upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing

Browse source 
Underneath" for the harden-below-nxdomain option.



git-svn-id: file:///svn/unbound/trunk@3927 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2016-11-21 09:53:43 +00:00
parent e6678abba6
commit 3132937112
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
doc/Changelog
View file

@ -1,3 +1,7 @@
21 November 2016: Wouter
- Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
Underneath" for the harden-below-nxdomain option.
10 November 2016: Ralph 10 November 2016: Ralph
- Fix #1155: test status code of unbound-control in 04-checkconf, - Fix #1155: test status code of unbound-control in 04-checkconf,
not the status code from the tee command. not the status code from the tee command.

4
doc/unbound.conf.5.in
View file

@ -624,7 +624,8 @@ unsigned to badly signed often. If turned off you run the risk of a
downgrade attack that disables security for a zone. Default is on. downgrade attack that disables security for a zone. Default is on.
.TP .TP
.B harden\-below\-nxdomain: \fI<yes or no> .B harden\-below\-nxdomain: \fI<yes or no>
From draft\-vixie\-dnsext\-resimprove, returns nxdomain to queries for a name From RFC 8020 (with title "NXDOMAIN: There Really Is Nothing Underneath"),
returns nxdomain to queries for a name
below another name that is already known to be nxdomain. DNSSEC mandates below another name that is already known to be nxdomain. DNSSEC mandates
noerror for empty nonterminals, hence this is possible. Very old software noerror for empty nonterminals, hence this is possible. Very old software
might return nxdomain for empty nonterminals (that usually happen for reverse might return nxdomain for empty nonterminals (that usually happen for reverse
@ -632,7 +633,6 @@ IP address lookups), and thus may be incompatible with this. To try to avoid
this only DNSSEC-secure nxdomains are used, because the old software does not this only DNSSEC-secure nxdomains are used, because the old software does not
have DNSSEC. Default is off. have DNSSEC. Default is off.
The nxdomain must be secure, this means nsec3 with optout is insufficient. The nxdomain must be secure, this means nsec3 with optout is insufficient.
Currently, draft\-ietf\-dnsop\-nxdomain\-cut promotes this technique.
.TP .TP
.B harden\-referral\-path: \fI<yes or no> .B harden\-referral\-path: \fI<yes or no>
Harden the referral path by performing additional queries for Harden the referral path by performing additional queries for