[Fix] Make dnssec configurable option disabled by default for now

diff --git a/contrib/librdns/dns_private.h b/contrib/librdns/dns_private.h
index 4e3f7c9a869f885873e684ea861eb2577434379e..a198dc46d10d411e903f3c63cd85af7ac9e3190a 100644 (file)
--- a/contrib/librdns/dns_private.h
+++ b/contrib/librdns/dns_private.h
@@ -125,6 +125,7 @@ struct rdns_resolver {
 
        bool async_binded;
        bool initialized;
+       bool enable_dnssec;
        ref_entry_t ref;
 };
 

diff --git a/contrib/librdns/packet.c b/contrib/librdns/packet.c
index 25f3d897936ed0eaeb2c515320d1ada60882a6ab..e3020d7e86cb468e60b72ece9f7652fb63e3f650 100644 (file)
--- a/contrib/librdns/packet.c
+++ b/contrib/librdns/packet.c
@@ -268,7 +268,12 @@ rdns_add_edns0 (struct rdns_request *req)
        *p16++ = 0;
        /* Z 10000000 00000000 to allow dnssec */
        p8 = (uint8_t *)p16;
-       *p8++ = 0x80;
+       if (req->resolver->enable_dnssec) {
+               *p8++ = 0x80;
+       }
+       else {
+               *p8++ = 0x00;
+       }
        *p8++ = 0;
        p16 = (uint16_t *)p8;
        /* Length */

diff --git a/contrib/librdns/rdns.h b/contrib/librdns/rdns.h
index d7615667eb82813b1551e354571ee5b6eea1dca4..82506d36ad65cbb9c5e26b4399dd75debf0ed8f5 100644 (file)
--- a/contrib/librdns/rdns.h
+++ b/contrib/librdns/rdns.h
@@ -236,6 +236,12 @@ struct rdns_resolver *rdns_resolver_new (void);
 void rdns_resolver_async_bind (struct rdns_resolver *resolver,
                struct rdns_async_context *ctx);
 
+/**
+ * Enable stub dnssec resolver
+ * @param resolver
+ */
+void rdns_resolver_set_dnssec (struct rdns_resolver *resolver, bool enabled);
+
 /**
  * Add new DNS server definition to the resolver
  * @param resolver resolver object

diff --git a/contrib/librdns/resolver.c b/contrib/librdns/resolver.c
index 20700ee3b013517c76596cbd958147460d1af280..70e226804984adaa4f4f8da07e4a29ee8200ae3d 100644 (file)
--- a/contrib/librdns/resolver.c
+++ b/contrib/librdns/resolver.c
@@ -853,3 +853,11 @@ rdns_resolver_async_bind (struct rdns_resolver *resolver,
                resolver->async_binded = true;
        }
 }
+
+void
+rdns_resolver_set_dnssec (struct rdns_resolver *resolver, bool enabled)
+{
+       if (resolver) {
+               resolver->enable_dnssec = enabled;
+       }
+}

diff --git a/src/libserver/cfg_file.h b/src/libserver/cfg_file.h
index 2eb4185066720e785690cc460bc7c253dde2ad6e..f66361a417318aa63e815df3a5f353311489a4ed 100644 (file)
--- a/src/libserver/cfg_file.h
+++ b/src/libserver/cfg_file.h
@@ -383,6 +383,7 @@ struct rspamd_config {
        guint32 dns_io_per_server;                      /**< number of sockets per DNS server                                   */
        const ucl_object_t *nameservers;                /**< list of nameservers or NULL to parse resolv.conf   */
        guint32 dns_max_requests;                       /**< limit of DNS requests per task                                     */
+       gboolean enable_dnssec;                         /**< enable dnssec stub resolver                                                */
 
        guint upstream_max_errors;                                              /**< upstream max errors before shutting off                    */
        gdouble upstream_error_time;                                    /**< rate of upstream errors                                                    */

diff --git a/src/libserver/cfg_rcl.c b/src/libserver/cfg_rcl.c
index 94c5862d74b3a4833a67381793285bd7e94fce9a..3d1c6ecad5150e48f470a2a95756121890dbea47 100644 (file)
--- a/src/libserver/cfg_rcl.c
+++ b/src/libserver/cfg_rcl.c
@@ -2015,6 +2015,12 @@ rspamd_rcl_config_init (struct rspamd_config *cfg)
                        G_STRUCT_OFFSET (struct rspamd_config, dns_io_per_server),
                        RSPAMD_CL_FLAG_INT_32,
                        "Number of sockets per DNS server");
+       rspamd_rcl_add_default_handler (ssub,
+                       "enable_dnssec",
+                       rspamd_rcl_parse_struct_boolean,
+                       G_STRUCT_OFFSET (struct rspamd_config, enable_dnssec),
+                       0,
+                       "Enable DNSSEC support in Rspamd");
 
 
        /* New upstreams configuration */

diff --git a/src/libserver/dns.c b/src/libserver/dns.c
index eb0e4e9a292dc2c7364ea2f3d5e7342c30249afb..c0fdceebd9ef0510c4fe2cec0c5fa568682a31b2 100644 (file)
--- a/src/libserver/dns.c
+++ b/src/libserver/dns.c
@@ -244,6 +244,7 @@ dns_resolver_init (rspamd_logger_t *logger,
        if (cfg != NULL) {
                rdns_resolver_set_log_level (dns_resolver->r, cfg->log_level);
                dns_resolver->cfg = cfg;
+               rdns_resolver_set_dnssec (dns_resolver->r, cfg->enable_dnssec);
        }
 
        rdns_resolver_set_logger (dns_resolver->r, rspamd_rnds_log_bridge, logger);