Fixup comment

Implement rfc6840 (AD flag processing) if using trusted name servers

libc can't do DNSSEC validation but it can ask a "security-aware"
resolver to do so. Let's send queries with the AD flag set whe

Implement rfc6840 (AD flag processing) if using trusted name servers

libc can't do DNSSEC validation but it can ask a "security-aware"
resolver to do so. Let's send queries with the AD flag set when
appropriate, and let applications look at the AD flag in responses in
a safe way, ie clear the AD flag if the resolvers aren't trusted.
By default we only trust resolvers if resolv.conf(5) only lists name
servers on localhost - the obvious candidates being unwind(8) and
unbound(8). For non-localhost resolvers, an admin who trusts *all the
name servers* listed in resolv.conf(5) *and the network path leading to
them* can annotate this with "options trust-ad".

AD flag processing gives ssh -o VerifyHostkeyDNS=Yes a chance to fetch
SSHFP records in a secure manner, and tightens the situation for other
applications, eg those using RES_USE_DNSSEC for DANE. It should be
noted that postfix currently assumes trusted name servers by default and
forces RES_TRUSTAD if available.

RES_TRUSTAD and "options trust-ad" were first introduced in glibc by
Florian Weimer. Florian Obser (florian@) contributed various
improvements, fixed a bug and added automatic trust for name servers on
localhost.

ok florian@ phessler@

show more ...

correctly handle read(2) return value.

fix issue reported by Mikolaj Kucharski.

ok martijn@ deraadt@

Unbreak tree. Last minute changes are evil.

There are cases where a program doing dns requests wants to set the
Checking Disabled flag. Introduce a RES flag to do so. ok krw@
deraadt@ eric@

use recallocarray to resize buffer - ensures that detritus from previous
lookups isn't left lying around the address space.
ok eric

don't need to handle the malloc case special, since realloc works
with NULL
ok eric

Add support for RES_USE_DNSSEC

RES_USE_DNSSEC is implemented by setting the DNSSEC DO bit in outgoing
queries. The resolver is then supposed to set the AD bit in the reply
if it managed to validate

Add support for RES_USE_DNSSEC

RES_USE_DNSSEC is implemented by setting the DNSSEC DO bit in outgoing
queries. The resolver is then supposed to set the AD bit in the reply
if it managed to validate the answer through DNSSEC. Useful when the
application doesn't implement validation internally. This scheme
assumes that the validating resolver is trusted and that the
communication channel between the validating resolver and and the client
is secure.

ok eric@ gilles@

show more ...

Put a common flags field in the query struct, rather than in some
elements of the union.

This field is for internal asr flags. The flags in "struct rrset" and
"struct ni" are different kinds of fla

Put a common flags field in the query struct, rather than in some
elements of the union.

This field is for internal asr flags. The flags in "struct rrset" and
"struct ni" are different kinds of flags.

ok eric@

show more ...

Use more specific error codes for invalid packets.
In particular, truncated packets without the TC flag set (non-compliant
server sending too large packets) now fail with EOVERFLOW instead of EINVAL,

Use more specific error codes for invalid packets.
In particular, truncated packets without the TC flag set (non-compliant
server sending too large packets) now fail with EOVERFLOW instead of EINVAL,
so the TCP fallback mechanism can work.

feedback and ok krw@ jca@ benno@

show more ...

Add EDNS0 support.

EDNS allows for various DNS extensions, among which UDP DNS packets size
bigger than 512 bytes. The default is still to not advertize anything.

ok eric@

Increase UDP packet buffer to 4096 bytes from 512. There are some really
broken DNS servers out there that send packets >512 bytes w/o even the
courtesy of trying to use EDNS0.

A partial workaround

Increase UDP packet buffer to 4096 bytes from 512. There are some really
broken DNS servers out there that send packets >512 bytes w/o even the
courtesy of trying to use EDNS0.

A partial workaround as more complete packet parsing solutions are
worked on.

ok jca@ eric@

show more ...

Switch to using SOCK_DNS flag, rather than the dnssocket() and
dnssonnect() calls. Be a bit careful crossing over this, need a kernel
no older than Monday.
ok guenther tedu semarie

libc DNS functions will now use the new dnssocket() / dnsconnect()
system calls. These signal to the pledge kernel code that a DNS
transaction is happening. These special sockets only work well wit

libc DNS functions will now use the new dnssocket() / dnsconnect()
system calls. These signal to the pledge kernel code that a DNS
transaction is happening. These special sockets only work well with
port 53 (there are some cute plans...).
Programs calling pledge "inet" will not work! You need pledge "dns",

and of course, you need a fairly fresh kernel.

ok guenther kettenis tedu

show more ...

remove bogus includes of err.h

Wrap <asr.h> so internal calls go direct and all the symbols are weak

Hide all unnecessary asr / resolver related API with _ prefixes.
direction & ok guenther

Use SOCK_NONBLOCK in a couple more places

ok deraadt@

Rename print_sockaddr() to avoid symbol visibility problems

print_sockaddr is internal to asr, and conflicts with ports/net/samba4.

ok eric@

Make the asr API public. Install asr.h to /usr/include.h and manpages.
Include tweaks suggested by mpi@

ok deraadt@

Cleanup and simplify the API to be exposed. Use better names for
structures, functions and defines.

discussed with and ok deraadt@ guenther@

prefix structure names to avoid ambiguity and possible collisions when
the API gets public.

ok deraadt@

Make some symbols static and prefix all visible symbols with asr_
to prevent collisions with third-party programs.

suggested by sthen@, ok theo@

iterating over the ns list only matters for res_send_async.c, so move
things around.

Do not take external buffers for storing DNS responses in the internal
async API. That is actually useless and it makes the code more
complicated. The required buffers are always allocated when nee

Do not take external buffers for storing DNS responses in the internal
async API. That is actually useless and it makes the code more
complicated. The required buffers are always allocated when needed.

show more ...