summaryrefslogtreecommitdiff
path: root/src/resolve
diff options
context:
space:
mode:
authorMartin Pitt <martin.pitt@ubuntu.com>2016-06-24 07:54:28 +0200
committerGitHub <noreply@github.com>2016-06-24 07:54:28 +0200
commitceeddf79b8464469a5307a1030862c7c4fe289e9 (patch)
tree4ad0a49ca457e8e53789c3aea41c6284ab3ff277 /src/resolve
parenta2c28c645160b4e9377db4cb40cb9f22141f2dd3 (diff)
resolved: add option to disable caching (#3592)
In some cases, caching DNS results locally is not desirable, a it makes DNS cache poisoning attacks a tad easier and also allows users on the system to determine whether or not a particular domain got visited by another user. Thus provide a new "Cache" resolved.conf option to disable it.
Diffstat (limited to 'src/resolve')
-rw-r--r--src/resolve/resolved-dns-transaction.c4
-rw-r--r--src/resolve/resolved-gperf.gperf1
-rw-r--r--src/resolve/resolved-manager.c1
-rw-r--r--src/resolve/resolved-manager.h1
-rw-r--r--src/resolve/resolved.conf.in1
5 files changed, 8 insertions, 0 deletions
diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c
index 09f60d3e76..06e7145422 100644
--- a/src/resolve/resolved-dns-transaction.c
+++ b/src/resolve/resolved-dns-transaction.c
@@ -590,6 +590,10 @@ static void dns_transaction_cache_answer(DnsTransaction *t) {
if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
return;
+ /* Caching disabled? */
+ if (!t->scope->manager->enable_cache)
+ return;
+
/* We never cache if this packet is from the local host, under
* the assumption that a locally running DNS server would
* cache this anyway, and probably knows better when to flush
diff --git a/src/resolve/resolved-gperf.gperf b/src/resolve/resolved-gperf.gperf
index 82f26215df..2fd56bce26 100644
--- a/src/resolve/resolved-gperf.gperf
+++ b/src/resolve/resolved-gperf.gperf
@@ -19,3 +19,4 @@ Resolve.FallbackDNS, config_parse_dns_servers, DNS_SERVER_FALLBACK, 0
Resolve.Domains, config_parse_search_domains, 0, 0
Resolve.LLMNR, config_parse_resolve_support, 0, offsetof(Manager, llmnr_support)
Resolve.DNSSEC, config_parse_dnssec_mode, 0, offsetof(Manager, dnssec_mode)
+Resolve.Cache, config_parse_bool, 0, offsetof(Manager, enable_cache)
diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
index 30036049da..add463b6a9 100644
--- a/src/resolve/resolved-manager.c
+++ b/src/resolve/resolved-manager.c
@@ -500,6 +500,7 @@ int manager_new(Manager **ret) {
m->llmnr_support = RESOLVE_SUPPORT_YES;
m->mdns_support = RESOLVE_SUPPORT_NO;
m->dnssec_mode = DEFAULT_DNSSEC_MODE;
+ m->enable_cache = true;
m->read_resolv_conf = true;
m->need_builtin_fallbacks = true;
m->etc_hosts_last = m->etc_hosts_mtime = USEC_INFINITY;
diff --git a/src/resolve/resolved-manager.h b/src/resolve/resolved-manager.h
index 114fec7927..deebd8e484 100644
--- a/src/resolve/resolved-manager.h
+++ b/src/resolve/resolved-manager.h
@@ -46,6 +46,7 @@ struct Manager {
ResolveSupport llmnr_support;
ResolveSupport mdns_support;
DnssecMode dnssec_mode;
+ bool enable_cache;
/* Network */
Hashmap *links;
diff --git a/src/resolve/resolved.conf.in b/src/resolve/resolved.conf.in
index a288588924..3bd8389c88 100644
--- a/src/resolve/resolved.conf.in
+++ b/src/resolve/resolved.conf.in
@@ -17,3 +17,4 @@
#Domains=
#LLMNR=yes
#DNSSEC=@DEFAULT_DNSSEC_MODE@
+#Cache=yes