diff options
| author | Florian Weimer <fweimer@redhat.com> | 2019-04-08 11:19:38 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2019-04-08 11:19:38 +0200 |
| commit | 333221862ecbebde60dd16e7ca17d26444e62f50 (patch) | |
| tree | da1639481030c9cc8a8a478dad7308869cb783bc /resolv/res_send.c | |
| parent | 3f8b44be0a658266adff5ece1e4bc3ce097a5dbe (diff) | |
| download | glibc-333221862ecbebde60dd16e7ca17d26444e62f50.tar glibc-333221862ecbebde60dd16e7ca17d26444e62f50.tar.gz glibc-333221862ecbebde60dd16e7ca17d26444e62f50.tar.bz2 glibc-333221862ecbebde60dd16e7ca17d26444e62f50.zip | |
resolv: Remove RES_INSECURE1, RES_INSECURE2
Always perform the associated security checks.
Diffstat (limited to 'resolv/res_send.c')
| -rw-r--r-- | resolv/res_send.c | 32 |
1 files changed, 13 insertions, 19 deletions
diff --git a/resolv/res_send.c b/resolv/res_send.c index ca441c4ce1..eeeb8acf27 100644 --- a/resolv/res_send.c +++ b/resolv/res_send.c @@ -1316,31 +1316,25 @@ send_dg(res_state statp, */ goto wait; } - if (!(statp->options & RES_INSECURE1) && - !res_ourserver_p(statp, &from)) { - /* - * response from wrong server? ignore it. - * XXX - potential security hazard could - * be detected here. - */ - goto wait; - } - if (!(statp->options & RES_INSECURE2) - && (recvresp1 || !res_queriesmatch(buf, buf + buflen, + + /* Paranoia check. Due to the connected UDP socket, + the kernel has already filtered invalid addresses + for us. */ + if (!res_ourserver_p(statp, &from)) + goto wait; + + /* Check for the correct header layout and a matching + question. */ + if ((recvresp1 || !res_queriesmatch(buf, buf + buflen, *thisansp, *thisansp + *thisanssizp)) && (recvresp2 || !res_queriesmatch(buf2, buf2 + buflen2, *thisansp, *thisansp - + *thisanssizp))) { - /* - * response contains wrong query? ignore it. - * XXX - potential security hazard could - * be detected here. - */ - goto wait; - } + + *thisanssizp))) + goto wait; + if (anhp->rcode == SERVFAIL || anhp->rcode == NOTIMP || anhp->rcode == REFUSED) { |