This introduces a concept of trusted name servers, for which the
AD bit is passed through to applications. For untrusted name
servers (the default), the AD bit in responses are cleared, to
provide a safe default.
This approach is very similar to the one suggested by Pavel Šimerda
in <https://bugzilla.redhat.com/show_bug.cgi?id=1164339#c15>.
The DNS test framework in support/ is enhanced with support for
setting the AD bit in responses.
Tested on x86_64-linux-gnu.
Change-Id: Ibfe0f7c73ea221c35979842c5c3b6ed486495ccc
This patch removes the HP_TIMING_BITS usage for fast random bits and replace
with clock_gettime (CLOCK_MONOTONIC). It has unspecified starting time and
nano-second accuracy, so its randomness is significantly better than
gettimeofday.
Althoug it should incur in more overhead (specially for architecture that
support hp-timing), the symbol is also common implemented as a vDSO.
Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. I also
checked on a i686-gnu build.
* include/random-bits.h: New file.
* resolv/res_mkquery.c [HP_TIMING_AVAIL] (RANDOM_BITS,
(__res_context_mkquery): Remove usage hp-timing usage and replace with
random_bits.
* resolv/res_send.c [HP_TIMING_AVAIL] (nameserver_offset): Likewise.
* sysdeps/posix/tempname.c [HP_TIMING_AVAIL] (__gen_tempname):
Likewise.
struct resolv_context objects provide a temporary resolver context
which does not change during a name lookup operation. Only when the
outmost context is created, the stub resolver configuration is
verified to be current (at present, only against previous res_init
calls). Subsequent attempts to obtain the context will reuse the
result of the initial verification operation.
struct resolv_context can also be extended in the future to store
data which needs to be deallocated during thread cancellation.
In EDNS0 records the maximum result size is transmitted in a 16
bit value. Large buffer sizes were handled incorrectly by using
only the low 16 bits. Fix this by limiting the size to 0xffff.
* resolv/res_mkquery.c: Define __res_nopt.
* resolv/res_query.c (__libc_res_nquery): If RES_USE_EDNS0 is set
try adding EDNS0 record.
* resolv/res_send.c (send_dg): If request failed with FORMERR and
EDNS0 record was send make sure we don't try it again.
* resolv/resolv.h: Define RES_F_EDNS0ERR and RES_USE_EDNS0.
* include/resolv.h: Declare __res_nopt.
* resolv/res_mkquery.c: Use NS_PUT16 and NS_PUT32 instead of __putshort
and __putlong respectively. Correct buffer overflow check for
NS_NOTIFY_OP.
* resolv/res_send.c (send_vc): Use ns_put16 instead of putshort.
1999-12-03 Andreas Jaeger <aj@suse.de>
* nss/getXXbyYY.c: Include <resolv.h>
(FUNCTION_NAME): Use res_ninit instead of res_init.
* nss/getXXbyYY_r.c [NEED__RES]: Include <resolv.h> for _res
declaration and prototypes.
Remove extra _res declaration.
(INTERNAL): Use thread aware res_ninit function.
* inet/gethstbyad_r.c: Include <resolv.h>.
* resolv/res_data.c: Update from Bind 8.2.2-P5. Moved res_init to
res_libc.c. Disabled unneeded functions.
* resolv/res_libc.c: New file.
* Versions.def: Add version GLIBC_2.2 for libpthread.
Add versions GLIBC_2.1 and GLIBC_2.2 for libresolv.
* include/resolv.h: Add internal interfaces.
* resolv/Makefile (routines): Add new files.
(libresolv-routines): Likewise.
(distribute): Likewise.
* resolv/gethnamaddr.c: Use thread safe resolver functions.
* resolv/nss_dns/dns-host.c: Likewise.
* resolv/nss_dns/dns-network.c: Likewise.
* resolv/arpa/nameser.h: Update from Bind 8.2.2-P5.
* resolv/nsap_addr.c: Likewise.
* resolv/res_comp.c: Likewise.
* resolv/res_debug.c: Likewise.
* resolv/res_init.c: Likewise.
