1
0
mirror of https://github.com/systemd/systemd.git synced 2025-03-22 06:50:18 +03:00
Lennart Poettering b652d4a209 resolved: add an automatic downgrade to non-DNSSEC mode
This adds a mode that makes resolved automatically downgrade from DNSSEC
support to classic non-DNSSEC resolving if the configured DNS server is
not capable of DNSSEC. Enabling this mode increases compatibility with
crappy network equipment, but of course opens up the system to
downgrading attacks.

The new mode can be enabled by setting DNSSEC=downgrade-ok in
resolved.conf. DNSSEC=yes otoh remains a "strict" mode, where DNS
resolving rather fails then allow downgrading.

Downgrading is done:

- when the server does not support EDNS0+DO
- or when the server supports it but does not augment returned RRs with
  RRSIGs. The latter is detected when requesting DS or SOA RRs for the
  root domain (which is necessary to do proofs for unsigned data)
2015-12-26 19:09:11 +01:00
2015-07-06 17:47:38 +02:00
2015-11-14 09:54:17 +01:00
2015-08-31 18:12:37 +02:00
2015-11-23 12:32:59 +01:00
2015-06-03 00:22:53 +02:00
2014-06-04 15:41:10 -04:00
2015-07-27 20:15:34 +02:00
2015-12-13 07:50:11 +00:00

systemd - System and Service Manager

Build Status
Coverity Scan Status

Details

  • General information about systemd can be found in the systemd Wiki
  • Information about build requirements are provided in the README file
Description
The systemd System and Service Manager
Readme 572 MiB
Languages
C 89.2%
Python 5.3%
Shell 4.1%
Meson 1.2%