{"push_id":890483499,"size":13,"distinct_size":13,"ref":"refs/heads/master","head":"8eb3655cdb1910537615bb69c5ecf90dcc9d81c3","before":"517d12cc0c94e09f8b4783e84ee0d2d5df3e9b5a","commits":[{"sha":"c9ad0edbab44123ad14767232c2d5a2c5641b459","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: refuse resolving of a number of domains listed in RFC6303\n\nWe already blacklisted a few domains, add more.","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/c9ad0edbab44123ad14767232c2d5a2c5641b459"},{"sha":"2a44bec4f62833222a85ad8c90054468dfa75013","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: make expiration error recognizable","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/2a44bec4f62833222a85ad8c90054468dfa75013"},{"sha":"1b4f6e79ec51a57003896a0b605fba427b4a98d2","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: optionally, allocate DnsResourceKey objects on the stack\n\nSometimes when looking up entries in hashmaps indexed by a\nDnsResourceKey it is helpful not having to allocate a full\nDnsResourceKey dynamically just to use it as search key. Instead,\noptionally allow allocation of a DnsResourceKey on the stack. Resource\nkeys allocated like that of course are subject to other lifetime cycles\nthan the usual Resource keys, hence initialize the reference counter to\nto (unsigned) -1.\n\nWhile we are at it, remove the prototype for\ndns_resource_key_new_dname() which was never implemented.","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/1b4f6e79ec51a57003896a0b605fba427b4a98d2"},{"sha":"22f711bb6a1ca9ef20c1672a7fa077f5d3235d55","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: don't bother with picking a search domain when searching is disabled","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/22f711bb6a1ca9ef20c1672a7fa077f5d3235d55"},{"sha":"28b9b7640603f88cb49f95609331fa5072715f15","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: rework how we allow allow queries to be dispatched to scopes\n\nPreviously, we'd never do any single-label or root domain lookups via\nDNS, thus leaving single-label lookups to LLMNR and the search path\nlogic in order that single-label names don't leak too easily onto the\ninternet. With this change we open things up a bit, and only prohibit\nA/AAAA lookups of single-label/root domains, but allow all other\nlookups. This should provide similar protection, but allow us to resolve\nDNSKEY+DS RRs for the top-level and root domains.\n\n(This also simplifies handling of the search domain detection, and gets\nrid of dns_scope_has_search_domains() in favour of\ndns_scope_get_search_domains()).","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/28b9b7640603f88cb49f95609331fa5072715f15"},{"sha":"0d2cd47617b423f37d7425be7a56ae2fca8ff9f6","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: add a simple trust anchor database as additional RR source\n\nWhen doing DNSSEC lookups we need to know one or more DS or DNSKEY RRs\nas trust anchors to validate lookups. With this change we add a\ncompiled-in trust anchor database, serving the root DS key as of today,\nretrieved from:\n\nhttps://data.iana.org/root-anchors/root-anchors.xml\n\nThe interface is kept generic, so that additional DS or DNSKEY RRs may\nbe served via the same interface, for example by provisioning them\nlocally in external files to support \"islands\" of security.\n\nThe trust anchor database becomes the fourth source of RRs we maintain,\nbesides, the network, the local cache, and the local zone.","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/0d2cd47617b423f37d7425be7a56ae2fca8ff9f6"},{"sha":"896c567247371cc14e49774c3b844a7038c37a60","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: add a limit on the max DNSSEC RRSIG expiry skew we allow","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/896c567247371cc14e49774c3b844a7038c37a60"},{"sha":"24710c48ed16be5fa461fbb303a744a907541daf","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: introduce a dnssec_mode setting per scope\n\nThe setting controls which kind of DNSSEC validation is done: none at\nall, trusting the AD bit, or client-side validation.\n\nFor now, no validation is implemented, hence the setting doesn't do much\nyet, except of toggling the CD bit in the generated messages if full\nclient-side validation is requested.","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/24710c48ed16be5fa461fbb303a744a907541daf"},{"sha":"2cd8727718632ed80fa3871fddf71506c548d770","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: maintain a short TODO list for DNSSEC support in the dnssec C files for now","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/2cd8727718632ed80fa3871fddf71506c548d770"},{"sha":"3ba27cd339d2de53fa34c1ec7242da50a1c047b7","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: when synthesizing NODATA from cached NSEC bitmaps, honour CNAME/DNAME\n\nWhen an RR type is not set in an NSEC, then the CNAME/DNAME types might\nstill be, hence check them too.\n\nOtherwise we might end up refusing resolving of CNAME'd RRs if we cached\nan NSEC before.","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/3ba27cd339d2de53fa34c1ec7242da50a1c047b7"},{"sha":"931851e8e492a4d2715e22dcde50a5e7ccef4b49","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: add a concept of \"authenticated\" responses\n\nThis adds a new SD_RESOLVED_AUTHENTICATED flag for responses we return\non the bus. When set, then the data has been authenticated. For now this\nmostly reflects the DNSSEC AD bit, if DNSSEC=trust is set. As soon as\nthe client-side validation is complete it will be hooked up to this flag\ntoo.\n\nWe also set this bit whenver we generated the data ourselves, for\nexample, because it originates in our local LLMNR zone, or from the\nbuilt-in trust anchor database.\n\nThe \"systemd-resolve-host\" tool has been updated to show the flag state\nfor the data it shows.","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/931851e8e492a4d2715e22dcde50a5e7ccef4b49"},{"sha":"bb1fa24261fd60ec1df6c6c42940c5f764d9246d","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: update DNSSEC TODO list a bit","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/bb1fa24261fd60ec1df6c6c42940c5f764d9246d"},{"sha":"8eb3655cdb1910537615bb69c5ecf90dcc9d81c3","author":{"email":"7c8224529a7c718e876cb2496c973509fde1e50e@jklm.no","name":"Tom Gundersen"},"message":"Merge pull request #2092 from poettering/dnssec2\n\nSecond DNSSEC patch set","distinct":true,"url":"https://api.github.com/repos/systemd-mailing-devs/systemd-mailing-list/commits/8eb3655cdb1910537615bb69c5ecf90dcc9d81c3"}]}