607
68%

Ran 22 Oct 2015 01:36PM UTC

Jobs 1

Files 31

Run time 1s

Badge

Embed ▾

pending completion

Build # 607

Build Type

push

travis-ci

Committed by

vavrusa

Commit Message

iterator+rrcache: do not follow CNAME chains (if not DNSSEC-secured)

[1] shows an attack using spoofed CNAME targets to replace legitimate
entries in resolver cache by speeding up once-per-TTL attack opportunity

as a defense, the resolver almost always requeries CNAME targets and
doesn't store them in cache. the only exception is when the CNAME target
is within current authority, and the answer is DNSSEC-secured

thanks to Toshinori Maeno (@beyondDNS) for pointing this out [2]

[1]: https://tools.ietf.org/id/draft-weaver-dnsext-comprehensive-
resolver-00.html
[2]: https://moin.qmail.jp/DNS/KnotResolver/CNAMEpatch

Coverage Stats

4125 of 5471 relevant lines covered (75.4%)

635.58 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	607.1	22 Oct 2015 01:36PM UTC	0	75.4	Travis Job 607.1

Source Files on build 607

Detailed source file information is not available for this build.

CZ-NIC / knot-resolver / 607
68%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 607

CZ-NIC / knot-resolver / 607 68%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 607

CZ-NIC / knot-resolver / 607
68%

README BADGES
x