IABSD.fr/src/include

Branch : - branch - master - tag -

• Show log

  Commit

• Author : jca
  Date : 2021-11-22 20:18:27
  Hash : 931108e9
  Message : Implement rfc6840 (AD flag processing) if using trusted name servers libc can't do DNSSEC validation but it can ask a "security-aware" resolver to do so. Let's send queries with the AD flag set when appropriate, and let applications look at the AD flag in responses in a safe way, ie clear the AD flag if the resolvers aren't trusted. By default we only trust resolvers if resolv.conf(5) only lists name servers on localhost - the obvious candidates being unwind(8) and unbound(8). For non-localhost resolvers, an admin who trusts *all the name servers* listed in resolv.conf(5) *and the network path leading to them* can annotate this with "options trust-ad". AD flag processing gives ssh -o VerifyHostkeyDNS=Yes a chance to fetch SSHFP records in a secure manner, and tightens the situation for other applications, eg those using RES_USE_DNSSEC for DANE. It should be noted that postfix currently assumes trusted name servers by default and forces RES_TRUSTAD if available. RES_TRUSTAD and "options trust-ad" were first introduced in glibc by Florian Weimer. Florian Obser (florian@) contributed various improvements, fixed a bug and added automatic trust for name servers on localhost. ok florian@ phessler@

• Files
• Makefile
• a.out.h
• ar.h
• arpa
• asr.h
• assert.h
• bitstring.h
• blf.h
• bsd_auth.h
• complex.h
• cpio.h
• ctype.h
• curses.h
• db.h
• dirent.h
• disktab.h
• dlfcn.h
• elf.h
• elf_abi.h
• err.h
• errno.h
• fenv.h
• float.h
• fnmatch.h
• fstab.h
• fts.h
• ftw.h
• getopt.h
• glob.h
• grp.h
• icdb.h
• ieeefp.h
• ifaddrs.h
• inttypes.h
• iso646.h
• kvm.h
• langinfo.h
• libgen.h
• limits.h
• link.h
• link_elf.h
• locale.h
• login_cap.h
• math.h
• md5.h
• memory.h
• ndbm.h
• netdb.h
• netgroup.h
• nl_types.h
• nlist.h
• paths.h
• poll.h
• protocols
• pthread.h
• pthread_np.h
• pwd.h
• ranlib.h
• readpassphrase.h
• regex.h
• resolv.h
• rmd160.h
• rpc
• rpcsvc
• sched.h
• search.h
• semaphore.h
• setjmp.h
• sha1.h
• sha2.h
• signal.h
• siphash.h
• sndio.h
• spawn.h
• stdbool.h
• stddef.h
• stdio.h
• stdlib.h
• string.h
• strings.h
• sysexits.h
• tar.h
• tgmath.h
• tib.h
• time.h
• ttyent.h
• unistd.h
• utime.h
• utmp.h
• uuid.h
• vis.h
• wchar.h
• wctype.h