keyfromlabel 2026-03-24 02:17:57 -07:00
dnssec-signzone.c Check wildcard signer and NOQNAME signer match 2026-06-18 10:01:29 -07:00
dnssec-signzone.rst Fix broken links in documentation 2025-01-24 12:07:36 +01:00
dnssec-verify.c use the zone file's basename as origin in dnssec tools 2026-04-01 12:29:33 -07:00
dnssec-verify.rst Remove OpenSSL Engine support 2024-08-06 15:17:48 +02:00
dnssectool.c Reject negative and out-of-range TTLs in dnssec-* tools 2026-04-30 17:40:19 +02:00
dnssectool.h remove -C option from dnssec-keygen and dnssec-keyfromlabel 2026-03-24 02:17:57 -07:00
meson.build replace the build system with meson 2025-06-11 10:30:12 +03:00