Attachment #1665 for bug #1625

View | Details | Raw Unified | Return to bug 1625
Collapse All | Expand All




{
	u_int counter;
	int result;
	unsigned int rrset_flags = 0;
	struct rrsetinfo *fingerprints = NULL;

	u_int8_t hostkey_algorithm;

		return -1;
	}

	/*
	 * Original getrrsetbyname function, found on OpenBSD for example,
	 * doesn't accept any flag and prerequisite for obtaining AD bit in
	 * DNS response is set by "options edns0" in resolv.conf.
	 *
	 * Our version is more clever and use RRSET_FORCE_EDNS0 flag.
	 */
#ifndef HAVE_GETRRSETBYNAME
	rrset_flags |= RRSET_FORCE_EDNS0;
#endif
	result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
	    DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints);

	if (result) {
		verbose("DNS lookup error: %s", dns_result_totext(result));
		return -1;




		goto fail;
	}

	/* Allow RRSET_FORCE_EDNS0 flag only. */
	if ((flags & !RRSET_FORCE_EDNS0) != 0) {
		result = ERRSET_INVAL;
		goto fail;
	}

#endif /* DEBUG */

#ifdef RES_USE_DNSSEC
	/* turn on DNSSEC if required  */
	if (flags & RRSET_FORCE_EDNS0)
		_resp->options |= (RES_USE_EDNS0|RES_USE_DNSSEC);
#endif /* RES_USE_DNSEC */

	/* make query */

Lines 72-77 Link Here

(-)openssh-5.2p1/openbsd-compat/getrrsetbyname.h.rh205842 (+3 lines)
72	#ifndef RRSET_VALIDATED	72	#ifndef RRSET_VALIDATED
73	# define RRSET_VALIDATED 1	73	# define RRSET_VALIDATED 1
74	#endif	74	#endif
		75	#ifndef RRSET_FORCE_EDNS0
		76	# define RRSET_FORCE_EDNS0 0x0001
		77	#endif
75		78
76	/*	79	/*
77	* Return codes for getrrsetbyname()	80	* Return codes for getrrsetbyname()

Return to bug 1625

Lines 176-181 verify_host_key_dns(const char *hostname Link Here

(-)openssh-5.2p1/dns.c.rh205842 (-1 / +13 lines)
176	{	176	{
177	u_int counter;	177	u_int counter;
178	int result;	178	int result;
		179	unsigned int rrset_flags = 0;
179	struct rrsetinfo *fingerprints = NULL;	180	struct rrsetinfo *fingerprints = NULL;
180		181
181	u_int8_t hostkey_algorithm;	182	u_int8_t hostkey_algorithm;
Lines 199-206 verify_host_key_dns(const char *hostname Link Here
199	return -1;	200	return -1;
200	}	201	}
201		202
		203	/*
		204	* Original getrrsetbyname function, found on OpenBSD for example,
		205	* doesn't accept any flag and prerequisite for obtaining AD bit in
		206	* DNS response is set by "options edns0" in resolv.conf.
		207	*
		208	* Our version is more clever and use RRSET_FORCE_EDNS0 flag.
		209	*/
		210	#ifndef HAVE_GETRRSETBYNAME
		211	rrset_flags \|= RRSET_FORCE_EDNS0;
		212	#endif
202	result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,	213	result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
203	DNS_RDATATYPE_SSHFP, 0, &fingerprints);	214	DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints);
		215
204	if (result) {	216	if (result) {
205	verbose("DNS lookup error: %s", dns_result_totext(result));	217	verbose("DNS lookup error: %s", dns_result_totext(result));
206	return -1;	218	return -1;

Lines 209-216 getrrsetbyname(const char *hostname, uns Link Here

(-)openssh-5.2p1/openbsd-compat/getrrsetbyname.c.rh205842 (-5 / +5 lines)
209	goto fail;	209	goto fail;
210	}	210	}
211		211
212	/* don't allow flags yet, unimplemented */	212	/* Allow RRSET_FORCE_EDNS0 flag only. */
213	if (flags) {	213	if ((flags & !RRSET_FORCE_EDNS0) != 0) {
214	result = ERRSET_INVAL;	214	result = ERRSET_INVAL;
215	goto fail;	215	goto fail;
216	}	216	}
Lines 226-234 getrrsetbyname(const char *hostname, uns Link Here
226	#endif /* DEBUG */	226	#endif /* DEBUG */
227		227
228	#ifdef RES_USE_DNSSEC	228	#ifdef RES_USE_DNSSEC
229	/* turn on DNSSEC if EDNS0 is configured */	229	/* turn on DNSSEC if required */
230	if (_resp->options & RES_USE_EDNS0)	230	if (flags & RRSET_FORCE_EDNS0)
231	_resp->options \|= RES_USE_DNSSEC;	231	_resp->options \|= (RES_USE_EDNS0\|RES_USE_DNSSEC);
232	#endif /* RES_USE_DNSEC */	232	#endif /* RES_USE_DNSEC */
233		233
234	/* make query */	234	/* make query */