summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2017-02-15 16:01:53 +0100
committerLennart Poettering <lennart@poettering.net>2017-02-17 10:25:15 +0100
commit97277567b8695e1c3f3eab65c9d1a9cf02d06fde (patch)
treed14a156c6cf6ddac5ff0ea23053df6a1f4d86722
parentcbb1aabb99c5898213cc8d7d942785dcc442581d (diff)
resolved: when DNSSEC mode is disabled, don't go beyond EDNS0 feature level
There's no point in talking to a server in DNSSEC mode when we don't actually want to verify anything. See: #5352
-rw-r--r--src/resolve/resolved-dns-server.c18
1 files changed, 15 insertions, 3 deletions
diff --git a/src/resolve/resolved-dns-server.c b/src/resolve/resolved-dns-server.c
index 9f81798f6e..2df917e61e 100644
--- a/src/resolve/resolved-dns-server.c
+++ b/src/resolve/resolved-dns-server.c
@@ -399,12 +399,24 @@ static bool dns_server_grace_period_expired(DnsServer *s) {
}
DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
+ DnsServerFeatureLevel best;
+
assert(s);
- if (s->possible_feature_level != DNS_SERVER_FEATURE_LEVEL_BEST &&
- dns_server_grace_period_expired(s)) {
+ /* Determine the best feature level we care about. If DNSSEC mode is off there's no point in using anything
+ * better than EDNS0, hence don't even try. */
+ best = dns_server_get_dnssec_mode(s) == DNSSEC_NO ?
+ DNS_SERVER_FEATURE_LEVEL_EDNS0 :
+ DNS_SERVER_FEATURE_LEVEL_BEST;
+
+ /* Clamp the feature level the highest level we care about. The DNSSEC mode might have changed since the last
+ * time, hence let's downgrade if we are still at a higher level. */
+ if (s->possible_feature_level > best)
+ s->possible_feature_level = best;
+
+ if (s->possible_feature_level < best && dns_server_grace_period_expired(s)) {
- s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
+ s->possible_feature_level = best;
dns_server_reset_counters(s);