diff options
author | Lennart Poettering <lennart@poettering.net> | 2016-01-13 02:29:31 +0100 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2016-01-13 20:21:57 +0100 |
commit | e8233bce196a14fa3ebde2969594fcdfa4404e19 (patch) | |
tree | 96c31f230e85cc595a7e3375169607cd3f76c0b2 /src/resolve/dns-type.c | |
parent | 7160eb1b867a4bc64522287352fbe2a6aa687d2a (diff) |
resolved: refuse validating wildcard RRs for SOA, NSEC3, DNAME
Diffstat (limited to 'src/resolve/dns-type.c')
-rw-r--r-- | src/resolve/dns-type.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/src/resolve/dns-type.c b/src/resolve/dns-type.c index fb8228048d..47a37fa0a7 100644 --- a/src/resolve/dns-type.c +++ b/src/resolve/dns-type.c @@ -120,6 +120,21 @@ bool dns_type_may_redirect(uint16_t type) { DNS_TYPE_KEY); } +bool dns_type_may_wildcard(uint16_t type) { + + /* The following records may not be expanded from wildcard RRsets */ + + if (dns_type_is_pseudo(type)) + return false; + + return !IN_SET(type, + DNS_TYPE_NSEC3, + DNS_TYPE_SOA, + + /* Prohibited by https://tools.ietf.org/html/rfc4592#section-4.4 */ + DNS_TYPE_DNAME); +} + bool dns_type_is_dnssec(uint16_t type) { return IN_SET(type, DNS_TYPE_DS, |