typo in comment; saveguard -> safeguard; ok gilles@

Set correct errno field in struct asr_result.

Otherwise gethostbyname(3) returns stack garbage when it is called
with an invalid host name, indicating success.
Problem observed in segfaulting ifconf

Set correct errno field in struct asr_result.

Otherwise gethostbyname(3) returns stack garbage when it is called
with an invalid host name, indicating success.
Problem observed in segfaulting ifconfig(8) by bluhm.

show more ...

localhost is either 127.0.0.1 or ::1, nothing else.

RFC 6761, 6.3 Domain Name Reservation Considerations for "localhost.":
3. Name resolution APIs and libraries SHOULD recognize localhost

localhost is either 127.0.0.1 or ::1, nothing else.

RFC 6761, 6.3 Domain Name Reservation Considerations for "localhost.":
3. Name resolution APIs and libraries SHOULD recognize localhost
names as special and SHOULD always return the IP loopback address
for address queries and negative responses for all other query
types. Name resolution APIs SHOULD NOT send queries for
localhost names to their configured caching DNS server(s).

This makes sure that the getaddrinfo(3) and gethostbyname(3) family of
functions always return the loopback address and do not send queries
to name servers. This includes "localhost", "localhost." and
everything under ".localhost" and ".localhost.".

For example, a host underneath the .com.ar zone will per default have
a search list of "com.ar.". resolv.conf(5) has a default of "lookup
bind file". Both combined will result in lookups for "localhost" to
not return 127.0.0.1 because localhost.com.ar is registered in DNS.

It has been known for decades that this is a problem, especially for
localhost.

Problem recently spotted by gonzalo@ and debugged by sthen@

Testing sthen, gonzalo
Input & OK phessler, eric, millert
OK sthen, kn, deraadt

show more ...

Add break to error out on weird characters in gethostbyname().

Missed in previous some time ago; while here remove confusing else.

Input & OK eric

Restrict what getaddrinfo(3) is willing to try to resolve.

Programs assume that a successful call to getaddrinfo(3) validates the
input as "safe", but that's not true. Characters like '$', '`', '\n'

Restrict what getaddrinfo(3) is willing to try to resolve.

Programs assume that a successful call to getaddrinfo(3) validates the
input as "safe", but that's not true. Characters like '$', '`', '\n'
or '*' can traverse the DNS without problems, but have special
meaning, for example a shell.

There is a function res_hnok() already in libc, but it validates if a
string is a host name, which is too strict in practice. For example
foo-.example.com is not a valid host name, but is used on the
Internet.

Posix has this to say:
"The getaddrinfo() function shall translate the name of a service
location (for example, a host name)"

It hints that the input should be a host name, but it does not
restrict it to it.

This introduces a function hnok_lenient() which restricts the input to
getaddrinfo(3) to the set [A-z0-9-_.]. Additionally two consecutive
dots ('.') are not allowed nor can the string start with - or '.'.

glibc introduced a similar restriction years ago, so this should not
cause problems.

It has been known in the DNS community for years, probably decades
that getaddrinfo(3) is too lenient what it accepts, but it has always
been kicked down the road as "not a DNS problem". Unfortunately this
information never made it out of the DNS community and no coordinated
effort happened to have this addressed in operating systems.

David Leadbeater recently demonstrated how ssh(1) and ftp(1) are too
trusting with what getaddrinfo(3) accepts. Both have been fixed
independently of this.

Input deraadt, eric
OK millert, deraadt

show more ...

If we don't receive a reply packet the res_send subquery will already have
set subq_h_errno and ar_count. Remove the ar_datalen == -1 check, so we
set ar_h_errno and don't have to (wrongly) guess tha

If we don't receive a reply packet the res_send subquery will already have
set subq_h_errno and ar_count. Remove the ar_datalen == -1 check, so we
set ar_h_errno and don't have to (wrongly) guess that
ar_h_errno = HOST_NOT_FOUND.

