Evan Hunt 9eeb8bde5a Check wildcard signer and NOQNAME signer match ... A positive wildcard answer, and the NSEC3 proof that the requested name doesn't exist in the zone, must both be from the same zone. Otherwise, an NSEC3 from an ancestor zone could be used to interfere with validation. We now retrieve the signer name from a wildcard response's signature. An NSEC3 record cannot be used as a NOQNAME proof for the wildcard unless it exactly matches the name one level above the NSEC3. Fixes: isc-projects/bind9#5971 (cherry picked from commit 45c9bd2603)		2026-06-18 10:58:11 -07:00
..
dns	Check wildcard signer and NOQNAME signer match	2026-06-18 10:58:11 -07:00
isc	Replace the shared work pool with per-loop, per-lane worker threads	2026-06-17 21:15:17 +02:00
isccc	Remove redundant parentheses from the return statement	2024-11-19 14:26:52 +01:00
isccfg	Fix spelling typos in comments and code	2026-06-01 15:04:31 +00:00
ns	Use original query name when caching SERVFAIL	2026-06-18 14:06:14 +02:00
.gitignore	The isc/platform.h header has been completely removed	2021-07-06 05:33:48 +00:00
Makefile.am	Move irs_resconf into libdns and remove libirs	2023-02-24 09:38:59 +00:00