|
 |
ce426f |
commit 3e3002ffead0526d088c353f97475400367087da
|
|
|
ce426f |
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
|
|
|
ce426f |
Date: Tue Feb 24 12:57:26 2015 +0530
|
|
|
ce426f |
|
|
|
ce426f |
Skip logging for DNSSEC responses [BZ 14841]
|
|
|
ce426f |
|
|
|
ce426f |
DNSSEC defines a number of response types that one me expect when the
|
|
|
ce426f |
DO bit is set. We don't process any of them, but since we do allow
|
|
|
ce426f |
setting the DO bit, skip them without logging an error since it is
|
|
|
ce426f |
only a nuisance.
|
|
|
ce426f |
|
|
|
ce426f |
Tested on x86_64.
|
|
|
ce426f |
|
|
|
ce426f |
[BZ #14841]
|
|
|
ce426f |
* resolv/gethnamaddr.c (getanswer): Skip logging if
|
|
|
ce426f |
RES_USE_DNSSEC is set.
|
|
|
ce426f |
* resolv/nss_dns/dns-host.c (getanswer_r): Likewise.
|
|
|
ce426f |
|
|
|
ce426f |
diff --git glibc-2.17-c758a686/resolv/gethnamaddr.c glibc-2.17-c758a686/resolv/gethnamaddr.c
|
|
|
ce426f |
index a861a84..7fd0e49 100644
|
|
|
ce426f |
--- glibc-2.17-c758a686/resolv/gethnamaddr.c
|
|
|
ce426f |
+++ glibc-2.17-c758a686/resolv/gethnamaddr.c
|
|
|
ce426f |
@@ -331,23 +331,18 @@ getanswer (const querybuf *answer, int anslen, const char *qname, int qtype)
|
|
|
ce426f |
buflen -= n;
|
|
|
ce426f |
continue;
|
|
|
ce426f |
}
|
|
|
ce426f |
- if ((type == T_SIG) || (type == T_KEY) || (type == T_NXT)) {
|
|
|
ce426f |
- /* We don't support DNSSEC yet. For now, ignore
|
|
|
ce426f |
- * the record and send a low priority message
|
|
|
ce426f |
- * to syslog.
|
|
|
ce426f |
- */
|
|
|
ce426f |
- syslog(LOG_DEBUG|LOG_AUTH,
|
|
|
ce426f |
- "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
|
ce426f |
- qname, p_class(C_IN), p_type(qtype),
|
|
|
ce426f |
- p_type(type));
|
|
|
ce426f |
- cp += n;
|
|
|
ce426f |
- continue;
|
|
|
ce426f |
- }
|
|
|
ce426f |
if (type != qtype) {
|
|
|
ce426f |
- syslog(LOG_NOTICE|LOG_AUTH,
|
|
|
ce426f |
+ /* Log a low priority message if we get an unexpected
|
|
|
ce426f |
+ * record, but skip it if we are using DNSSEC since it
|
|
|
ce426f |
+ * uses many different types in responses that do not
|
|
|
ce426f |
+ * match QTYPE.
|
|
|
ce426f |
+ */
|
|
|
ce426f |
+ if ((_res.options & RES_USE_DNSSEC) == 0) {
|
|
|
ce426f |
+ syslog(LOG_NOTICE|LOG_AUTH,
|
|
|
ce426f |
"gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
|
ce426f |
- qname, p_class(C_IN), p_type(qtype),
|
|
|
ce426f |
- p_type(type));
|
|
|
ce426f |
+ qname, p_class(C_IN), p_type(qtype),
|
|
|
ce426f |
+ p_type(type));
|
|
|
ce426f |
+ }
|
|
|
ce426f |
cp += n;
|
|
|
ce426f |
continue; /* XXX - had_error++ ? */
|
|
|
ce426f |
}
|
|
|
ce426f |
diff --git glibc-2.17-c758a686/resolv/nss_dns/dns-host.c glibc-2.17-c758a686/resolv/nss_dns/dns-host.c
|
|
|
ce426f |
index f715ab0..b16b0dd 100644
|
|
|
ce426f |
--- glibc-2.17-c758a686/resolv/nss_dns/dns-host.c
|
|
|
ce426f |
+++ glibc-2.17-c758a686/resolv/nss_dns/dns-host.c
|
|
|
ce426f |
@@ -820,26 +820,19 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
|
|
|
ce426f |
linebuflen -= n;
|
|
|
ce426f |
continue;
|
|
|
ce426f |
}
|
|
|
ce426f |
- if (__builtin_expect (type == T_SIG, 0)
|
|
|
ce426f |
- || __builtin_expect (type == T_KEY, 0)
|
|
|
ce426f |
- || __builtin_expect (type == T_NXT, 0))
|
|
|
ce426f |
- {
|
|
|
ce426f |
- /* We don't support DNSSEC yet. For now, ignore the record
|
|
|
ce426f |
- and send a low priority message to syslog. */
|
|
|
ce426f |
- syslog (LOG_DEBUG | LOG_AUTH,
|
|
|
ce426f |
- "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
|
ce426f |
- qname, p_class (C_IN), p_type(qtype), p_type (type));
|
|
|
ce426f |
- cp += n;
|
|
|
ce426f |
- continue;
|
|
|
ce426f |
- }
|
|
|
ce426f |
|
|
|
ce426f |
if (type == T_A && qtype == T_AAAA && map)
|
|
|
ce426f |
have_to_map = 1;
|
|
|
ce426f |
else if (__builtin_expect (type != qtype, 0))
|
|
|
ce426f |
{
|
|
|
ce426f |
- syslog (LOG_NOTICE | LOG_AUTH,
|
|
|
ce426f |
- "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
|
ce426f |
- qname, p_class (C_IN), p_type (qtype), p_type (type));
|
|
|
ce426f |
+ /* Log a low priority message if we get an unexpected record, but
|
|
|
ce426f |
+ skip it if we are using DNSSEC since it uses many different types
|
|
|
ce426f |
+ in responses that do not match QTYPE. */
|
|
|
ce426f |
+ if ((_res.options & RES_USE_DNSSEC) == 0)
|
|
|
ce426f |
+ syslog (LOG_NOTICE | LOG_AUTH,
|
|
|
ce426f |
+ "gethostby*.getanswer: asked for \"%s %s %s\", "
|
|
|
ce426f |
+ "got type \"%s\"",
|
|
|
ce426f |
+ qname, p_class (C_IN), p_type (qtype), p_type (type));
|
|
|
ce426f |
cp += n;
|
|
|
ce426f |
continue; /* XXX - had_error++ ? */
|
|
|
ce426f |
}
|