diff options
author | Rich Felker <dalias@aerifal.cx> | 2020-05-18 21:17:34 -0400 |
---|---|---|
committer | Rich Felker <dalias@aerifal.cx> | 2020-05-18 21:30:33 -0400 |
commit | fd7ec068efd590c0393a612599a4fab9bb0a8633 (patch) | |
tree | f7e4b3bf7e023ddfe8e464b5a71e0cb858bf4beb /src | |
parent | 593caa456309714402ca4cb77c3770f4c24da9da (diff) | |
download | musl-fd7ec068efd590c0393a612599a4fab9bb0a8633.zip musl-fd7ec068efd590c0393a612599a4fab9bb0a8633.tar.gz musl-fd7ec068efd590c0393a612599a4fab9bb0a8633.tar.bz2 |
set AD bit in dns queries, suppress for internal use
the AD (authenticated data) bit in outgoing dns queries is defined by
rfc3655 to request that the nameserver report (via the same bit in the
response) whether the result is authenticated by DNSSEC. while all
results returned by a DNSSEC conforming nameserver will be either
authenticated or cryptographically proven to lack DNSSEC protection,
for some applications it's necessary to be able to distinguish these
two cases. in particular, conforming and compatible handling of DANE
(TLSA) records requires enforcing them only in signed zones.
when the AD bit was first defined for queries, there were reports of
compatibility problems with broken firewalls and nameservers dropping
queries with it set. these problems are probably a thing of the past,
and broken nameservers are already unsupported. however, since there
is no use in the AD bit with the netdb.h interfaces, explicitly clear
it in the queries they make. this ensures that, even with broken
setups, the standard functions will work, and at most the res_*
functions break.
Diffstat (limited to 'src')
-rw-r--r-- | src/network/getnameinfo.c | 1 | ||||
-rw-r--r-- | src/network/lookup_name.c | 1 | ||||
-rw-r--r-- | src/network/res_mkquery.c | 1 |
3 files changed, 3 insertions, 0 deletions
diff --git a/src/network/getnameinfo.c b/src/network/getnameinfo.c index f77e73a..949e181 100644 --- a/src/network/getnameinfo.c +++ b/src/network/getnameinfo.c @@ -158,6 +158,7 @@ int getnameinfo(const struct sockaddr *restrict sa, socklen_t sl, unsigned char query[18+PTR_MAX], reply[512]; int qlen = __res_mkquery(0, ptr, 1, RR_PTR, 0, 0, 0, query, sizeof query); + query[3] = 0; /* don't need AD flag */ int rlen = __res_send(query, qlen, reply, sizeof reply); buf[0] = 0; if (rlen > 0) diff --git a/src/network/lookup_name.c b/src/network/lookup_name.c index c93263a..c4d994a 100644 --- a/src/network/lookup_name.c +++ b/src/network/lookup_name.c @@ -149,6 +149,7 @@ static int name_from_dns(struct address buf[static MAXADDRS], char canon[static 0, 0, 0, qbuf[nq], sizeof *qbuf); if (qlens[nq] == -1) return EAI_NONAME; + qbuf[nq][3] = 0; /* don't need AD flag */ nq++; } } diff --git a/src/network/res_mkquery.c b/src/network/res_mkquery.c index 6fa04a5..33f50cb 100644 --- a/src/network/res_mkquery.c +++ b/src/network/res_mkquery.c @@ -20,6 +20,7 @@ int __res_mkquery(int op, const char *dname, int class, int type, /* Construct query template - ID will be filled later */ memset(q, 0, n); q[2] = op*8 + 1; + q[3] = 32; /* AD */ q[5] = 1; memcpy((char *)q+13, dname, l); for (i=13; q[i]; i=j+1) { |