217d136f41
April 2016 nss_dns hardening
149 lines
4.5 KiB
Diff
149 lines
4.5 KiB
Diff
commit b9b026c9c00db1a1b5b4a3caa28162655a04a882
|
|
Author: Florian Weimer <fweimer@redhat.com>
|
|
Date: Wed Apr 27 16:12:32 2016 +0200
|
|
|
|
resolv, nss_dns: Remove remaining syslog logging [BZ #19862]
|
|
|
|
The fix for bug 14841 only removed part of the logging.
|
|
|
|
Index: b/resolv/gethnamaddr.c
|
|
===================================================================
|
|
--- a/resolv/gethnamaddr.c
|
|
+++ b/resolv/gethnamaddr.c
|
|
@@ -70,7 +70,6 @@ static char sccsid[] = "@(#)gethostnamad
|
|
#include <resolv.h>
|
|
#include <ctype.h>
|
|
#include <errno.h>
|
|
-#include <syslog.h>
|
|
|
|
#define RESOLVSORT
|
|
|
|
@@ -100,9 +99,6 @@ static char sccsid[] = "@(#)gethostnamad
|
|
#define MAXALIASES 35
|
|
#define MAXADDRS 35
|
|
|
|
-static const char AskedForGot[] =
|
|
- "gethostby*.getanswer: asked for \"%s\", got \"%s\"";
|
|
-
|
|
static char *h_addr_ptrs[MAXADDRS + 1];
|
|
|
|
static struct hostent host;
|
|
@@ -337,20 +333,12 @@ getanswer (const querybuf *answer, int a
|
|
* uses many different types in responses that do not
|
|
* match QTYPE.
|
|
*/
|
|
- if ((_res.options & RES_USE_DNSSEC) == 0) {
|
|
- syslog(LOG_NOTICE|LOG_AUTH,
|
|
- "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
|
|
- qname, p_class(C_IN), p_type(qtype),
|
|
- p_type(type));
|
|
- }
|
|
cp += n;
|
|
continue; /* XXX - had_error++ ? */
|
|
}
|
|
switch (type) {
|
|
case T_PTR:
|
|
if (strcasecmp(tname, bp) != 0) {
|
|
- syslog(LOG_NOTICE|LOG_AUTH,
|
|
- AskedForGot, qname, bp);
|
|
cp += n;
|
|
continue; /* XXX - had_error++ ? */
|
|
}
|
|
@@ -399,8 +387,6 @@ getanswer (const querybuf *answer, int a
|
|
case T_A:
|
|
case T_AAAA:
|
|
if (strcasecmp(host.h_name, bp) != 0) {
|
|
- syslog(LOG_NOTICE|LOG_AUTH,
|
|
- AskedForGot, host.h_name, bp);
|
|
cp += n;
|
|
continue; /* XXX - had_error++ ? */
|
|
}
|
|
@@ -748,9 +734,6 @@ gethostbyaddr(addr, len, af)
|
|
_res.options &= ~RES_DNSRCH;
|
|
_res.options |= RES_DEFNAMES;
|
|
if (!(rhp = gethostbyname(hname2))) {
|
|
- syslog(LOG_NOTICE|LOG_AUTH,
|
|
- "gethostbyaddr: No A record for %s (verifying [%s])",
|
|
- hname2, inet_ntoa(*((struct in_addr *)addr)));
|
|
_res.options = old_options;
|
|
__set_h_errno (HOST_NOT_FOUND);
|
|
return (NULL);
|
|
@@ -760,9 +743,6 @@ gethostbyaddr(addr, len, af)
|
|
if (!memcmp(*haddr, addr, INADDRSZ))
|
|
break;
|
|
if (!*haddr) {
|
|
- syslog(LOG_NOTICE|LOG_AUTH,
|
|
- "gethostbyaddr: A record of %s != PTR record [%s]",
|
|
- hname2, inet_ntoa(*((struct in_addr *)addr)));
|
|
__set_h_errno (HOST_NOT_FOUND);
|
|
return (NULL);
|
|
}
|
|
Index: b/resolv/nss_dns/dns-host.c
|
|
===================================================================
|
|
--- a/resolv/nss_dns/dns-host.c
|
|
+++ b/resolv/nss_dns/dns-host.c
|
|
@@ -78,7 +78,6 @@
|
|
#include <stdlib.h>
|
|
#include <stddef.h>
|
|
#include <string.h>
|
|
-#include <sys/syslog.h>
|
|
|
|
#include "nsswitch.h"
|
|
|
|
@@ -99,10 +98,6 @@
|
|
#endif
|
|
#define MAXHOSTNAMELEN 256
|
|
|
|
-static const char AskedForGot[] = "\
|
|
-gethostby*.getanswer: asked for \"%s\", got \"%s\"";
|
|
-
|
|
-
|
|
/* We need this time later. */
|
|
typedef union querybuf
|
|
{
|
|
@@ -838,14 +833,6 @@ getanswer_r (const querybuf *answer, int
|
|
have_to_map = 1;
|
|
else if (__glibc_unlikely (type != qtype))
|
|
{
|
|
- /* Log a low priority message if we get an unexpected record, but
|
|
- skip it if we are using DNSSEC since it uses many different types
|
|
- in responses that do not match QTYPE. */
|
|
- if ((_res.options & RES_USE_DNSSEC) == 0)
|
|
- syslog (LOG_NOTICE | LOG_AUTH,
|
|
- "gethostby*.getanswer: asked for \"%s %s %s\", "
|
|
- "got type \"%s\"",
|
|
- qname, p_class (C_IN), p_type (qtype), p_type (type));
|
|
cp += n;
|
|
continue; /* XXX - had_error++ ? */
|
|
}
|
|
@@ -855,7 +842,6 @@ getanswer_r (const querybuf *answer, int
|
|
case T_PTR:
|
|
if (__glibc_unlikely (strcasecmp (tname, bp) != 0))
|
|
{
|
|
- syslog (LOG_NOTICE | LOG_AUTH, AskedForGot, qname, bp);
|
|
cp += n;
|
|
continue; /* XXX - had_error++ ? */
|
|
}
|
|
@@ -899,7 +885,6 @@ getanswer_r (const querybuf *answer, int
|
|
case T_AAAA:
|
|
if (__builtin_expect (strcasecmp (result->h_name, bp), 0) != 0)
|
|
{
|
|
- syslog (LOG_NOTICE | LOG_AUTH, AskedForGot, result->h_name, bp);
|
|
cp += n;
|
|
continue; /* XXX - had_error++ ? */
|
|
}
|
|
@@ -1152,13 +1137,6 @@ gaih_getanswer_slice (const querybuf *an
|
|
|| __builtin_expect (type == T_DNAME, 0))
|
|
#endif
|
|
{
|
|
- /* We don't support DNSSEC yet. For now, ignore the record
|
|
- and send a low priority message to syslog.
|
|
-
|
|
- We also don't expect T_PTR or T_DNAME messages. */
|
|
- syslog (LOG_DEBUG | LOG_AUTH,
|
|
- "getaddrinfo*.gaih_getanswer: got type \"%s\"",
|
|
- p_type (type));
|
|
cp += n;
|
|
continue;
|
|
}
|