* resolv/res_mkquery.c: Likewise.
* resolv/res_query.c: Likewise.
* resolv/res_send.c: Likewise.
* resolv/resolv.h: Likewise.
* resolv/Versions: Add __res_state and __res_ninit with version
GLIBC_2.2 to libc.
Add new interfaces with version GLIBC_2.2 to libresolv.
* resolv/Banner: Update.
* include/arpa/nameser_compat.h: New file.
* resolv/ns_name.c: New file from Bind 8.2.2-P5.
* resolv/ns_netint.c: Likewise.
* resolv/ns_parse.c: Likewise.
* resolv/ns_print.c: Likewise.
* resolv/ns_samedomain.c: Likewise.
* resolv/ns_ttl.c: Likewise.
* resolv/arpa/nameser_compat.h: Likewise.
* resolv/res_debug.h: Likewise.
Some patches are based on work done by Adam D. Bradley
<artdodge@cs.bu.edu>.
* sysdeps/unix/sysv/linux/configure.in: Remove check for ldconfig,
set always use_ldconfig instead.
Thu Aug 29 00:28:08 1996 Ulrich Drepper <drepper@cygnus.com>
* stdio-common/printf_fp.c (__printf_fp): Use default value `.` if
`decimal' char is 0.
* C-numeric.c (not_available): New constant.
(_nl_C_LC_NUMERIC): Use `not_available' for grouping value.
* nss/nsswitch.conf: Example configuration file.
* nss/db-Makefile: Example Makefile for generation of databases
for nss_db.
* nss/Makefile (distribute): Add nsswitch.conf and db-Makefile.
1996-08-28 Paul Eggert <eggert@twinsun.com>
* C-messages.c (_nl_C_LC_MESSAGES): Set yesexpr to "^[yY]" and
noexpr to "^[nN]"; this conforms to POSIX.2.
* C-time.c (_nl_C_LC_TIME): Change %d to %e in d_t_format, to
conform to POSIX.2.
1996-08-28 Paul Eggert <eggert@twinsun.com>
* C-monetary.c (not_available): New constant.
(_nl_C_LC_MONETARY): Set mon_decimal_point to "", and set
mon_grouping, int_frac_digits, frac_digits, p_cs_precedes,
p_sep_by_space, n_cs_precedes, n_sep_by_space, p_sign_posn, and
n_sign_posn to CHAR_MAX, as required by the POSIX Standard.
Wed Aug 28 23:12:28 1996 Ulrich Drepper <drepper@cygnus.com>
* nss/nss_db/db-XXX.c: Correct function names. They must be
`_nss_db_*' instead of `_nss_files_*'.
(lookup): `parse_line' returns 1 if succesful.
* nss/nss_files/files-service.c (servbyname): Key for database
must also contain protocol names.
(servbypt): Likewise.
Test must also check for protocol. Add `proto' argument.
Tue Aug 27 09:56:13 1996 Andreas Schwab <schwab@issan.informatik.uni-dortmund.de>
* MakeTAGS ($P/subdirs.pot): Prefix all file names, not only the
first one.
Fri Aug 16 16:11:25 1996 Thomas Bushnell, n/BSG <thomas@gnu.ai.mit.edu>
* nss/nss_dns/dns-host.c (_nss_dns_gethostbyname2_r): Treat
EPFNOSUPPORT and EAFNOSUPPORT as implying NSS_STATUS_UNAVAIL just
like ECONNREFUSED already does.
(_nss_dns_gethostbyaddr_r): Likewise.
* nss/nss_dns/dns-network.c (_nss_dns_getnetbyname_r): Likewise.
(_nss_dns_getnetbyaddr_r): Likewise.
* sysdeps/mach/hurd/socket.c (socket): For message transmission
and RPC errors that indicate that the socket server is not really
present and able to do its job, turn the error into EPFNOSUPPORT.
* sysdeps/generic/sbrk.c (__sbrk): Get kernel brk address
always only if in static libc or if statically linked program
uses libc.so.
