upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- harden-below-nxdomain: changed so that it activates when the

Browse source 
cached nxdomain is dnssec secure.  This avoids backwards
         incompatibility because those old servers do not have dnssec.


git-svn-id: file:///svn/unbound/trunk@2407 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2011-03-29 09:47:54 +00:00
parent fcc7f9dae0
commit 3c87eb6c49
3 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
doc/Changelog
View file

@ -1,3 +1,8 @@
29 March 2011: Wouter
- harden-below-nxdomain: changed so that it activates when the
cached nxdomain is dnssec secure. This avoids backwards
incompatibility because those old servers do not have dnssec.
24 March 2011: Wouter 24 March 2011: Wouter
- iana portlist updated. - iana portlist updated.
- release 1.4.9. - release 1.4.9.

4
doc/unbound.conf.5.in
View file

@ -471,7 +471,9 @@ From draft-vixie-dnsext-resimprove, returns nxdomain to queries for a name
below another name that is already known to be nxdomain. DNSSEC mandates below another name that is already known to be nxdomain. DNSSEC mandates
noerror for empty nonterminals, hence this is possible. Very old software noerror for empty nonterminals, hence this is possible. Very old software
might return nxdomain for empty nonterminals (that usually happen for reverse might return nxdomain for empty nonterminals (that usually happen for reverse
IP address lookups), and thus may be incompatible with this. Default is off. IP address lookups), and thus may be incompatible with this. To try to avoid
this only DNSSEC-secure nxdomains are used, because the old software does not
have DNSSEC. Default is off.
.TP .TP
.B harden\-referral\-path: \fI<yes or no> .B harden\-referral\-path: \fI<yes or no>
Harden the referral path by performing additional queries for Harden the referral path by performing additional queries for

2
services/cache/dns.c vendored
View file

@ -685,7 +685,7 @@ dns_cache_lookup(struct module_env* env,
struct reply_info* data = (struct reply_info*)e->data; struct reply_info* data = (struct reply_info*)e->data;
struct dns_msg* msg; struct dns_msg* msg;
if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
&& data->security != sec_status_bogus && data->security == sec_status_secure
&& (msg=tomsg(env, &k, data, region, now, scratch))){ && (msg=tomsg(env, &k, data, region, now, scratch))){
lock_rw_unlock(&e->lock); lock_rw_unlock(&e->lock);
msg->qinfo.qname=qname; msg->qinfo.qname=qname;