fba3e94df5
This adjusts our feature level handling: when DNSSEC strict mode is on, let's never lower the feature level below the lowest DNSSEC mode. Also, when asking whether DNSSEC is supproted, always say yes in strict mode. This means that error reporting about transactions that fail because of missing DNSSEC RRs will not report "incompatible-server" but instead "missing-signature" or suchlike. The main difference here is that DNSSEC failures become local to a transaction, instead of propagating into the feature level we reuse for future transactions. This is beneficial with routers that implement "mostly a DNS proxy", i.e. that propagate most DNS requests 1:1 to their upstream servers, but synthesize local answers for a select few domains. For example, AVM Fritz!Boxes operate that way: they proxy most traffic 1:1 upstream in an DNSSEC-compatible fashion, but synthesize the "fritz.box" locally, so that it can be used to configure the router. This local domain cannot be DNSSEC verified, it comes without signatures. Previously this would mean once that domain was resolved feature level would be downgraded, and we'd thus fail all future DNSSEC attempts. With this change, the immediate lookup for "fritz.box" will fail validation, but for all other unrelated future ones that comes without prejudice. (While we are at it, also make a couple of other downgrade paths a bit tighter.) Fixes: #10570 #14435 #6490
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list or join our IRC channel.
Stable branches with backported patches are available in the stable repo.