Wed Aug 14 21:36:16 1996 Ulrich Drepper <drepper@cygnus.com>
* stdlib/strtod.c (STRTOD): Correct assertion about size of
wint_t and wchar_t. Reported by David Mosberger-Tang.
Mon Aug 12 22:40:16 1996 Andreas Schwab <schwab@issan.informatik.uni-dortmund.de>
* elf/dl-lookup.c (_dl_lookup_symbol): Remove fifth parameter
RELOC_ADDR and make NOPLT a set of flags. All callers
changed. Delete condition that checks for resolving to the
location being filled in. Add condition to skip the
executable's symbols if requested.
* elf/link.h: Change declaration of _dl_lookup_symbol
accordingly.
(DL_LOOKUP_NOEXEC, DL_LOOKUP_NOPLT): New definitions.
* elf/dl-reloc.c (RESOLVE): Remove second parameter and rename
NOPLT to FLAGS.
* elf/dl-runtime.c (RESOLVE): Likewise.
* elf/rtld.c (RESOLVE): Likewise.
* sysdeps/m68k/dl-machine.h (elf_machine_rela): Pass
DL_LOOKUP_NOEXEC as second argument to the RESOLVE macro if
processing a copy reloc, DL_LOOKUP_NOPLT for a jump slot
reloc, zero otherwise.
* sysdeps/alpha/dl-machine.h (elf_machine_rela): Likewise.
* sysdeps/i386/dl-machine.h (elf_machine_rel): Likewise.
* sysdeps/mips/dl-machine.h (elf_machine_rel): Likewise.
Wed Aug 14 17:57:08 1996 Ulrich Drepper <drepper@cygnus.com>
* MakeTAGS: Clean up use of --omit-header and -n for xgettext.
* po/header.pot: Add empty line at end.
Sun Aug 11 13:45:33 1996 Andreas Schwab <schwab@issan.informatik.uni-dortmund.de>
* MakeTAGS (all-pot): Remove $P/errlist.pot, all error messages
are now in $P/stdio-common.pot.
(XGETTEXTFLAGS-errlist.pot): Variable removed.
Mon Aug 12 19:25:03 1996 Andreas Schwab <schwab@issan.informatik.uni-dortmund.de>
* Makerules (do-ar, o-iterator-doit): Compute path to autolock
script at run time, not configure time.
* config.make.in, configure.in: Undo previous change.
Wed Aug 14 13:20:02 1996 Ulrich Drepper <drepper@cygnus.com>
* sysdeps/unix/sysv/linux/i386/close.S: Push return value of thread
on stack as argument for `_exit'. Reported by Andreas Schwab.
Mon Aug 12 19:36:25 1996 Andreas Schwab <schwab@issan.informatik.uni-dortmund.de>
* sysdeps/unix/sysv/linux/m68k/clone.S: New file.
Wed Aug 14 04:22:35 1996 Richard Henderson <rth@tamu.edu>
* elf/dl-load.c (_dl_map_object): Save name in malloced memory.
(_dl_map_object_from_fd): Free name on error.
Wed Aug 14 13:00:09 1996 Ulrich Drepper <drepper@cygnus.com>
* string/strdup.c: Use result of memcpy to avoid reloading.
Tue Aug 13 00:55:03 1996 Andreas Schwab <schwab@issan.informatik.uni-dortmund.de>
* shadow/sgetspent_r.c (__sgetspent_r): Copy string to buffer, not
the other way round.
* resolv/Makefile (libresolv-routines): Add base64, inet_net_ntop,
inet_net_pton, inet_net.
* resolv/arpa/nameser.h (__BIND): Update version number.
Mon Aug 12 19:03:22 1996 Thomas Bushnell n/BSG <thomas@psilocin.gnu.ai.mit.edu>
* sysdeps/generic/gnu/types.h: Declare __fd_mask as `unsigned long'.
* mach/Makefile (mach/mach_host.uh): Depend on
$(objpfx)/mach-syscalls.mk.
($(objpfx)mach-shortcuts.h): Depend on $(objpfx)mach/mach_host.h.
(This fixes a make loop; thanks to Marcus Daniels
<marcus@sysc.pdx.edu> for the patch.)
