From d87b323e23727615a22a110d12cfa3f13beda00a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 13 Oct 2020 08:19:33 +0200 Subject: [PATCH] Add also trust-ad option More recent glibc squashes ad bit from remote network, unless trust-ad is provided (visit rhbz#1878166). Add it for forward compatibility. --- ...tch => 0004-Add-options-edns0-and-trust-ad.patch | 13 +++++++++---- dnssec-trigger.spec | 3 ++- 2 files changed, 11 insertions(+), 5 deletions(-) rename dnssec-trigger-0.15-edns0.patch => 0004-Add-options-edns0-and-trust-ad.patch (71%) diff --git a/dnssec-trigger-0.15-edns0.patch b/0004-Add-options-edns0-and-trust-ad.patch similarity index 71% rename from dnssec-trigger-0.15-edns0.patch rename to 0004-Add-options-edns0-and-trust-ad.patch index f328ce2..5d59b87 100644 --- a/dnssec-trigger-0.15-edns0.patch +++ b/0004-Add-options-edns0-and-trust-ad.patch @@ -1,16 +1,21 @@ -From a704a5009681a16560937769b3db5b51d0da2eca Mon Sep 17 00:00:00 2001 +From 96b32c7a3494e214998f53fe69503667ada8ea46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 12 Oct 2020 23:25:43 +0200 -Subject: [PATCH] Add options edns +Subject: [PATCH 4/5] Add options edns0 and trust-ad SSH uses AD flag only when edns0 is enabled in resolv.conf. Unbound of course supports it, no need to keep it disabled. + +Add also trust-ad for more recent libraries, which discard AD flag +without explicit trust. + +Patch: dnssec-trigger-0.15-edns0.patch --- dnssec-trigger-script.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dnssec-trigger-script.in b/dnssec-trigger-script.in -index 14d9278..bc99c87 100644 +index 14d9278..1c6f581 100644 --- a/dnssec-trigger-script.in +++ b/dnssec-trigger-script.in @@ -421,7 +421,7 @@ class Application: @@ -18,7 +23,7 @@ index 14d9278..bc99c87 100644 resolvconf_networkmanager = "/var/run/NetworkManager/resolv.conf" - resolvconf_localhost_contents = "# Generated by dnssec-trigger-script\nnameserver 127.0.0.1\n" -+ resolvconf_localhost_contents = "# Generated by dnssec-trigger-script\nnameserver 127.0.0.1\noptions edns0\n" ++ resolvconf_localhost_contents = "# Generated by dnssec-trigger-script\nnameserver 127.0.0.1\noptions edns0 trust-ad\n" rfc1918_reverse_zones = [ "c.f.ip6.arpa", diff --git a/dnssec-trigger.spec b/dnssec-trigger.spec index 4a65573..392497c 100644 --- a/dnssec-trigger.spec +++ b/dnssec-trigger.spec @@ -23,7 +23,8 @@ Source3: dnssec-trigger-workstation.conf Patch1: 0001-dnssec-trigger-script-port-to-libnm.patch Patch2: 0002-Fix-that-NXDOMAIN-for-_probe.uk.uk-is-deemed-allrigh.patch Patch3: 0003-Move-the-NetworkManager-dispatcher-script-out-of-etc.patch -Patch4: dnssec-trigger-0.15-edns0.patch +# https://github.com/NLnetLabs/dnssec-trigger/pull/7 +Patch4: 0004-Add-options-edns0-and-trust-ad.patch # to obsolete the version in which the panel was in main package Obsoletes: %{name} < 0.12-22