diff options
| author | Ronan Pigott <ronan@rjp.ie> | 2024-03-08 21:40:08 +0100 |
|---|---|---|
| committer | Yu Watanabe <watanabe.yu+github@gmail.com> | 2024-06-12 11:50:45 +0200 |
| commit | 364c948707afa097f6ad177b61c2b51a86c0089a (patch) | |
| tree | 4034fcd5228d3d89cce5da47a13d8124d3e8ef90 /src/resolve/resolved-dns-server.c | |
| parent | Merge pull request #33074 from keszybz/bpf-fd-handling (diff) | |
| download | systemd-364c948707afa097f6ad177b61c2b51a86c0089a.tar.xz systemd-364c948707afa097f6ad177b61c2b51a86c0089a.zip | |
resolved: permit dnssec rrtype questions when we aren't validating
This check introduced in 91adc4db33f6 is intended to spare us from
encountering broken resolver behavior we don't want to deal with.
However if we aren't validating we more than likely don't know the state
of the upstream resolver's support for dnssec. Let's let clients try
these queries if they want.
This brings the behavior of sd-resolved in-line with previouly stated
change in the meaning of DNSSEC=no, which now means "don't validate"
rather than "don't validate, because the upstream resolver is declared to
be dnssec-unaware".
Fixes: 9c47b334445a ("resolved: enable DNS proxy mode if client wants DNSSEC")
Diffstat (limited to '')
| -rw-r--r-- | src/resolve/resolved-dns-server.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/src/resolve/resolved-dns-server.c b/src/resolve/resolved-dns-server.c index 340f11f4f4..b37f541c7f 100644 --- a/src/resolve/resolved-dns-server.c +++ b/src/resolve/resolved-dns-server.c @@ -706,9 +706,6 @@ bool dns_server_dnssec_supported(DnsServer *server) { if (dns_server_get_dnssec_mode(server) == DNSSEC_YES) /* If strict DNSSEC mode is enabled, always assume DNSSEC mode is supported. */ return true; - if (!DNS_SERVER_FEATURE_LEVEL_IS_DNSSEC(server->possible_feature_level)) - return false; - if (server->packet_bad_opt) return false; |