openbsd-src/sbin/unwind/ at fan · jcs.org/openbsd-src

jcs.org / openbsd-src

jcs's openbsd hax

openbsd

openbsd-src / sbin / unwind /

at fan 1 folder 17 files

Sync config.h, we have ed25519 support now.

3 years ago

Dynamically link these /sbin daemons: dhcpleased, mountd, nfsd, pflogd, resolvd, slaacd, unwind. The mitigation story is way better: syscalls are in a randomly located libc, and every syscall stub is randomly located inside that due to random relinking. As opposed to fixed offset inside a release binary. There is one known consequence: /usr nfs mounting must use statically configured IP addresses. ok kettenis florian, others

3 years ago

We need to track the pid of the connecting control connection to be able to send answers back to the correct client in case two are connecting at the same time. We also need to pass the pid around to the resolver process so that it can hand it back to us. Debugged by deraadt and dlg who noticed that answers would always arrive on the first control connection.

5 years ago

Move control_state and ctl_conns to control.c, it's not needed elsewhere and unbreaks -fno-common. Inspired by claudio Problem reported by mortimer

5 years ago

Implement DNS64 synthesis. When unwind(8) learns new autoconf resolvers (from dhcp or router advertisements) it checks if a DNS64 is present in this network location and tries to recover the IPv6 prefix used according to RFC7050. The learned autoconf resolvers are then prevented from upgrading to the validating state since DNS64 breaks DNSSEC. unwind(8) can now perform its own synthesis. If a query for a AAAA record results in no answer we re-send the query for A and if that leads to an answer we synthesize an AAAA answer using the learned prefixes.

5 years ago

Implement DNS64 synthesis. When unwind(8) learns new autoconf resolvers (from dhcp or router advertisements) it checks if a DNS64 is present in this network location and tries to recover the IPv6 prefix used according to RFC7050. The learned autoconf resolvers are then prevented from upgrading to the validating state since DNS64 breaks DNSSEC. unwind(8) can now perform its own synthesis. If a query for a AAAA record results in no answer we re-send the query for A and if that leads to an answer we synthesize an AAAA answer using the learned prefixes.

5 years ago

unwind: add two missing void to function definitions

3 years ago

Determine available address families (and monitor when this changes) to configure libunbound accordingly. This way it no longer tries to talk to IPv6 nameservers when only IPv4 is available and vice versa. input deraadt OK kn

5 years ago

Due to the way we build libunbound inside of unwind .o files collide in the obj directory. Previously this was solved by keeping the libunbound file name (to be able to keep in sync with upstream) and prefixing the source filename of colliding .o files in unwind with uw_.

7 years ago

including sys/cdefs.h manually started as a result of netbsd trying to macro-build a replacement for sccsid, and was done without any concern for namespace damage. Unfortunately this practice started infecting other code as others were unaware they didn't need the file. ok millert guenther

4 years ago

config_new_empty() should give us a completely empty config, let parse_config() handle the case of defaults. This prevents the resolver process from spinning up resolver strategies before the config has been parsed and tearing them down immediately after if they are not listed in the config files preferences section.

4 years ago

Allow forcing specific domains to be resolved by specific resolvers; Handles typical split-horzizon setups. ok florian@

6 years ago

unwind: add two missing void to function definitions

3 years ago

Implement unwindctl status memory to show chache memory usage. testing by otto & pamela as part of a larger diff

6 years ago

some nameserver proposal bits:

3 years ago

Use correct order of arguments for shutdown(2).

3 years ago

some nameserver proposal bits:

3 years ago

Say autoconf not dhcp

4 years ago