summaryrefslogtreecommitdiff
path: root/src/resolve/resolved-dns-server.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2020-11-12 20:47:35 +0100
committerLennart Poettering <lennart@poettering.net>2021-02-17 09:42:07 +0100
commit4a6eb82445e6b8a1ce1e6c28d4a99eb3747dff2c (patch)
tree366a80f9b06ea82f63c7574c15d0608c942e33f4 /src/resolve/resolved-dns-server.c
parent9628ba7c6b54bd3d743051d7e3e86f2d29ea7651 (diff)
downloadsystemd-4a6eb82445e6b8a1ce1e6c28d4a99eb3747dff2c.tar.gz
resolved: include NSID support to DNS stub
This adds minimal support for RFC5001 NSID to the stub resolver. This useful to identify systemd-resolved when talking to the stub resolver, and distuingishing the packets resolved answers itself (where NSID is now set) from those which it proxies 1:1 upstream (where NSID will not be set, or set to whatever the upstream server has it set to). The NSID chosen consist of two parts: 1. The first part is derived from /etc/machine-id and identifies the resolved instance in a stable way. 2. The second part is the fixed string ".resolved.systemd.io". This thus maybe used for a veriety of checks: a. Am I talking to a resolved stub? b. Am I talking to the same stub as last time? c. Am I talking to the local resolved? Given that the first part leaks the identity of the system in away two protections are in place: I) The NSID is only included on the main stub, not the extra stub. The main stub has with a TTL of 1 and other protections a lot of safety in place that the datagrams never leave the local system, thus the identifying info is only accessible to the local system — but /etc/machine-id is accessible to local software anyway. II) The NSID is hashed from /etc/machine-id in a non-invertable way, so that the machine ID itself isn't leaked, but only an identifier derived from it. Example dig run: ``` $ dig +nsid localhost @127.0.0.53 ; <<>> DiG 9.11.23-RedHat-9.11.23-1.fc33 <<>> +nsid localhost @127.0.0.53 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46917 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ; NSID: 35 33 64 34 61 34 66 63 32 31 32 65 34 31 61 30 39 66 30 39 65 33 32 34 63 64 64 38 30 36 32 33 2e 72 65 73 6f 6c 76 65 64 2e 73 79 73 74 65 6d 64 2e 69 6f ("53d4a4fc212e41a09f09e324cdd80623.resolved.systemd.io") ;; QUESTION SECTION: ;localhost. IN A ;; ANSWER SECTION: localhost. 0 IN A 127.0.0.1 ;; Query time: 0 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Do Nov 12 20:57:16 CET 2020 ;; MSG SIZE rcvd: 110 ```
Diffstat (limited to 'src/resolve/resolved-dns-server.c')
-rw-r--r--src/resolve/resolved-dns-server.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/resolve/resolved-dns-server.c b/src/resolve/resolved-dns-server.c
index a561035faa..da509a2c96 100644
--- a/src/resolve/resolved-dns-server.c
+++ b/src/resolve/resolved-dns-server.c
@@ -587,7 +587,7 @@ int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeature
else
packet_size = server->received_udp_packet_max;
- return dns_packet_append_opt(packet, packet_size, edns_do, /* include_rfc6975 = */ true, 0, NULL);
+ return dns_packet_append_opt(packet, packet_size, edns_do, /* include_rfc6975 = */ true, NULL, 0, NULL);
}
int dns_server_ifindex(const DnsServer *s) {