SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

resolvectl: support JSON output for openpgp and tlsa

Browse Source 
The openpgp and tlsa verbs rejected --json= even though they
already determine the RR type they query. Allow JSON output for
these shortcut commands.

Accept matching explicit --type= values as well, but reject
mismatched types so openpgp only queries OPENPGPKEY records and
tlsa only queries TLSA records.

Refuse unauthenticated key records in JSON format so scripts do
not accidentally consume cryptographic DNS data that would only
produce a warning in human-readable output.

Fixes #43245
This commit is contained in:
dongshengyuan
2026-08-04 08:08:33 +09:00
committed by Yu Watanabe
parent 1652be7df8
commit 05ea7e87b6
6 changed files with 89 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/knot-data/zones/untrusted.test.zone
+2
View File
@@ -24,3 +24,5 @@ mail A 10.0.0.122
myservice A 10.0.0.123
AAAA fd00:dead:beef:cafe::123
_mysvc._tcp SRV 10 5 1234 myservice
5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey OPENPGPKEY AAECAw==
test/units/TEST-75-RESOLVED.sh
+14
View File
@@ -607,6 +607,20 @@ testcase_08_resolved() {
run resolvectl openpgp mr.smith@signed.test
grep -qF "5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test" "$RUN_OUT"
grep -qF "authenticated: yes" "$RUN_OUT"
run resolvectl openpgp mr.smith@signed.test --json=short
grep -qF '"key":{"class":1,"type":61,"name":"5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test"}' "$RUN_OUT"
grep -qF '"data":"' "$RUN_OUT"
(! run resolvectl openpgp mr.smith@untrusted.test --json=short)
grep -qF "Refusing to output unauthenticated DNS records that require authentication in JSON format." "$RUN_OUT"
run resolvectl openpgp mr.smith@signed.test --json=short --type=OPENPGPKEY
grep -qF '"key":{"class":1,"type":61,"name":"5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test"}' "$RUN_OUT"
grep -qF '"data":"' "$RUN_OUT"
(! run resolvectl openpgp mr.smith@signed.test --json=short --type=A)
grep -qF -- "The openpgp command may only be combined with --type=OPENPGPKEY." "$RUN_OUT"
(! run resolvectl tlsa signed.test:invalid --json=short)
grep -qF 'Invalid port "invalid".' "$RUN_OUT"
(! run resolvectl tlsa signed.test --json=short --type=A)
grep -qF -- "The tlsa command may only be combined with --type=TLSA." "$RUN_OUT"
# Check zone transfers (AXFR/IXFR)
# Note: since resolved doesn't support zone transfers, let's just make sure it
# simply refuses such requests without choking on them