Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-20 02:38:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Better handling of truncated DNSSEC replies.

Browse Source
This commit is contained in:
Simon Kelley
2014-01-20 11:57:23 +00:00
parent 72ae2f3d56
commit 5d3b87a484
2 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/dnsmasq.h
View File

@@ -519,6 +519,7 @@ struct hostsfile {
#define STAT_BOGUS 3 #define STAT_BOGUS 3
#define STAT_NEED_DS 4 #define STAT_NEED_DS 4
#define STAT_NEED_KEY 5 #define STAT_NEED_KEY 5
#define STAT_TRUNCATED 6
#define FREC_NOREBIND 1 #define FREC_NOREBIND 1
#define FREC_CHECKING_DISABLED 2 #define FREC_CHECKING_DISABLED 2

16
src/forward.c
View File

@@ -751,14 +751,11 @@ void reply_query(int fd, int family, time_t now)
if (header->hb3 & HB3_TC) if (header->hb3 & HB3_TC)
{ {
/* Truncated answer can't be validated. /* Truncated answer can't be validated.
The client will retry over TCP, but if this is an answer to a If this is an answer to a DNSSEC-generated query, we still
DNSSEC-generated query, we have a problem. Should really re-send need to get the client to retry over TCP, so return
over TCP. No-one with any sense will make a DNSKEY or DS RRset an answer with the TC bit set, even if the actual answer fits.
exceed 4096, so this may not be a real problem. Just log */
for now. */ status = STAT_TRUNCATED;
if (forward->flags & (FREC_DNSKEY_QUERY | FREC_DS_QUERY))
my_syslog(LOG_ERR, _("Reply to DNSSEC query truncated - validation fails."));
status = STAT_INSECURE;
} }
else if (forward->flags & FREC_DNSKEY_QUERY) else if (forward->flags & FREC_DNSKEY_QUERY)
status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class); status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
@@ -892,6 +889,9 @@ void reply_query(int fd, int family, time_t now)
} }
} }
if (status == STAT_TRUNCATED)
header->hb3 |= HB3_TC;
else
log_query(F_KEYTAG | F_SECSTAT, "result", NULL, log_query(F_KEYTAG | F_SECSTAT, "result", NULL,
status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS")); status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));