Jeremie Courreges-Anglas <[email protected]> writes:
> This flag is useful for software that wants to rely on the resolver to
> perform DNSSEC validation. Among the use cases there are DANE and SSHFP
> records, and the obvious interfaces that I think are useful are
> res_mkquery and getrrsetbyname. The latter still doesn't support
> DNSSEC, another diff will follow.
>
> The first hunk is not supposed to be committed, it is only here for
> basic testing (add "options dnssec" to resolv.conf). Other testing
> could involve postfix or exim.
>
> Since RES_USE_DNSSEC now actually adds an EDNS0 OPT record to the
> outgoing packet, one can be concerned with problems with resolvers out
> there. Windows seems to have a way to disable EDNS0, I am not aware of
> existing mechanisms elsewhere.
>
> Thoughts? ok?
Reviewing the dnssec patch from Peter J. Philipp, I noticed that this
first diff lacks hunks to amend the response flags check. Initially
I had - lazily - only removed the Z_MASK test.
Updated diff, that includes bits for asr_debug.c. First hunk still here
for basic testing. Packets with the AD or CD flags are no longer
discarded, given the new Z_MASK #define. (I don't see a reason to
discard packets with the CD bit set, we should probably just ignore
it. I've kept things as is for the must-be-zero part.)
Index: asr/asr.c
===================================================================
RCS file: /d/cvs/src/lib/libc/asr/asr.c,v
retrieving revision 1.56
diff -u -p -r1.56 asr.c
--- asr/asr.c 23 Feb 2017 17:04:02 -0000 1.56
+++ asr/asr.c 27 Feb 2017 07:25:11 -0000
@@ -597,6 +597,8 @@ pass0(char **tok, int n, struct asr_ctx
ac->ac_options |= RES_USEVC;
else if (!strcmp(tok[i], "edns0"))
ac->ac_options |= RES_USE_EDNS0;
+ else if (!strcmp(tok[i], "dnssec"))
+ ac->ac_options |= RES_USE_DNSSEC;
else if ((!strncmp(tok[i], "ndots:", 6))) {
e = NULL;
d = strtonum(tok[i] + 6, 1, 16, &e);
Index: asr/asr_debug.c
===================================================================
RCS file: /d/cvs/src/lib/libc/asr/asr_debug.c,v
retrieving revision 1.23
diff -u -p -r1.23 asr_debug.c
--- asr/asr_debug.c 17 Feb 2017 22:24:45 -0000 1.23
+++ asr/asr_debug.c 27 Feb 2017 07:25:11 -0000
@@ -37,7 +37,6 @@ static const char *print_rr(const struct
FILE *_asr_debug = NULL;
#define OPCODE_SHIFT 11
-#define Z_SHIFT 4
static const char *
rcodetostr(uint16_t v)
@@ -147,7 +146,7 @@ static const char *
print_header(const struct asr_dns_header *h, char *buf, size_t max)
{
snprintf(buf, max,
- "id:0x%04x %s op:%i %s %s %s %s z:%i r:%s qd:%i an:%i ns:%i ar:%i",
+ "id:0x%04x %s op:%i %s %s %s %s z:%i %s %s r:%s qd:%i an:%i ns:%i
ar:%i",
((int)h->id),
(h->flags & QR_MASK) ? "QR":" ",
(int)(OPCODE(h->flags) >> OPCODE_SHIFT),
@@ -155,7 +154,9 @@ print_header(const struct asr_dns_header
(h->flags & TC_MASK) ? "TC":" ",
(h->flags & RD_MASK) ? "RD":" ",
(h->flags & RA_MASK) ? "RA":" ",
- ((h->flags & Z_MASK) >> Z_SHIFT),
+ (h->flags & Z_MASK),
+ (h->flags & AD_MASK) ? "AD":" ",
+ (h->flags & CD_MASK) ? "CD":" ",
rcodetostr(RCODE(h->flags)),
h->qdcount, h->ancount, h->nscount, h->arcount);
Index: asr/asr_private.h
===================================================================
RCS file: /d/cvs/src/lib/libc/asr/asr_private.h,v
retrieving revision 1.43
diff -u -p -r1.43 asr_private.h
--- asr/asr_private.h 23 Feb 2017 17:04:02 -0000 1.43
+++ asr/asr_private.h 27 Feb 2017 07:25:11 -0000
@@ -23,7 +23,9 @@
#define TC_MASK (0x1 << 9)
#define RD_MASK (0x1 << 8)
#define RA_MASK (0x1 << 7)
-#define Z_MASK (0x7 << 4)
+#define Z_MASK (0x1 << 6)
+#define AD_MASK (0x1 << 5)
+#define CD_MASK (0x1 << 4)
#define RCODE_MASK (0xf)
#define OPCODE(v) ((v) & OPCODE_MASK)
@@ -297,7 +299,7 @@ __BEGIN_HIDDEN_DECLS
void _asr_pack_init(struct asr_pack *, char *, size_t);
