diff options
author | Lennart Poettering <lennart@poettering.net> | 2017-02-15 16:01:53 +0100 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2017-02-17 10:25:15 +0100 |
commit | 97277567b8695e1c3f3eab65c9d1a9cf02d06fde (patch) | |
tree | d14a156c6cf6ddac5ff0ea23053df6a1f4d86722 | |
parent | cbb1aabb99c5898213cc8d7d942785dcc442581d (diff) |
resolved: when DNSSEC mode is disabled, don't go beyond EDNS0 feature level
There's no point in talking to a server in DNSSEC mode when we don't
actually want to verify anything.
See: #5352
-rw-r--r-- | src/resolve/resolved-dns-server.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/src/resolve/resolved-dns-server.c b/src/resolve/resolved-dns-server.c index 9f81798f6e..2df917e61e 100644 --- a/src/resolve/resolved-dns-server.c +++ b/src/resolve/resolved-dns-server.c @@ -399,12 +399,24 @@ static bool dns_server_grace_period_expired(DnsServer *s) { } DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) { + DnsServerFeatureLevel best; + assert(s); - if (s->possible_feature_level != DNS_SERVER_FEATURE_LEVEL_BEST && - dns_server_grace_period_expired(s)) { + /* Determine the best feature level we care about. If DNSSEC mode is off there's no point in using anything + * better than EDNS0, hence don't even try. */ + best = dns_server_get_dnssec_mode(s) == DNSSEC_NO ? + DNS_SERVER_FEATURE_LEVEL_EDNS0 : + DNS_SERVER_FEATURE_LEVEL_BEST; + + /* Clamp the feature level the highest level we care about. The DNSSEC mode might have changed since the last + * time, hence let's downgrade if we are still at a higher level. */ + if (s->possible_feature_level > best) + s->possible_feature_level = best; + + if (s->possible_feature_level < best && dns_server_grace_period_expired(s)) { - s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST; + s->possible_feature_level = best; dns_server_reset_counters(s); |