path: root/src/network/lookup_name.c
diff options
authorRich Felker <>2020-05-18 21:17:34 -0400
committerRich Felker <>2020-05-18 21:30:33 -0400
commitfd7ec068efd590c0393a612599a4fab9bb0a8633 (patch)
treef7e4b3bf7e023ddfe8e464b5a71e0cb858bf4beb /src/network/lookup_name.c
parent593caa456309714402ca4cb77c3770f4c24da9da (diff)
set AD bit in dns queries, suppress for internal use
the AD (authenticated data) bit in outgoing dns queries is defined by rfc3655 to request that the nameserver report (via the same bit in the response) whether the result is authenticated by DNSSEC. while all results returned by a DNSSEC conforming nameserver will be either authenticated or cryptographically proven to lack DNSSEC protection, for some applications it's necessary to be able to distinguish these two cases. in particular, conforming and compatible handling of DANE (TLSA) records requires enforcing them only in signed zones. when the AD bit was first defined for queries, there were reports of compatibility problems with broken firewalls and nameservers dropping queries with it set. these problems are probably a thing of the past, and broken nameservers are already unsupported. however, since there is no use in the AD bit with the netdb.h interfaces, explicitly clear it in the queries they make. this ensures that, even with broken setups, the standard functions will work, and at most the res_* functions break.
Diffstat (limited to 'src/network/lookup_name.c')
1 files changed, 1 insertions, 0 deletions
diff --git a/src/network/lookup_name.c b/src/network/lookup_name.c
index c93263a9..c4d994a1 100644
--- a/src/network/lookup_name.c
+++ b/src/network/lookup_name.c
@@ -149,6 +149,7 @@ static int name_from_dns(struct address buf[static MAXADDRS], char canon[static
0, 0, 0, qbuf[nq], sizeof *qbuf);
if (qlens[nq] == -1)
return EAI_NONAME;
+ qbuf[nq][3] = 0; /* don't need AD flag */