picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Systemd/src
History
Lennart Poettering 547973dea7 resolved: chase DNSKEY/DS RRs when doing look-ups with DNSSEC enabled 
This adds initial support for validating RRSIG/DNSKEY/DS chains when
doing lookups. Proof-of-non-existance, or proof-of-unsigned-zones is not
implemented yet.

With this change DnsTransaction objects will generate additional
DnsTransaction objects when looking for DNSKEY or DS RRs to validate an
RRSIG on a response. DnsTransaction objects are thus created for three
reasons now:

1) Because a user asked for something to be resolved, i.e. requested by
   a DnsQuery/DnsQueryCandidate object.
2) As result of LLMNR RR probing, requested by a DnsZoneItem.
3) Because another DnsTransaction requires the requested RRs for
   validation of its own response.

DnsTransactions are shared between all these users, and are GC
automatically as soon as all of these users don't need a specific
transaction anymore.

To unify the handling of these three reasons for existance for a
DnsTransaction, a new common naming is introduced: each DnsTransaction
now tracks its "owners" via a Set* object named "notify_xyz", containing
all owners to notify on completion.

A new DnsTransaction state is introduced called "VALIDATING" that is
entered after a response has been receieved which needs to be validated,
as long as we are still waiting for the DNSKEY/DS RRs from other
DnsTransactions.

This patch will request the DNSKEY/DS RRs bottom-up, and then validate
them top-down.

Caching of RRs is now only done after verification, so that the cache is
not poisoned with known invalid data.

