|
 |
85f98a |
From 89f57e39b69f92beacb6bad9c68d61f9c4fb0e77 Mon Sep 17 00:00:00 2001
|
|
|
85f98a |
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
|
85f98a |
Date: Fri, 2 Mar 2018 13:17:04 +0100
|
|
|
85f98a |
Subject: [PATCH] Print warning on FIPS machine with dnssec enabled. Dnsmasq
|
|
|
85f98a |
has no proper FIPS 140-2 compliant implementation.
|
|
|
85f98a |
|
|
|
85f98a |
---
|
|
|
85f98a |
src/dnsmasq.c | 6 +++++-
|
|
|
85f98a |
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
85f98a |
|
|
|
85f98a |
diff --git a/src/dnsmasq.c b/src/dnsmasq.c
|
|
|
85f98a |
index ce44809..9f6c020 100644
|
|
|
85f98a |
--- a/src/dnsmasq.c
|
|
|
85f98a |
+++ b/src/dnsmasq.c
|
|
|
85f98a |
@@ -187,6 +187,7 @@ int main (int argc, char **argv)
|
|
|
85f98a |
|
|
|
85f98a |
if (daemon->cachesize < CACHESIZ)
|
|
|
85f98a |
die(_("cannot reduce cache size from default when DNSSEC enabled"), NULL, EC_BADCONF);
|
|
|
85f98a |
+
|
|
|
85f98a |
#else
|
|
|
85f98a |
die(_("DNSSEC not available: set HAVE_DNSSEC in src/config.h"), NULL, EC_BADCONF);
|
|
|
85f98a |
#endif
|
|
|
85f98a |
@@ -769,7 +770,10 @@ int main (int argc, char **argv)
|
|
|
85f98a |
}
|
|
|
85f98a |
|
|
|
85f98a |
my_syslog(LOG_INFO, _("DNSSEC validation enabled"));
|
|
|
85f98a |
-
|
|
|
85f98a |
+
|
|
|
85f98a |
+ if (access("/etc/system-fips", F_OK) == 0)
|
|
|
85f98a |
+ my_syslog(LOG_WARNING, _("DNSSEC support is not FIPS 140-2 compliant"));
|
|
|
85f98a |
+
|
|
|
85f98a |
daemon->dnssec_no_time_check = option_bool(OPT_DNSSEC_TIME);
|
|
|
85f98a |
if (option_bool(OPT_DNSSEC_TIME) && !daemon->back_to_the_future)
|
|
|
85f98a |
my_syslog(LOG_INFO, _("DNSSEC signature timestamps not checked until receipt of SIGINT"));
|
|
|
85f98a |
--
|
|
|
85f98a |
2.14.4
|
|
|
85f98a |
|