dns-manager: don't add "public suffix" domains to search (rh #851521)

If the hostname is "foo.example.com" then we want to add
"search example.com" to resolv.conf, but if it's just "example.com",
we don't want to add "search com" (rh #812394).

So if NetworkManager is being built with recent libsoup, use
soup_tld_domain_is_public_suffix() to double-check the domain before
adding it. (If it is not being built with libsoup, or is being built
with too old a version, we just skip that test, keeping the old
behavior.)

configure.ac

@@ -622,6 +622,12 @@ AC_DEFINE_UNQUOTED(KERNEL_FIRMWARE_DIR, "$KERNEL_FIRMWARE_DIR", [Define to path
 AC_SUBST(KERNEL_FIRMWARE_DIR)
 
 PKG_CHECK_MODULES(LIBSOUP, [libsoup-2.4 >= 2.26], [have_libsoup=yes],[have_libsoup=no])
+if test "$have_libsoup" = "yes"; then
+	AC_DEFINE(HAVE_LIBSOUP, 1, [Define if you have libsoup])
+else
+	AC_DEFINE(HAVE_LIBSOUP, 0, [Define if you have libsoup])
+fi
+
 AC_ARG_ENABLE(concheck, AS_HELP_STRING([--enable-concheck], [enable connectivity checking support]),
                      [enable_concheck=${enableval}], [enable_concheck=${have_libsoup}])
 if (test "${enable_concheck}" = "yes"); then

src/dns-manager/nm-dns-manager.c

@@ -46,6 +46,16 @@
 #include "nm-dns-plugin.h"
 #include "nm-dns-dnsmasq.h"
 
+#ifdef HAVE_LIBSOUP
+#include <libsoup/soup.h>
+#endif
+
+#if defined (SOUP_CHECK_VERSION) && SOUP_CHECK_VERSION (2, 40, 0)
+#define DOMAIN_IS_VALID(domain) (*(domain) && !soup_tld_domain_is_public_suffix (domain))
+#else
+#define DOMAIN_IS_VALID(domain) (*(domain))
+#endif
+
 G_DEFINE_TYPE (NMDnsManager, nm_dns_manager, G_TYPE_OBJECT)
 
 #define NM_DNS_MANAGER_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), \
@@ -129,14 +139,22 @@ merge_one_ip4_config (NMResolvConfData *rc, NMIP4Config *src)
 		const char *domain;
 
 		domain = nm_ip4_config_get_domain (src, i);
+		if (!DOMAIN_IS_VALID (domain))
+			continue;
 		if (!rc->domain)
 			rc->domain = domain;
 		add_string_item (rc->searches, domain);
 	}
 
 	num = nm_ip4_config_get_num_searches (src);
-	for (i = 0; i < num; i++)
+	for (i = 0; i < num; i++) {
-		add_string_item (rc->searches, nm_ip4_config_get_search (src, i));
+		const char *search;
+
+		search = nm_ip4_config_get_search (src, i);
+		if (!DOMAIN_IS_VALID (search))
+			continue;
+		add_string_item (rc->searches, search);
+	}
 
 	/* NIS stuff */
 	num = nm_ip4_config_get_num_nis_servers (src);
@@ -194,14 +212,22 @@ merge_one_ip6_config (NMResolvConfData *rc, NMIP6Config *src)
 		const char *domain;
 
 		domain = nm_ip6_config_get_domain (src, i);
+		if (!DOMAIN_IS_VALID (domain))
+			continue;
 		if (!rc->domain)
 			rc->domain = domain;
 		add_string_item (rc->searches, domain);
 	}
 
 	num = nm_ip6_config_get_num_searches (src);
-	for (i = 0; i < num; i++)
+	for (i = 0; i < num; i++) {
-		add_string_item (rc->searches, nm_ip6_config_get_search (src, i));
+		const char *search;
+
+		search = nm_ip6_config_get_search (src, i);
+		if (!DOMAIN_IS_VALID (search))
+			continue;
+		add_string_item (rc->searches, search);
+	}
 }
 
 
@@ -636,7 +662,7 @@ update_dns (NMDnsManager *self,
 		const char *hostsearch = strchr (priv->hostname, '.');
 
 		/* +1 to get rid of the dot */
-		if (hostsearch && strlen (hostsearch + 1))
+		if (hostsearch && DOMAIN_IS_VALID (hostsearch + 1))
 			add_string_item (rc.searches, hostsearch + 1);
 	}