summaryrefslogtreecommitdiff
path: root/src/resolve/resolved-dns-scope.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2015-12-25 15:05:46 +0100
committerLennart Poettering <lennart@poettering.net>2015-12-26 19:09:11 +0100
commitb652d4a2099d1c167584dcc1d179d47c58dc38a2 (patch)
tree3d597bd8be7cb96040d2d4a2cf8f08a7e685272e /src/resolve/resolved-dns-scope.c
parent0e4fb6b2dedf590741220b806c92e9e68857b457 (diff)
resolved: add an automatic downgrade to non-DNSSEC mode
This adds a mode that makes resolved automatically downgrade from DNSSEC support to classic non-DNSSEC resolving if the configured DNS server is not capable of DNSSEC. Enabling this mode increases compatibility with crappy network equipment, but of course opens up the system to downgrading attacks. The new mode can be enabled by setting DNSSEC=downgrade-ok in resolved.conf. DNSSEC=yes otoh remains a "strict" mode, where DNS resolving rather fails then allow downgrading. Downgrading is done: - when the server does not support EDNS0+DO - or when the server supports it but does not augment returned RRs with RRSIGs. The latter is detected when requesting DS or SOA RRs for the root domain (which is necessary to do proofs for unsigned data)
Diffstat (limited to 'src/resolve/resolved-dns-scope.c')
0 files changed, 0 insertions, 0 deletions