The "DnsAnswer" object gained a substantial number of new calls, since
we need to add/remove RRs to it dynamically now.
 		2015-12-10 11:35:52 +01:00
..
ac-power treewide: no need to negate errno for log_*_errno() 2014-11-28 13:29:21 +01:00
activate util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
analyze tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
ask-password strv: Add _cleanup_strv_free_erase_ and _cleanup_string_free_erase_ 2015-10-19 23:13:07 +02:00
backlight tree-wide: group include of libudev.h with sd-* 2015-11-17 07:06:08 +01:00
basic basic: add RB-Tree implementation 2015-12-07 18:34:05 +01:00
binfmt defs: rework CONF_DIRS_NULSTR() macro 2015-11-10 17:31:31 +01:00
boot tree-wide: sort includes 2015-11-16 22:09:36 +01:00
bootchart tree-wide: sort includes in *.h 2015-11-18 23:09:02 +01:00
bus-proxyd tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
cgls tests: turn check if manager cannot be intialized into macro 2015-12-02 09:50:00 -05:00
cgroups-agent tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
cgtop tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
compat-libs #pragma once here and there 2015-01-23 09:30:44 -05:00
core Merge pull request #2056 from evverx/expose-soft-limits-on-the-bus 2015-12-10 11:20:03 +01:00
cryptsetup tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
dbus1-generator treewide: apply errno.cocci 2015-11-09 20:01:06 +01:00
debug-generator debug-generator: respect kernel parameters for default unit setting 2015-11-03 14:47:39 +03:00
delta treewide: apply errno.cocci 2015-11-09 20:01:06 +01:00
detect-virt detect-virt: add new --chroot switch to detect chroot() environments 2015-10-27 13:25:57 +01:00
escape util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
firstboot firstboot: log on take_etc_passwd_lock error too 2015-11-15 18:30:26 +00:00
fsck tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
fstab-generator fstab-gen: post can't be NULL 2015-11-25 21:21:44 +01:00
getty-generator util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
gpt-auto-generator tree-wide: group include of libudev.h with sd-* 2015-11-17 07:06:08 +01:00
hibernate-resume tree-wide: sort includes 2015-11-16 22:09:36 +01:00
hostname hostnamed: SMBIOS 3.0 knows the "tablet" form factor, add support for it 2015-12-02 20:32:58 +01:00
hwdb tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
import tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
initctl tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
journal journal: silently skip failing large messages if journald is missing 2015-12-03 11:44:59 -05:00
journal-remote tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
kernel-install 90-loaderentry.install: fixup BOOT_OPTIONS 2015-06-02 16:10:06 +02:00
libsystemd tests: turn check if manager cannot be intialized into macro 2015-12-02 09:50:00 -05:00
libsystemd-network util-lib: update dns_name_to_wire_format() to optionally generate DNSSEC canonical names 2015-12-02 22:50:11 +01:00
libudev libudev: simplify udev_device_ensure_usec_initialized a bit 2015-12-07 00:44:14 -05:00
locale tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
login login: make sure /run/nologin has correct SELinux label 2015-12-04 22:29:38 +01:00
machine nspawn: set TasksMax in machined instead of nspawn 2015-12-04 23:36:39 +01:00
machine-id-setup tree-wide: sort includes 2015-11-16 22:09:36 +01:00
modules-load defs: rework CONF_DIRS_NULSTR() macro 2015-11-10 17:31:31 +01:00
network tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
notify util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
nspawn nspawn: set TasksMax in machined instead of nspawn 2015-12-04 23:36:39 +01:00
nss-myhostname util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
nss-mymachines tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
nss-resolve tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
path util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
quotacheck tree-wide: sort includes 2015-11-16 22:09:36 +01:00
random-seed util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
rc-local-generator treewide: apply errno.cocci 2015-11-09 20:01:06 +01:00
remount-fs remount-fs: modernize coding style a bit 2015-11-17 00:52:10 +01:00
reply-password util-lib: split out fd-related operations into fd-util.[ch] 2015-10-25 13:19:18 +01:00
resolve resolved: chase DNSKEY/DS RRs when doing look-ups with DNSSEC enabled 2015-12-10 11:35:52 +01:00
resolve-host resolved: add a concept of "authenticated" responses 2015-12-03 21:17:49 +01:00
rfkill tree-wide: group include of libudev.h with sd-* 2015-11-17 07:06:08 +01:00
run tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
shared Merge pull request #2056 from evverx/expose-soft-limits-on-the-bus 2015-12-10 11:20:03 +01:00
sleep util-lib: split out fd-related operations into fd-util.[ch] 2015-10-25 13:19:18 +01:00
socket-proxy util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
sysctl defs: rework CONF_DIRS_NULSTR() macro 2015-11-10 17:31:31 +01:00
system-update-generator util-lib: move a number of fs operations into fs-util.[ch] 2015-10-27 13:25:56 +01:00
systemctl tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
systemd libsystemd: make sure we prefix even the dirty secrets in our API with "_sd_" 2015-11-27 20:33:04 +01:00
sysusers defs: rework CONF_DIRS_NULSTR() macro 2015-11-10 17:31:31 +01:00
sysv-generator install: follow unit file symlinks in /usr, but not /etc when looking for [Install] data 2015-11-12 17:57:04 +01:00
test Merge pull request #2115 from dvdhrm/rbtree 2015-12-08 17:31:09 +01:00
timedate tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
timesync tree-wide: sort includes in *.h 2015-11-18 23:09:02 +01:00
tmpfiles tmpfiles: create subvolumes for "v", "q", and "Q" only if / is a subvolume 2015-11-16 15:25:42 +01:00
tty-ask-password-agent tty-ask-password-agent: fix typo in error message 2015-11-05 13:44:01 +01:00
udev Merge pull request #2110 from keszybz/udev-indentation 2015-12-09 14:18:37 +01:00
update-done util-lib: split out IO related calls to io-util.[ch] 2015-10-26 01:24:38 +01:00
update-utmp tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easy 2015-11-27 19:19:36 +01:00
user-sessions user-sessions: make sure /run/nologin has correct SELinux label 2015-12-04 22:01:17 +01:00
vconsole treewide: use the negative error codes returned by our functions 2015-11-05 13:44:06 +01:00
.gitignore
…
Makefile
…