From 734076a52c94c290826224e524f49be07d4476e1 Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Thu, 20 Nov 2014 20:17:32 +0000 Subject: [PATCH] When following a CNAME chain, if any lookup is insecure the whole must be too --- src/src/dns.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/src/src/dns.c b/src/src/dns.c index ac52e5621..542354db3 100644 --- a/src/src/dns.c +++ b/src/src/dns.c @@ -455,6 +455,14 @@ return h->ad ? TRUE : FALSE; #endif } +static void +dns_set_insecure(dns_answer * dnsa) +{ +HEADER * h = (HEADER *)dnsa->answer; +h->ad = 0; +} + + @@ -752,7 +760,8 @@ int dns_lookup(dns_answer *dnsa, uschar *name, int type, uschar **fully_qualified_name) { int i; -uschar *orig_name = name; +const uschar *orig_name = name; +BOOL secure_so_far = TRUE; /* Loop to follow CNAME chains so far, but no further... */ @@ -825,6 +834,9 @@ for (i = 0; i < 10; i++) if (datalen < 0) return DNS_FAIL; name = data; + if (!dns_is_secure(dnsa)) + secure_so_far = FALSE; + DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name); } /* Loop back to do another lookup */ -- 2.30.2