lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-07 06:43:00 +03:00
Code Activity

resolv: Remove RES_INSECURE1, RES_INSECURE2

Browse Source 
Always perform the associated security checks.
This commit is contained in:
Florian Weimer
2019-04-08 11:19:38 +02:00
parent 3f8b44be0a
commit 333221862e
5 changed files with 25 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@@ -1,3 +1,12 @@
2019-04-08 Florian Weimer <fweimer@redhat.com>
* resolv/resolv.h (RES_INSECURE1, RES_INSECURE2): Remove
definitions.
* resolv/res_send.c (send_dg): Always perform RES_INSECURE1 and
RES_INSECURE2 security checks.
* resolv/res_debug.c (p_option): Remove RES_INSECURE1 and
RES_INSECURE2 handling.
2019-04-08 Florian Weimer <fweimer@redhat.com> 2019-04-08 Florian Weimer <fweimer@redhat.com>
resolv: Remove support for RES_USE_INET6 and the inet6 option. resolv: Remove support for RES_USE_INET6 and the inet6 option.

3
NEWS
View File

@@ -38,6 +38,9 @@ Deprecated and removed features, and other changes affecting compatibility:
* Support for the "inet6" option in /etc/resolv.conf and the RES_USE_INET6 * Support for the "inet6" option in /etc/resolv.conf and the RES_USE_INET6
resolver flag (deprecated in glibc 2.25) have been removed. resolver flag (deprecated in glibc 2.25) have been removed.
* The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub
resolver have been removed from <resolv.h>.
Changes to build and runtime requirements: Changes to build and runtime requirements:
* GCC 6.2 or later is required to build the GNU C Library. * GCC 6.2 or later is required to build the GNU C Library.

2
resolv/res_debug.c
View File

@@ -604,8 +604,6 @@ p_option(u_long option) {
case RES_DEFNAMES: return "defnam"; case RES_DEFNAMES: return "defnam";
case RES_STAYOPEN: return "styopn"; case RES_STAYOPEN: return "styopn";
case RES_DNSRCH: return "dnsrch"; case RES_DNSRCH: return "dnsrch";
case RES_INSECURE1: return "insecure1";
case RES_INSECURE2: return "insecure2";
case RES_NOALIASES: return "noaliases"; case RES_NOALIASES: return "noaliases";
case RES_ROTATE: return "rotate"; case RES_ROTATE: return "rotate";
case RES_USE_EDNS0: return "edns0"; case RES_USE_EDNS0: return "edns0";

28
resolv/res_send.c
View File

@@ -1316,31 +1316,25 @@ send_dg(res_state statp,
*/ */
goto wait; goto wait;
} }
if (!(statp->options & RES_INSECURE1) &&
!res_ourserver_p(statp, &from)) { /* Paranoia check. Due to the connected UDP socket,
/* the kernel has already filtered invalid addresses
* response from wrong server? ignore it. for us. */
* XXX - potential security hazard could if (!res_ourserver_p(statp, &from))
* be detected here.
*/
goto wait; goto wait;
}
if (!(statp->options & RES_INSECURE2) /* Check for the correct header layout and a matching
&& (recvresp1 || !res_queriesmatch(buf, buf + buflen, question. */
if ((recvresp1 || !res_queriesmatch(buf, buf + buflen,
*thisansp, *thisansp,
*thisansp *thisansp
+ *thisanssizp)) + *thisanssizp))
&& (recvresp2 || !res_queriesmatch(buf2, buf2 + buflen2, && (recvresp2 || !res_queriesmatch(buf2, buf2 + buflen2,
*thisansp, *thisansp,
*thisansp *thisansp
+ *thisanssizp))) { + *thisanssizp)))
/*
* response contains wrong query? ignore it.
* XXX - potential security hazard could
* be detected here.
*/
goto wait; goto wait;
}
if (anhp->rcode == SERVFAIL || if (anhp->rcode == SERVFAIL ||
anhp->rcode == NOTIMP || anhp->rcode == NOTIMP ||
anhp->rcode == REFUSED) { anhp->rcode == REFUSED) {

2
resolv/resolv.h
View File

@@ -115,8 +115,6 @@ struct res_sym {
#define RES_DEFNAMES 0x00000080 /* use default domain name */ #define RES_DEFNAMES 0x00000080 /* use default domain name */
#define RES_STAYOPEN 0x00000100 /* Keep TCP socket open */ #define RES_STAYOPEN 0x00000100 /* Keep TCP socket open */
#define RES_DNSRCH 0x00000200 /* search up local domain tree */ #define RES_DNSRCH 0x00000200 /* search up local domain tree */
#define RES_INSECURE1 0x00000400 /* type 1 security disabled */
#define RES_INSECURE2 0x00000800 /* type 2 security disabled */
#define RES_NOALIASES 0x00001000 /* shuts off HOSTALIASES feature */ #define RES_NOALIASES 0x00001000 /* shuts off HOSTALIASES feature */
#define RES_ROTATE 0x00004000 /* rotate ns list after each query */ #define RES_ROTATE 0x00004000 /* rotate ns list after each query */
#define RES_NOCHECKNAME \ #define RES_NOCHECKNAME \