glibc/glibc-rh1332914-3.patch
Florian Weimer 217d136f41 Resolves: #1332914
April 2016 nss_dns hardening
2016-05-06 17:02:34 +02:00

149 lines
4.5 KiB
Diff

commit b9b026c9c00db1a1b5b4a3caa28162655a04a882
Author: Florian Weimer <fweimer@redhat.com>
Date: Wed Apr 27 16:12:32 2016 +0200
resolv, nss_dns: Remove remaining syslog logging [BZ #19862]
The fix for bug 14841 only removed part of the logging.
Index: b/resolv/gethnamaddr.c
===================================================================
--- a/resolv/gethnamaddr.c
+++ b/resolv/gethnamaddr.c
@@ -70,7 +70,6 @@ static char sccsid[] = "@(#)gethostnamad
#include <resolv.h>
#include <ctype.h>
#include <errno.h>
-#include <syslog.h>
#define RESOLVSORT
@@ -100,9 +99,6 @@ static char sccsid[] = "@(#)gethostnamad
#define MAXALIASES 35
#define MAXADDRS 35
-static const char AskedForGot[] =
- "gethostby*.getanswer: asked for \"%s\", got \"%s\"";
-
static char *h_addr_ptrs[MAXADDRS + 1];
static struct hostent host;
@@ -337,20 +333,12 @@ getanswer (const querybuf *answer, int a
* uses many different types in responses that do not
* match QTYPE.
*/
- if ((_res.options & RES_USE_DNSSEC) == 0) {
- syslog(LOG_NOTICE|LOG_AUTH,
- "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
- qname, p_class(C_IN), p_type(qtype),
- p_type(type));
- }
cp += n;
continue; /* XXX - had_error++ ? */
}
switch (type) {
case T_PTR:
if (strcasecmp(tname, bp) != 0) {
- syslog(LOG_NOTICE|LOG_AUTH,
- AskedForGot, qname, bp);
cp += n;
continue; /* XXX - had_error++ ? */
}
@@ -399,8 +387,6 @@ getanswer (const querybuf *answer, int a
case T_A:
case T_AAAA:
if (strcasecmp(host.h_name, bp) != 0) {
- syslog(LOG_NOTICE|LOG_AUTH,
- AskedForGot, host.h_name, bp);
cp += n;
continue; /* XXX - had_error++ ? */
}
@@ -748,9 +734,6 @@ gethostbyaddr(addr, len, af)
_res.options &= ~RES_DNSRCH;
_res.options |= RES_DEFNAMES;
if (!(rhp = gethostbyname(hname2))) {
- syslog(LOG_NOTICE|LOG_AUTH,
- "gethostbyaddr: No A record for %s (verifying [%s])",
- hname2, inet_ntoa(*((struct in_addr *)addr)));
_res.options = old_options;
__set_h_errno (HOST_NOT_FOUND);
return (NULL);
@@ -760,9 +743,6 @@ gethostbyaddr(addr, len, af)
if (!memcmp(*haddr, addr, INADDRSZ))
break;
if (!*haddr) {
- syslog(LOG_NOTICE|LOG_AUTH,
- "gethostbyaddr: A record of %s != PTR record [%s]",
- hname2, inet_ntoa(*((struct in_addr *)addr)));
__set_h_errno (HOST_NOT_FOUND);
return (NULL);
}
Index: b/resolv/nss_dns/dns-host.c
===================================================================
--- a/resolv/nss_dns/dns-host.c
+++ b/resolv/nss_dns/dns-host.c
@@ -78,7 +78,6 @@
#include <stdlib.h>
#include <stddef.h>
#include <string.h>
-#include <sys/syslog.h>
#include "nsswitch.h"
@@ -99,10 +98,6 @@
#endif
#define MAXHOSTNAMELEN 256
-static const char AskedForGot[] = "\
-gethostby*.getanswer: asked for \"%s\", got \"%s\"";
-
-
/* We need this time later. */
typedef union querybuf
{
@@ -838,14 +833,6 @@ getanswer_r (const querybuf *answer, int
have_to_map = 1;
else if (__glibc_unlikely (type != qtype))
{
- /* Log a low priority message if we get an unexpected record, but
- skip it if we are using DNSSEC since it uses many different types
- in responses that do not match QTYPE. */
- if ((_res.options & RES_USE_DNSSEC) == 0)
- syslog (LOG_NOTICE | LOG_AUTH,
- "gethostby*.getanswer: asked for \"%s %s %s\", "
- "got type \"%s\"",
- qname, p_class (C_IN), p_type (qtype), p_type (type));
cp += n;
continue; /* XXX - had_error++ ? */
}
@@ -855,7 +842,6 @@ getanswer_r (const querybuf *answer, int
case T_PTR:
if (__glibc_unlikely (strcasecmp (tname, bp) != 0))
{
- syslog (LOG_NOTICE | LOG_AUTH, AskedForGot, qname, bp);
cp += n;
continue; /* XXX - had_error++ ? */
}
@@ -899,7 +885,6 @@ getanswer_r (const querybuf *answer, int
case T_AAAA:
if (__builtin_expect (strcasecmp (result->h_name, bp), 0) != 0)
{
- syslog (LOG_NOTICE | LOG_AUTH, AskedForGot, result->h_name, bp);
cp += n;
continue; /* XXX - had_error++ ? */
}
@@ -1152,13 +1137,6 @@ gaih_getanswer_slice (const querybuf *an
|| __builtin_expect (type == T_DNAME, 0))
#endif
{
- /* We don't support DNSSEC yet. For now, ignore the record
- and send a low priority message to syslog.
-
- We also don't expect T_PTR or T_DNAME messages. */
- syslog (LOG_DEBUG | LOG_AUTH,
- "getaddrinfo*.gaih_getanswer: got type \"%s\"",
- p_type (type));
cp += n;
continue;
}