Commit graph

15 commits

Author SHA1 Message Date
Lennart Poettering 588c53d044 resolved: some RR types may appear only or not at all in a zone apex
Add extra checks when validating with RRSIGs. This follows recommendations from:

http://www.george-barwood.pwp.blueyonder.co.uk/DnsServer/NotesOnDNSSSEC.htm
2016-01-17 20:44:25 +01:00
Lennart Poettering e8233bce19 resolved: refuse validating wildcard RRs for SOA, NSEC3, DNAME 2016-01-13 20:21:57 +01:00
Lennart Poettering 04680e36a4 resolved: don#t allow explicit queries for RRSIG RRs
We wouldn't know how to validate them, since they are the signatures, and hence have no signatures.
2016-01-11 20:15:28 +01:00
Lennart Poettering d0129ddb9f resolved: refuse doing queries for known-obsolete RR types
Given how fragile DNS servers are with some DNS types, and given that we really should avoid confusing them with
known-weird lookups, refuse doing lookups for known-obsolete RR types.
2016-01-11 20:05:29 +01:00
Lennart Poettering 91adc4db33 resolved: don't attempt to send queries for DNSSEC RR types to servers not supporting them
If we already degraded the feature level below DO don't bother with sending requests for DS, DNSKEY, RRSIG, NSEC, NSEC3
or NSEC3PARAM RRs. After all, we cannot do DNSSEC validation then anyway, and we better not press a legacy server like
this with such modern concepts.

This also has the benefit that when we try to validate a response we received using DNSSEC, and we detect a limited
server support level while doing so, all further auxiliary DNSSEC queries will fail right-away.
2016-01-11 19:40:00 +01:00
Lennart Poettering d3c7e9139c resolved: split out a new dns_type_may_redirect() call
Let's abstract which RRs shall honour CNAMEs, and which ones should not.
2015-12-26 19:09:09 +01:00
Lennart Poettering 4b548ef382 resolved: move DNS class utilities to dns-type.c and add more helpers
Let's make DNS class helpers more like DNS type helpers, let's move them
from resolved-dns-rr.[ch] into dns-type.[ch].

This also adds two new calls dns_class_is_pseudo() and
dns_class_is_valid_rr() which operate similar to dns_type_is_pseudo()
and dns_type_is_valid_rr() but for classes instead of types.

This should hopefully make handling of DNS classes and DNS types more
alike.
2015-12-18 18:53:11 +01:00
Lennart Poettering c463eb783e resolved: generalize DNS RR type validity checks
Check the validity of RR types as we parse or receive data from IPC
clients, and use the same code for all of them.
2015-12-11 14:14:27 +01:00
Lennart Poettering c33be4a6f2 resolved: refuse to cache ANY kind of pseudo-RR-type 2015-12-11 14:14:27 +01:00
Lennart Poettering bea4c76fa0 resolved: extend list of pseudo RR types
Also, explain the situation with a longer comment.
2015-12-11 14:13:31 +01:00
Lennart Poettering c84e853934 resolved: fix parameter type of dns_type_is_pseudo()
DNS RR types are uint16_t after all, treat them as such.
2015-12-10 11:28:01 +01:00
Torstein Husebø 94e5ba370a treewide: fix typos 2015-07-29 12:29:46 +02:00
Tom Gundersen 8e6edc490c resolved: rr - ignore pseudo types in NSEC(3) bitmaps 2015-07-23 18:06:50 +02:00
Zbigniew Jędrzejewski-Szmek de292aa1dd resolve-host: make arg_type an int
We are using it also to store _DNS_TYPE_INVALID, so it should be signed.
2014-08-03 22:02:32 -04:00
Zbigniew Jędrzejewski-Szmek 7263f72499 resolve: add more record types and convert to gperf table
We are unlikely to evert support most of them, but we can at least
display the types properly.

The list is taken from the IANA list.

The table of number->name mappings is converted to a switch
statement. gcc does a nice job of optimizing lookup (when optimization
is enabled).

systemd-resolve-host -t is now case insensitive.
2014-08-03 22:02:32 -04:00