upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Change default of harden-algo-downgrade to off. This is lenient

Browse source 
for algorithm rollover.


git-svn-id: file:///svn/unbound/trunk@3478 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2015-08-24 15:05:10 +00:00
parent 06838a2bad
commit e65fdc31aa
4 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
doc/Changelog
View file

@ -2,6 +2,8 @@
- Fix deadlock for local data add and zone add when unbound-control - Fix deadlock for local data add and zone add when unbound-control
list_local_data printout is interrupted. list_local_data printout is interrupted.
- iana portlist update. - iana portlist update.
- Change default of harden-algo-downgrade to off. This is lenient
for algorithm rollover.
13 August 2015: Wouter 13 August 2015: Wouter
- 5011 implementation does not insist on all algorithms, when - 5011 implementation does not insist on all algorithms, when

2
doc/example.conf.in
View file

@ -294,7 +294,7 @@ server:
# Harden against algorithm downgrade when multiple algorithms are # Harden against algorithm downgrade when multiple algorithms are
# advertised in the DS record. If no, allows the weakest algorithm # advertised in the DS record. If no, allows the weakest algorithm
# to validate the zone. # to validate the zone.
# harden-algo-downgrade: yes # harden-algo-downgrade: no
# Use 0x20-encoded random bits in the query to foil spoof attempts. # Use 0x20-encoded random bits in the query to foil spoof attempts.
# This feature is an experimental implementation of draft dns-0x20. # This feature is an experimental implementation of draft dns-0x20.

2
doc/unbound.conf.5.in
View file

@ -567,7 +567,7 @@ to increase the max depth that is checked to.
.B harden\-algo\-downgrade: \fI<yes or no> .B harden\-algo\-downgrade: \fI<yes or no>
Harden against algorithm downgrade when multiple algorithms are Harden against algorithm downgrade when multiple algorithms are
advertised in the DS record. If no, allows the weakest algorithm to advertised in the DS record. If no, allows the weakest algorithm to
validate the zone. Default is yes. Zone signers must produce zones validate the zone. Default is no. Zone signers must produce zones
that allow this feature to work, but sometimes they do not, and turning that allow this feature to work, but sometimes they do not, and turning
this option off avoids that validation failure. this option off avoids that validation failure.
.TP .TP

2
util/config_file.c
View file

@ -174,7 +174,7 @@ config_create(void)
cfg->harden_dnssec_stripped = 1; cfg->harden_dnssec_stripped = 1;
cfg->harden_below_nxdomain = 0; cfg->harden_below_nxdomain = 0;
cfg->harden_referral_path = 0; cfg->harden_referral_path = 0;
cfg->harden_algo_downgrade = 1; cfg->harden_algo_downgrade = 0;
cfg->use_caps_bits_for_id = 0; cfg->use_caps_bits_for_id = 0;
cfg->caps_whitelist = NULL; cfg->caps_whitelist = NULL;
cfg->private_address = NULL; cfg->private_address = NULL;