This makes sure that if no nameserver responds the h_errno value is set to
TRY_AGAIN instead of HOST_NOT_FOUND.

OK eric@, deraadt@

show more ...

To allow us to get rid of /etc/networks, make getnetby*(3)
wrappers around gethostby*_async(3). If you had anything of
importance in /etc/networks, specify it in /etc/hosts instead.
Feedback and OK

To allow us to get rid of /etc/networks, make getnetby*(3)
wrappers around gethostby*_async(3). If you had anything of
importance in /etc/networks, specify it in /etc/hosts instead.
Feedback and OK eric@, OK deraadt@

show more ...

Put a common subq pointer in the query struct, rather than one in each
element of the union.

ok gilles@ millert@ krw@

Remove support for HOSTALIASES from the resolver. This "open and parse
any file indicated by an environment variable" feature inside the
resolver is incompatible with what pledge "dns" is trying to

Remove support for HOSTALIASES from the resolver. This "open and parse
any file indicated by an environment variable" feature inside the
resolver is incompatible with what pledge "dns" is trying to be. It is
a misguided "feature" added way back in history which almost noone uses,
but everyone has to assume the risk from.
ok eric florian kettenis

show more ...

Remove support for "lookup yp" in /etc/resolv.conf. This historical
wart is incompatible with pledge, because suddenly a "dns" operation
needs "getpw" access to ypbind/ypserv, etc. file + dns acces

Remove support for "lookup yp" in /etc/resolv.conf. This historical
wart is incompatible with pledge, because suddenly a "dns" operation
needs "getpw" access to ypbind/ypserv, etc. file + dns access is
enough for everyone, sorry if you were using that old SunOS 4.x style
mechanism, but it is now gone.
ok semarie millert florian

show more ...

remove bogus includes of err.h

Wrap <asr.h> so internal calls go direct and all the symbols are weak

Hide all unnecessary asr / resolver related API with _ prefixes.
direction & ok guenther

fix a possible off-by-one when reading /etc/hosts if it doesn't end
with a newline.

ok jca@

simply use _PATH_HOSTS where appropriate

gethostbyname(3) would fail when more than 16 addrs/aliases were returned.

Bump MAXADDRS/ALIASES to the original of 35, and silently ignore extras
instead of failing.

Noticed by markson on freenode

gethostbyname(3) would fail when more than 16 addrs/aliases were returned.

Bump MAXADDRS/ALIASES to the original of 35, and silently ignore extras
instead of failing.

Noticed by markson on freenode.

OK eric@ "with revised diff", phessler@.

show more ...

Move to the <limits.h> universe.
review by millert, binary checking process with doug, concept with guenther

change _yp_domain[] to HOST_NAME_MAX+1, and re-arrange those who include
it to get limits.h early enough

Fix a NULL deref when getting an actual result for an invalid hostname
in gethostbyname(). Similar fix for getnetbyname().

ok deraadt@ daniel@ jca@

When fopen()ing internal to libc (the API doesn't support the use
of the resulting FILE *), then pass fopen() the 'e' mode letter to
mark it close-on-exec.

ok miod@

Make queries using the search list for hostname lookups fail with
NO_DATA/EAI_NODATA when the hostname param is an empty string.
So far, they were using the entries in the search list with no
additio

Make queries using the search list for hostname lookups fail with
NO_DATA/EAI_NODATA when the hostname param is an empty string.
So far, they were using the entries in the search list with no
additional component, which is not really expected.

reported by jsing@ and a few others

ok deraadt@, "makes sense" jsing@

show more ...

skip incomplete entries in /etc/hosts and /etc/networks
fix null deref spotted by Seth Hanford, pinpointed by dtucker@

ok florian@

Make the asr API public. Install asr.h to /usr/include.h and manpages.
Include tweaks suggested by mpi@

ok deraadt@

Cleanup and simplify the API to be exposed. Use better names for
structures, functions and defines.

discussed with and ok deraadt@ guenther@

prefix structure names to avoid ambiguity and possible collisions when
the API gets public.

ok deraadt@