resolv: Implement trust-ad option for /etc/resolv.conf [BZ #20358]
authorFlorian Weimer <fweimer@redhat.com>
Wed, 30 Oct 2019 16:26:58 +0000 (17:26 +0100)
committerFlorian Weimer <fweimer@redhat.com>
Wed, 27 Nov 2019 19:54:37 +0000 (20:54 +0100)
commit446997ff1433d33452b81dfa9e626b8dccf101a4
tree9a0e13fb7ca042a6f05fa9310f862c494580da80
parent4a2ab5843a5cc4a5db1b3b79916a520ea8b115dc
resolv: Implement trust-ad option for /etc/resolv.conf [BZ #20358]

This introduces a concept of trusted name servers, for which the
AD bit is passed through to applications.  For untrusted name
servers (the default), the AD bit in responses are cleared, to
provide a safe default.

This approach is very similar to the one suggested by Pavel Šimerda
in <https://bugzilla.redhat.com/show_bug.cgi?id=1164339#c15>.

The DNS test framework in support/ is enhanced with support for
setting the AD bit in responses.

Tested on x86_64-linux-gnu.

Change-Id: Ibfe0f7c73ea221c35979842c5c3b6ed486495ccc
NEWS
resolv/Makefile
resolv/res_debug.c
resolv/res_init.c
resolv/res_mkquery.c
resolv/res_send.c
resolv/resolv.h
resolv/tst-resolv-res_init-skeleton.c
resolv/tst-resolv-trustad.c [new file with mode: 0644]
support/resolv_test.c
support/resolv_test.h