Implement rfc6840 (AD flag processing) if using trusted name servers

libc can't do DNSSEC validation but it can ask a "security-aware"
resolver to do so. Let's send queries with the AD flag set whe

Implement rfc6840 (AD flag processing) if using trusted name servers

libc can't do DNSSEC validation but it can ask a "security-aware"
resolver to do so. Let's send queries with the AD flag set when
appropriate, and let applications look at the AD flag in responses in
a safe way, ie clear the AD flag if the resolvers aren't trusted.
By default we only trust resolvers if resolv.conf(5) only lists name
servers on localhost - the obvious candidates being unwind(8) and
unbound(8). For non-localhost resolvers, an admin who trusts *all the
name servers* listed in resolv.conf(5) *and the network path leading to
them* can annotate this with "options trust-ad".

AD flag processing gives ssh -o VerifyHostkeyDNS=Yes a chance to fetch
SSHFP records in a secure manner, and tightens the situation for other
applications, eg those using RES_USE_DNSSEC for DANE. It should be
noted that postfix currently assumes trusted name servers by default and
forces RES_TRUSTAD if available.

RES_TRUSTAD and "options trust-ad" were first introduced in glibc by
Florian Weimer. Florian Obser (florian@) contributed various
improvements, fixed a bug and added automatic trust for name servers on
localhost.

ok florian@ phessler@

show more ...

swap rname and mname in debug output, and handle the USE_CD flag

from Boudewijn Dijkstra

snprintf/vsnprintf return < 0 on error, rather than -1.

To allow us to get rid of /etc/networks, make getnetby*(3)
wrappers around gethostby*_async(3). If you had anything of
importance in /etc/networks, specify it in /etc/hosts instead.
Feedback and OK

To allow us to get rid of /etc/networks, make getnetby*(3)
wrappers around gethostby*_async(3). If you had anything of
importance in /etc/networks, specify it in /etc/hosts instead.
Feedback and OK eric@, OK deraadt@

show more ...

Recognize and allow bits AD and CD in DNS replies.

Needed for RES_USE_DNSSEC support.

ok eric@ gilles@

use common errnos instead of random strings as error indicators in
pack/unpack contexts.

ok krw@ deraadt@

We are always using _PATH_RESCONF, so no need to remember the path on
the resolver.

ok millert@ deraadt@

missing asr* -> _asr* symbol rename for building with debug code

ok jca@

Hide all unnecessary asr / resolver related API with _ prefixes.
direction & ok guenther

Rename print_sockaddr() to avoid symbol visibility problems

print_sockaddr is internal to asr, and conflicts with ports/net/samba4.

ok eric@

simply use _PATH_HOSTS where appropriate

Make the asr API public. Install asr.h to /usr/include.h and manpages.
Include tweaks suggested by mpi@

ok deraadt@

Cleanup and simplify the API to be exposed. Use better names for
structures, functions and defines.

discussed with and ok deraadt@ guenther@

prefix structure names to avoid ambiguity and possible collisions when
the API gets public.

ok deraadt@

Make some symbols static and prefix all visible symbols with asr_
to prevent collisions with third-party programs.

suggested by sthen@, ok theo@

Add minimal support for _res setup and update.

Change res_init() to initialize the _res structure on first call, and
udpate the global async context if changes were made by the user. All
resolver fu

Add minimal support for _res setup and update.

Change res_init() to initialize the _res structure on first call, and
udpate the global async context if changes were made by the user. All
resolver functions now call res_init() internally.

fixes issue spotted by otto@

show more ...

show what we parsed in debug output; ok guether@

space cleanup; ok eric

knf

make separate structures for pack and unpack

cleanup asr_debug.c

use proper macros for debug traces.

Get rid of the hostaddr_async subquery and merge its behaviour
directly into getaddrinfo_async_run. Simplifies everything by
a great deal.

Make hostaddr_async() return a linked list of struct addrinfo. First
round of a getaddrinfo_async() simplification. The goal is to make YP
support easier to add, and eventually remove the whole host

Make hostaddr_async() return a linked list of struct addrinfo. First
round of a getaddrinfo_async() simplification. The goal is to make YP
support easier to add, and eventually remove the whole hostaddr_async
subquery.

show more ...

rename function to avoid symbol clash