resolved: allow the full TTL to be used by OPT records

Whereas RFC 1035 says the TTL field takes the "positive values of a
signed 32 bit number", and RFC 2181 says "Implementations should treat
TTL values received with the most significant bit set as if the entire
value received was zero,", the dns_packet_read_rr() function sets
rr->ttl to zero if the MSB is set.

However, EDNS(0) as specified in RFC 6891 repurposes the TTL field's 4
octets to store other information, c.f.:

                  +0 (MSB)                            +1 (LSB)
       +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
    0: |         EXTENDED-RCODE        |            VERSION            |
       +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
    2: | DO|                           Z                               |
       +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

The first octet extends the usual 4-bit RCODE from the packet header by
providing an additional 8 bits of space, extending the RCODE to 12 bits.
But, our handling of the TTL field means that the high bit in the first
octet is not actually usable, since setting it will mean these 4 octets
are replaced with 0. This may have the effect of making us believe a
server does not support DNSSEC when it actually set the DO bit in its
OPT record.

Here we change things so that the TTL is only set to zero for record
types other than OPT.

diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index 67a83269e2aa40e73ad0fbe8c8dd27d1c86c4673..c32a1a9a6712df107123f1340940dafa9aa70d49 100644 (file)
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -1804,9 +1804,9 @@ int dns_packet_read_rr(
         if (r < 0)
                 return r;
 
-        /* RFC 2181, Section 8, suggests to
-         * treat a TTL with the MSB set as a zero TTL. */
-        if (rr->ttl & UINT32_C(0x80000000))
+        /* RFC 2181, Section 8, suggests to treat a TTL with the MSB set as a zero TTL. We avoid doing this
+         * for OPT records so that all 8 bits of the extended RCODE may be used .*/
+        if (key->type != DNS_TYPE_OPT && rr->ttl & UINT32_C(0x80000000))
                 rr->ttl = 0;
 
         r = dns_packet_read_uint16(p, &rdlength, NULL);