upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-25 00:59:37 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
7128 commits 23 branches 209 tags 123 MiB
Commit graph

554 commits

Author SHA1 Message Date
W.C.A. Wijngaards
ba6325f24f - Fix #823: Response change to NODATA for some ANY queries since 
1.12, tested on 1.16.1.
 2023-01-06 09:16:59 +01:00
W.C.A. Wijngaards
f6753a0f10 - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. 2022-08-01 13:24:40 +02:00
George Thessalonikefs
efdd70c7b5 - Cleanup some comments and TODO text. 2022-07-23 19:55:15 +02:00
George Thessalonikefs
eda0c0c194 - Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing for 
one loop pass'.
 2022-07-04 09:34:45 +02:00
George Thessalonikefs
309b1d368b - Reintroduce documentation and more EDE support for 
val_sigcrypt.c::dnskeyset_verify_rrset_sig.
 2022-07-04 00:06:26 +02:00
George Thessalonikefs
c513119bba - Improve val_sigcrypt.c::algo_needs_missing for one loop pass. 2022-07-03 23:32:18 +02:00
George Thessalonikefs
317bab9f1d For #660: formatting, less verbose logging, add EDE information. 2022-07-03 22:32:56 +02:00
Yorgos Thessalonikefs
e102aea751
Merge pull request #660 from InfrastructureServices/sha1-runtime-insecure 
Sha1 runtime insecure
 2022-07-03 22:24:58 +02:00
George Thessalonikefs
391dd86c3b Merge branch 'master' into InfrastructureServices-fips-mode-algo-ed25519 2022-07-01 17:34:09 +02:00
W.C.A. Wijngaards
11d077c826 - Fix some lint type warnings. 2022-05-20 15:32:27 +02:00
Petr Mensik
917c30a46a Disable ED25519 and ED448 in FIPS mode on openssl3 
Both crypto functions are not allowed by FIPS 140-3. Use openssl 3.0
function to check FIPS mode presence and use it to make those algorithms
unsupported.
 2022-05-11 16:19:25 +02:00
tcarpay
0ce36e8289
Add the basic EDE (RFC8914) cases (#604) 2022-05-06 12:48:53 +02:00
Petr Mensik
74c6cf5ac6 Log detailed openssl error also for digests failures 
Make output still only shown in verbose detail. But provide openssl
error details to make a reason more obvious.
 2022-04-12 16:13:49 +02:00
Petr Mensik
33c8baaaba Forward indeterminate status higher 
Create a path where it can result in insecure.
 2022-04-08 16:26:50 +02:00
Petr Mensik
6cfcf21451 Make SHA-1 signed domains insecure if openssl refuses the digest 
RHEL9/CentOS 9 would fail in default crypto policy. If call to openssl
returns invalid digest then report the name insecure. If all tested
signatures return the same issue, then make the reply insecure.
 2022-04-08 16:26:50 +02:00
W.C.A. Wijngaards
f81420d77f - Fix compile warnings for printf ll format on mingw compile. 2022-03-02 14:34:36 +01:00
W.C.A. Wijngaards
2b90181d3a - Fix #628: A rpz-passthru action is not ending RPZ zone processing. 2022-02-15 16:20:12 +01:00
W.C.A. Wijngaards
c6c54f9de4 - Fix validator debug output about DS support, print correct algorithm. 2021-12-06 13:12:44 +01:00
Wouter Wijngaards
9645228f03
Merge pull request #570 from rex4539/typos 
Fix typos
 2021-11-29 11:39:48 +01:00
tcarpay
c5a1e87f75
Remove wrongly added EDE comments 
Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2021-11-15 13:03:26 +01:00
Dimitris Apostolou
c21d6af617
Fix typos 2021-11-13 16:56:15 +02:00
TCY16
f5b586dbdc add potential EDE spots 2021-11-08 11:50:57 +01:00
TCY16
8205c87a96 complete renaming of the modules edns list 2021-11-08 11:50:29 +01:00
Tom Carpay
89d7476539 split edns_data.opt_list in opt_list_in and opt_list_out 
opt_list_in for parsed (incoming) edns options, and
opt_list_out for outgoing (to be encoded) edns options
 2021-11-01 12:48:40 +00:00
Tom Carpay
3e6eeb504d Modules have their own outgoing ends options list 
But nothing happens with it yet
 2021-10-27 13:48:49 +00:00
W.C.A. Wijngaards
60663c766a Review fixup for keyraw pkey function use. 2021-08-02 13:39:48 +02:00
W.C.A. Wijngaards
ca00814e67 - Prepare for OpenSSL 3.0.0 provider API usage, move the sldns 
keyraw functions to produce EVP_PKEY results.
