openbsd/src/lib/libc/net/res_init.3, branch OPENBSD_7_9 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2021-11-24T20:06:32+00:00 Describe what RES_USE_DNSSEC does and how it's affected by trust-ad 2021-11-24T20:06:32+00:00 jca 2021-11-24T20:06:32+00:00 urn:sha1:757c7646fbdf4543d7d64d84a70fae57d5aa6849 ok florian@ Implement rfc6840 (AD flag processing) if using trusted name servers 2021-11-22T20:18:27+00:00 jca 2021-11-22T20:18:27+00:00 urn:sha1:ca02920211b601ee0c85b3f9e9730859d617b1c2 libc can't do DNSSEC validation but it can ask a "security-aware" resolver to do so. Let's send queries with the AD flag set when appropriate, and let applications look at the AD flag in responses in a safe way, ie clear the AD flag if the resolvers aren't trusted. By default we only trust resolvers if resolv.conf(5) only lists name servers on localhost - the obvious candidates being unwind(8) and unbound(8). For non-localhost resolvers, an admin who trusts *all the name servers* listed in resolv.conf(5) *and the network path leading to them* can annotate this with "options trust-ad". AD flag processing gives ssh -o VerifyHostkeyDNS=Yes a chance to fetch SSHFP records in a secure manner, and tightens the situation for other applications, eg those using RES_USE_DNSSEC for DANE. It should be noted that postfix currently assumes trusted name servers by default and forces RES_TRUSTAD if available. RES_TRUSTAD and "options trust-ad" were first introduced in glibc by Florian Weimer. Florian Obser (florian@) contributed various improvements, fixed a bug and added automatic trust for name servers on localhost. ok florian@ phessler@ A comma is not appropriate here, use a semicolon 2020-04-25T21:06:17+00:00 jca 2020-04-25T21:06:17+00:00 urn:sha1:5ac285f9542fbaa83f719d92c31dc7540b6aa10b Suggested by Evan Silberman, confirmed by jmc@ Discourage use of RES_USE_INET6 2020-04-25T16:23:59+00:00 jca 2020-04-25T16:23:59+00:00 urn:sha1:a6b45674e18ab9626e7297f2b5433e1bc495a0e1 Suggested by eric@, input from deraadt@, ok deraadt@ eric@ Fix RES_USE_INET6 description 2020-04-25T14:30:05+00:00 jca 2020-04-25T14:30:05+00:00 urn:sha1:93346054dd85553cc13072024267ff8ceb9dfd19 The previous wording implied this option does nothing, which is wrong. This option does affect the way gethostbyname(3) works on OpenBSD (return IPv6 addresses if available). On some systems, it also introduces IPv4-mapped IPv6 addresses, a "feature" that we don't support. ok deraadt@ eric@ Move 4 manual pages from not-a-function filenames to a correct filename, 2019-08-30T18:33:17+00:00 deraadt 2019-08-30T18:33:17+00:00 urn:sha1:866a264a895fc2596c946fa5da0a02fd4f740319 and correct Xr. ok jmc