resolved: set the AA bit for synthetic answers

The stub DNS server is authoritative for the RRs we synthesize, such as
localhost, _gateway, and entries from /etc/hosts, and also for trust anchors.

Partially fixes https://github.com/systemd/systemd/issues/17972

diff --git a/src/resolve/resolved-dns-query.c b/src/resolve/resolved-dns-query.c
index 1413afe3b9b84f644f5b4b404a08ad0d61b54e87..7fb2e110e07130dd927b80936a658a9322283b8d 100644 (file)
--- a/src/resolve/resolved-dns-query.c
+++ b/src/resolve/resolved-dns-query.c
@@ -1140,3 +1140,10 @@ bool dns_query_fully_confidential(DnsQuery *q) {
 
         return FLAGS_SET(q->answer_query_flags, SD_RESOLVED_CONFIDENTIAL) && !q->previous_redirect_non_confidential;
 }
+
+bool dns_query_fully_synthetic(DnsQuery *q) {
+        assert(q);
+
+        return (q->answer_query_flags & (SD_RESOLVED_SYNTHETIC | SD_RESOLVED_FROM_TRUST_ANCHOR)) &&
+                !(q->answer_query_flags & SD_RESOLVED_FROM_MASK & ~SD_RESOLVED_FROM_TRUST_ANCHOR);
+}

diff --git a/src/resolve/resolved-dns-query.h b/src/resolve/resolved-dns-query.h
index 4874aa0c1773f8b2136edf502cecb5e7198f3461..ea296167b61e7a267d0aa3e7cc3a877e7c52d69e 100644 (file)
--- a/src/resolve/resolved-dns-query.h
+++ b/src/resolve/resolved-dns-query.h
@@ -134,6 +134,7 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(DnsQuery*, dns_query_free);
 
 bool dns_query_fully_authenticated(DnsQuery *q);
 bool dns_query_fully_confidential(DnsQuery *q);
+bool dns_query_fully_synthetic(DnsQuery *q);
 
 static inline uint64_t dns_query_reply_flags_make(DnsQuery *q) {
         assert(q);

diff --git a/src/resolve/resolved-dns-stub.c b/src/resolve/resolved-dns-stub.c
index a40eeea6553bbf153ab69cacbde9acc0d5a2b2eb..02ac29dbb9d707a05dbaa58e4fca9fc042e877c0 100644 (file)
--- a/src/resolve/resolved-dns-stub.c
+++ b/src/resolve/resolved-dns-stub.c
@@ -428,6 +428,7 @@ static int dns_stub_finish_reply_packet(
                 uint16_t id,
                 int rcode,
                 bool tc,        /* set the Truncated bit? */
+                bool aa,        /* set the Authoritative Answer bit? */
                 bool add_opt,   /* add an OPT RR to this packet? */
                 bool edns0_do,  /* set the EDNS0 DNSSEC OK bit? */
                 bool ad,        /* set the DNSSEC authenticated data bit? */
@@ -466,7 +467,7 @@ static int dns_stub_finish_reply_packet(
         DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(
                                                               1  /* qr */,
                                                               0  /* opcode */,
-                                                              0  /* aa */,
+                                                              aa /* aa */,
                                                               tc /* tc */,
                                                               1  /* rd */,
                                                               1  /* ra */,
@@ -556,6 +557,7 @@ static int dns_stub_send_reply(
                         DNS_PACKET_ID(q->request_packet),
                         rcode,
                         truncated,
+                        dns_query_fully_synthetic(q),
                         !!q->request_packet->opt,
                         edns0_do,
                         DNS_PACKET_AD(q->request_packet) && dns_query_fully_authenticated(q),
@@ -596,6 +598,7 @@ static int dns_stub_send_failure(
                         DNS_PACKET_ID(p),
                         rcode,
                         truncated,
+                        false,
                         !!p->opt,
                         DNS_PACKET_DO(p),
                         DNS_PACKET_AD(p) && authenticated,