|
 |
00db10 |
commit 3e3002ffead0526d088c353f97475400367087da
|
|
|
00db10 |
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
|
|
|
00db10 |
Date: Tue Feb 24 12:57:26 2015 +0530
|
|
|
00db10 |
|
|
|
00db10 |
Skip logging for DNSSEC responses [BZ 14841]
|
|
|
00db10 |
|
|
|
00db10 |
DNSSEC defines a number of response types that one me expect when the
|
|
|
00db10 |
DO bit is set. We don't process any of them, but since we do allow
|
|
|
00db10 |
setting the DO bit, skip them without logging an error since it is
|
|
|
00db10 |
only a nuisance.
|
|
|
00db10 |
|
|
|
00db10 |
Tested on x86_64.
|
|
|
00db10 |
|
|
|
00db10 |
[BZ #14841]
|
|
|
00db10 |
* resolv/gethnamaddr.c (getanswer): Skip logging if
|
|
|
00db10 |
RES_USE_DNSSEC is set.
|
|
|
00db10 |
* resolv/nss_dns/dns-host.c (getanswer_r): Likewise.
|
|
|
00db10 |
|
|
|
00db10 |
diff --git glibc-2.17-c758a686/resolv/gethnamaddr.c glibc-2.17-c758a686/resolv/gethnamaddr.c
|
|
|
00db10 |
index a861a84..7fd0e49 100644
|
|
|
00db10 |
--- glibc-2.17-c758a686/resolv/gethnamaddr.c
|
|
|
00db10 |
+++ glibc-2.17-c758a686/resolv/gethnamaddr.c
|
|
|
00db10 |
@@ -331,23 +331,18 @@ getanswer (const querybuf *answer, int anslen, const char *qname, int qtype)
|
|
|
00db10 |
buflen -= n;
|
|
|
00db10 |
continue;
|
|
|
00db10 |
}
|
|
|
00db10 |
- if ((type == T_SIG) || (type == T_KEY) || (type == T_NXT)) {
|
|
|
00db10 |
- /* We don't support DNSSEC yet. For now, ignore
|
|
|
00db10 |
- * the record and send a low priority message
|
|
|
00db10 |
- * to syslog.
|
|
|
00db10 |
- */
|
|
|
00db10 |
- syslog(LOG_DEBUG|LOG_AUTH,
|
|
|
00db10 |
- "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
|
00db10 |
- qname, p_class(C_IN), p_type(qtype),
|
|
|
00db10 |
- p_type(type));
|
|
|
00db10 |
- cp += n;
|
|
|
00db10 |
- continue;
|
|
|
00db10 |
- }
|
|
|
00db10 |
if (type != qtype) {
|
|
|
00db10 |
- syslog(LOG_NOTICE|LOG_AUTH,
|
|
|
00db10 |
+ /* Log a low priority message if we get an unexpected
|
|
|
00db10 |
+ * record, but skip it if we are using DNSSEC since it
|
|
|
00db10 |
+ * uses many different types in responses that do not
|
|
|
00db10 |
+ * match QTYPE.
|
|
|
00db10 |
+ */
|
|
|
00db10 |
+ if ((_res.options & RES_USE_DNSSEC) == 0) {
|
|
|
00db10 |
+ syslog(LOG_NOTICE|LOG_AUTH,
|
|
|
00db10 |
"gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
|
00db10 |
- qname, p_class(C_IN), p_type(qtype),
|
|
|
00db10 |
- p_type(type));
|
|
|
00db10 |
+ qname, p_class(C_IN), p_type(qtype),
|
|
|
00db10 |
+ p_type(type));
|
|
|
00db10 |
+ }
|
|
|
00db10 |
cp += n;
|
|
|
00db10 |
continue; /* XXX - had_error++ ? */
|
|
|
00db10 |
}
|
|
|
00db10 |
diff --git glibc-2.17-c758a686/resolv/nss_dns/dns-host.c glibc-2.17-c758a686/resolv/nss_dns/dns-host.c
|
|
|
00db10 |
index f715ab0..b16b0dd 100644
|
|
|
00db10 |
--- glibc-2.17-c758a686/resolv/nss_dns/dns-host.c
|
|
|
00db10 |
+++ glibc-2.17-c758a686/resolv/nss_dns/dns-host.c
|
|
|
00db10 |
@@ -820,26 +820,19 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
|
|
|
00db10 |
linebuflen -= n;
|
|
|
00db10 |
continue;
|
|
|
00db10 |
}
|
|
|
00db10 |
- if (__builtin_expect (type == T_SIG, 0)
|
|
|
00db10 |
- || __builtin_expect (type == T_KEY, 0)
|
|
|
00db10 |
- || __builtin_expect (type == T_NXT, 0))
|
|
|
00db10 |
- {
|
|
|
00db10 |
- /* We don't support DNSSEC yet. For now, ignore the record
|
|
|
00db10 |
- and send a low priority message to syslog. */
|
|
|
00db10 |
- syslog (LOG_DEBUG | LOG_AUTH,
|
|
|
00db10 |
- "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
|
00db10 |
- qname, p_class (C_IN), p_type(qtype), p_type (type));
|
|
|
00db10 |
- cp += n;
|
|
|
00db10 |
- continue;
|
|
|
00db10 |
- }
|
|
|
00db10 |
|
|
|
00db10 |
if (type == T_A && qtype == T_AAAA && map)
|
|
|
00db10 |
have_to_map = 1;
|
|
|
00db10 |
else if (__builtin_expect (type != qtype, 0))
|
|
|
00db10 |
{
|
|
|
00db10 |
- syslog (LOG_NOTICE | LOG_AUTH,
|
|
|
00db10 |
- "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
|
00db10 |
- qname, p_class (C_IN), p_type (qtype), p_type (type));
|
|
|
00db10 |
+ /* Log a low priority message if we get an unexpected record, but
|
|
|
00db10 |
+ skip it if we are using DNSSEC since it uses many different types
|
|
|
00db10 |
+ in responses that do not match QTYPE. */
|
|
|
00db10 |
+ if ((_res.options & RES_USE_DNSSEC) == 0)
|
|
|
00db10 |
+ syslog (LOG_NOTICE | LOG_AUTH,
|
|
|
00db10 |
+ "gethostby*.getanswer: asked for \"%s %s %s\", "
|
|
|
00db10 |
+ "got type \"%s\"",
|
|
|
00db10 |
+ qname, p_class (C_IN), p_type (qtype), p_type (type));
|
|
|
00db10 |
cp += n;
|
|
|
00db10 |
continue; /* XXX - had_error++ ? */
|
|
|
00db10 |
}
|