From 446997ff1433d33452b81dfa9e626b8dccf101a4 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Wed, 30 Oct 2019 17:26:58 +0100 Subject: resolv: Implement trust-ad option for /etc/resolv.conf [BZ #20358] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This introduces a concept of trusted name servers, for which the AD bit is passed through to applications. For untrusted name servers (the default), the AD bit in responses are cleared, to provide a safe default. This approach is very similar to the one suggested by Pavel Šimerda in . The DNS test framework in support/ is enhanced with support for setting the AD bit in responses. Tested on x86_64-linux-gnu. Change-Id: Ibfe0f7c73ea221c35979842c5c3b6ed486495ccc --- support/resolv_test.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'support/resolv_test.c') diff --git a/support/resolv_test.c b/support/resolv_test.c index aeca519..b1c745d 100644 --- a/support/resolv_test.c +++ b/support/resolv_test.c @@ -182,6 +182,8 @@ resolv_response_init (struct resolv_response_builder *b, if (flags.tc) b->buffer[2] |= 0x02; b->buffer[3] = 0x80 | flags.rcode; /* Always set RA. */ + if (flags.ad) + b->buffer[3] |= 0x20; /* Fill in the initial section count values. */ b->buffer[4] = flags.qdcount >> 8; -- cgit v1.1