Simplify trust anchor handling.

Open trust anchor file for reading and writing on startup and pass it
to the frontend process. The frontend process seeks and truncates the
file apropriately when writing out new trust anchors learned via DNS
but never closes the file. On error the file is truncated to zero
length.

This is in turn handled on startup by switching to the built in trust
anchor when no trustanchor can be read from disk.

This side steps the need for an unveil'ed directory with "c" permission
and also removes the wpath and cpath pledges from the parent process.

deraadt@ pointed out that my previous design didn't make sense and I
had confused myself along the way. (It did work, but was too
complicated for no good reason).

While here validate that we actually read a trust anchor from disk by
trying to parse it and checking that it is a DNSKEY. Unfortunately
ub_ctx_add_ta() accepts just any string as a trust anchor without any
validation.

1 files changed, 1 insertions, 6 deletions

diff --git a/sbin/unwind/unwind.h b/sbin/unwind/unwind.h
index df574ee38bc..47baff9e162 100644
--- a/sbin/unwind/unwind.h
+++ b/sbin/unwind/unwind.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: unwind.h,v 1.7 2019/02/07 17:20:35 florian Exp $	*/
+/*	$OpenBSD: unwind.h,v 1.8 2019/02/10 14:10:22 florian Exp $	*/
 
 /*
  * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
@@ -97,15 +97,10 @@ enum imsg_type {
 	IMSG_OPEN_HTTP_PORT,
 	IMSG_HTTPSOCK,
 	IMSG_CAPTIVEPORTAL_STATE,
-	IMSG_OPEN_TA_RO,
-	IMSG_OPEN_TA_W,
 	IMSG_TAFD,
-	IMSG_TAFD_W,
 	IMSG_NEW_TA,
 	IMSG_NEW_TAS_ABORT,
 	IMSG_NEW_TAS_DONE,
-	IMSG_TA_W_DONE,
-	IMSG_TA_W_FAILED
 };
 
 struct unwind_forwarder {