From e8233bce196a14fa3ebde2969594fcdfa4404e19 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 13 Jan 2016 02:29:31 +0100 Subject: resolved: refuse validating wildcard RRs for SOA, NSEC3, DNAME --- src/resolve/dns-type.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'src/resolve/dns-type.c') diff --git a/src/resolve/dns-type.c b/src/resolve/dns-type.c index fb8228048d..47a37fa0a7 100644 --- a/src/resolve/dns-type.c +++ b/src/resolve/dns-type.c @@ -120,6 +120,21 @@ bool dns_type_may_redirect(uint16_t type) { DNS_TYPE_KEY); } +bool dns_type_may_wildcard(uint16_t type) { + + /* The following records may not be expanded from wildcard RRsets */ + + if (dns_type_is_pseudo(type)) + return false; + + return !IN_SET(type, + DNS_TYPE_NSEC3, + DNS_TYPE_SOA, + + /* Prohibited by https://tools.ietf.org/html/rfc4592#section-4.4 */ + DNS_TYPE_DNAME); +} + bool dns_type_is_dnssec(uint16_t type) { return IN_SET(type, DNS_TYPE_DS, -- cgit v1.2.3-54-g00ecf