|
 |
edfbb2 |
Backport the support/ changes from this commit, to avoid future
|
|
|
edfbb2 |
conflicts:
|
|
|
edfbb2 |
|
|
|
edfbb2 |
commit 446997ff1433d33452b81dfa9e626b8dccf101a4
|
|
|
edfbb2 |
Author: Florian Weimer <fweimer@redhat.com>
|
|
|
edfbb2 |
Date: Wed Oct 30 17:26:58 2019 +0100
|
|
|
edfbb2 |
|
|
|
edfbb2 |
resolv: Implement trust-ad option for /etc/resolv.conf [BZ #20358]
|
|
|
edfbb2 |
|
|
|
edfbb2 |
This introduces a concept of trusted name servers, for which the
|
|
|
edfbb2 |
AD bit is passed through to applications. For untrusted name
|
|
|
edfbb2 |
servers (the default), the AD bit in responses are cleared, to
|
|
|
edfbb2 |
provide a safe default.
|
|
|
edfbb2 |
|
|
|
edfbb2 |
This approach is very similar to the one suggested by Pavel Šimerda
|
|
|
edfbb2 |
in <https://bugzilla.redhat.com/show_bug.cgi?id=1164339#c15>.
|
|
|
edfbb2 |
|
|
|
edfbb2 |
The DNS test framework in support/ is enhanced with support for
|
|
|
edfbb2 |
setting the AD bit in responses.
|
|
|
edfbb2 |
|
|
|
edfbb2 |
Tested on x86_64-linux-gnu.
|
|
|
edfbb2 |
|
|
|
edfbb2 |
Change-Id: Ibfe0f7c73ea221c35979842c5c3b6ed486495ccc
|
|
|
edfbb2 |
|
|
|
edfbb2 |
diff --git a/support/resolv_test.c b/support/resolv_test.c
|
|
|
edfbb2 |
index 3f2a09f36f445878..28af227cb5ed901c 100644
|
|
|
edfbb2 |
--- a/support/resolv_test.c
|
|
|
edfbb2 |
+++ b/support/resolv_test.c
|
|
|
edfbb2 |
@@ -182,6 +182,8 @@ resolv_response_init (struct resolv_response_builder *b,
|
|
|
edfbb2 |
if (flags.tc)
|
|
|
edfbb2 |
b->buffer[2] |= 0x02;
|
|
|
edfbb2 |
b->buffer[3] = 0x80 | flags.rcode; /* Always set RA. */
|
|
|
edfbb2 |
+ if (flags.ad)
|
|
|
edfbb2 |
+ b->buffer[3] |= 0x20;
|
|
|
edfbb2 |
|
|
|
edfbb2 |
/* Fill in the initial section count values. */
|
|
|
edfbb2 |
b->buffer[4] = flags.qdcount >> 8;
|
|
|
edfbb2 |
diff --git a/support/resolv_test.h b/support/resolv_test.h
|
|
|
edfbb2 |
index 4c2e6c1b417f5fcd..be736aead40cd0cc 100644
|
|
|
edfbb2 |
--- a/support/resolv_test.h
|
|
|
edfbb2 |
+++ b/support/resolv_test.h
|
|
|
edfbb2 |
@@ -134,6 +134,9 @@ struct resolv_response_flags
|
|
|
edfbb2 |
/* If true, the TC (truncation) flag will be set. */
|
|
|
edfbb2 |
bool tc;
|
|
|
edfbb2 |
|
|
|
edfbb2 |
+ /* If true, the AD (authenticated data) flag will be set. */
|
|
|
edfbb2 |
+ bool ad;
|
|
|
edfbb2 |
+
|
|
|
edfbb2 |
/* Initial section count values. Can be used to artificially
|
|
|
edfbb2 |
increase the counts, for malformed packet testing.*/
|
|
|
edfbb2 |
unsigned short qdcount;
|