 2021-08-02 13:33:32 +02:00
W.C.A. Wijngaards
a7eaf6364d - Fix from lint for ignored return value. 2021-07-16 17:46:04 +02:00
W.C.A. Wijngaards
e4e0eaa63e Analysis workflow, fix ctime formatting for autotrust and testbound. 2021-06-25 15:11:10 +02:00
W.C.A. Wijngaards
79209823ac - Fix a number of warnings reported by the gcc analyzer. 2021-06-18 18:12:26 +02:00
Florian Obser
d4314cad33 Make VAL_MAX_RESTART_COUNT configurable. 
unbound tries very hard (up to 6 authoritative servers) to find a
validating answer. This is not always desirable, for example on high
latency links.
 2021-05-08 16:56:32 +02:00
W.C.A. Wijngaards
e217bb48ad - Remove case fallthrough from deprecate-rsa-1024 code. 2021-05-07 17:06:09 +02:00
W.C.A. Wijngaards
59ea44322e - Add ./configure --with-deprecate-rsa-1024 that turns off RSA 1024. 2021-05-07 14:28:20 +02:00
George Thessalonikefs
e9a5f5ab3f - Add more logging for out-of-memory cases. 2021-05-04 15:39:06 +02:00
W.C.A. Wijngaards
b7a633fdc0 Merge branch 'master' into zonemd 2021-02-04 16:08:11 +01:00
Willem Toorop
48ecf95108 Merge branch 'master' into features/padding 2021-01-22 10:29:50 +01:00
W.C.A. Wijngaards
42d7cdb7d5 zonemd, region freed, and qstate not used when not in a query, and nsec 
and nsec3 bitmap checks.
 2020-10-14 14:46:59 +02:00
W.C.A. Wijngaards
1dc4d7a9f6 zonemd, harden result length for unsupported algo in nettle digest final. 2020-10-09 14:40:26 +02:00
W.C.A. Wijngaards
5e477e8a31 Merge branch 'master' into zonemd 2020-10-09 14:32:24 +02:00
W.C.A. Wijngaards
fca884a7e6 - Fix warning in libnss compile, nss_buf2dsa is not used without DSA. 2020-10-09 14:31:55 +02:00
W.C.A. Wijngaards
6cb0c4c61d zonemd, libnss implementation and libnettle implementation. Both succeed 
on unit tests.
 2020-10-09 14:30:56 +02:00
W.C.A. Wijngaards
eb4932a463 zonemd, digest code calls, secalgo openssl sha384 and sha512. 2020-10-09 11:19:31 +02:00
W.C.A. Wijngaards
3163a93121 zonemd, loop over zone and canonicalize data, test call in unit test. 2020-10-06 17:07:24 +02:00
W.C.A. Wijngaards
dd59521e52 dlv removal, remove from comments and unused code in iterator and validator 2020-08-04 17:17:48 +02:00
W.C.A. Wijngaards
f78f6a3b29 dlv removal, remove from tests and validator state machine 2020-08-04 09:15:45 +02:00
W.C.A. Wijngaards
c0c722cd97 DLV removal 2020-08-04 09:05:09 +02:00
W.C.A. Wijngaards
ff50993f36 - Fix add missing DSA header, for compilation without deprecated 
OpenSSL APIs.
 2020-07-08 11:43:50 +02:00
Willem Toorop
4f78b37c61 Down- and upstream padding a la RFC7830 & RFC8467 2020-04-02 18:34:03 +02:00
Willem Toorop
d4dcdba07e Cleanup nettle_ecc_point when verifying for ... 
... ECDSA256 with libnettle
 2020-03-02 12:27:45 +01:00
W.C.A. Wijngaards
57bbbfc0e6 - Fix #170: Fix gcc undefined sanitizer signed integer overflow 
warning in signature expiry RFC1982 serial number arithmetic.
 2020-02-27 15:22:35 +01:00