int _asr_pack_header(struct asr_pack *, const struct asr_dns_header *);
int _asr_pack_query(struct asr_pack *, uint16_t, uint16_t, const char *);
-int _asr_pack_edns0(struct asr_pack *, uint16_t);
+int _asr_pack_edns0(struct asr_pack *, uint16_t, int);
void _asr_unpack_init(struct asr_unpack *, const char *, size_t);
int _asr_unpack_header(struct asr_unpack *, struct asr_dns_header *);
int _asr_unpack_query(struct asr_unpack *, struct asr_dns_query *);
Index: asr/asr_utils.c
===================================================================
RCS file: /d/cvs/src/lib/libc/asr/asr_utils.c,v
retrieving revision 1.16
diff -u -p -r1.16 asr_utils.c
--- asr/asr_utils.c 19 Feb 2017 12:02:30 -0000 1.16
+++ asr/asr_utils.c 27 Feb 2017 07:25:11 -0000
@@ -423,12 +423,19 @@ _asr_pack_query(struct asr_pack *p, uint
}
int
-_asr_pack_edns0(struct asr_pack *p, uint16_t pktsz)
+_asr_pack_edns0(struct asr_pack *p, uint16_t pktsz, int dnssec_do)
{
+ DPRINT("asr EDNS0 pktsz:%hu dnssec:%s\n", pktsz,
+ dnssec_do ? "yes" : "no");
+
pack_dname(p, ""); /* root */
pack_u16(p, T_OPT); /* OPT */
pack_u16(p, pktsz); /* UDP payload size */
- pack_u32(p, 0); /* extended RCODE and flags */
+
+ /* extended RCODE and flags */
+ pack_u16(p, 0);
+ pack_u16(p, dnssec_do ? DNS_MESSAGEEXTFLAG_DO : 0);
+
pack_u16(p, 0); /* RDATA len */
return (p->err) ? (-1) : (0);
Index: asr/res_mkquery.c
===================================================================
RCS file: /d/cvs/src/lib/libc/asr/res_mkquery.c,v
retrieving revision 1.10
diff -u -p -r1.10 res_mkquery.c
--- asr/res_mkquery.c 18 Feb 2017 19:23:05 -0000 1.10
+++ asr/res_mkquery.c 27 Feb 2017 07:25:11 -0000
@@ -61,14 +61,15 @@ res_mkquery(int op, const char *dname, i
if (ac->ac_options & RES_RECURSE)
h.flags |= RD_MASK;
h.qdcount = 1;
- if (ac->ac_options & RES_USE_EDNS0)
+ if (ac->ac_options & (RES_USE_EDNS0 | RES_USE_DNSSEC))
h.arcount = 1;
_asr_pack_init(&p, buf, buflen);
_asr_pack_header(&p, &h);
_asr_pack_query(&p, type, class, dn);
- if (ac->ac_options & RES_USE_EDNS0)
- _asr_pack_edns0(&p, MAXPACKETSZ);
+ if (ac->ac_options & (RES_USE_EDNS0 | RES_USE_DNSSEC))
+ _asr_pack_edns0(&p, MAXPACKETSZ,
+ ac->ac_options & RES_USE_DNSSEC);
_asr_ctx_unref(ac);
Index: asr/res_send_async.c
===================================================================
RCS file: /d/cvs/src/lib/libc/asr/res_send_async.c,v
retrieving revision 1.32
diff -u -p -r1.32 res_send_async.c
--- asr/res_send_async.c 18 Feb 2017 22:25:13 -0000 1.32
+++ asr/res_send_async.c 27 Feb 2017 07:25:11 -0000
@@ -377,14 +377,15 @@ setup_query(struct asr_query *as, const
if (as->as_ctx->ac_options & RES_RECURSE)
h.flags |= RD_MASK;
h.qdcount = 1;
- if (as->as_ctx->ac_options & RES_USE_EDNS0)
+ if (as->as_ctx->ac_options & (RES_USE_EDNS0 | RES_USE_DNSSEC))
h.arcount = 1;
_asr_pack_init(&p, as->as.dns.obuf, as->as.dns.obufsize);
_asr_pack_header(&p, &h);
_asr_pack_query(&p, type, class, dname);
- if (as->as_ctx->ac_options & RES_USE_EDNS0)
- _asr_pack_edns0(&p, MAXPACKETSZ);
+ if (as->as_ctx->ac_options & (RES_USE_EDNS0 | RES_USE_DNSSEC))
+ _asr_pack_edns0(&p, MAXPACKETSZ,
+ as->as_ctx->ac_options & RES_USE_DNSSEC);
if (p.err) {
DPRINT("error packing query");
errno = EINVAL;
Index: net/resolver.3
===================================================================
RCS file: /d/cvs/src/lib/libc/net/resolver.3,v
retrieving revision 1.36
diff -u -p -r1.36 resolver.3
--- net/resolver.3 18 Feb 2017 19:23:05 -0000 1.36
+++ net/resolver.3 27 Feb 2017 07:25:11 -0000
@@ -199,9 +199,6 @@ uses 4096 bytes as input buffer size.
Request that the resolver uses
Domain Name System Security Extensions (DNSSEC),
as defined in RFCs 4033, 4034, and 4035.
-On
-.Ox
-this option does nothing.
.El
.Pp
The
--
jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
