Re: Proposed Improvements to NPF

On Sat 07 Jun 2025 at 06:52:55 -0400, Greg Troxel wrote:
> Josh Moyer <[email protected]> writes:
> 
> > 3: DNS hostname lookup support.  (Is this a bad idea from a remote
> > firewall rule manipulation attack type of perspective?)
> 
> (I agree with Edgar's chicken/egg comment.)

Maybe Josh doesn't literally mean DNS lookup but just name lookup in
general. That can also work with /etc/hosts or whatever else in
/etc/nsswitch.conf that doesn't need to access the network before it has
been set up.

-Olaf.
-- 
___ Olaf 'Rhialto' Seibert                            <rhialto/at/falu.nl>
\X/ There is no AI. There is just someone else's work.           --I. Rose

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEFVAhiiWjqgwBVdQAmYnGRWHD+9MFAmhEQvsACgkQmYnGRWHD
+9PLrwf+JirprljbhuSNx0385F7GuxhFeOzmgkIymqCDvIq8CHFGIRAL3o/MV4Fp
1KFIDAHDBmOHdIuzj4tjny6VIXAa5Gzh9bxfI9vSXkzO2C+T+IA+tr5/NxozRRlo
HgMLpz4qXtLcHivB7xTgKDN0s0mlW/yzAz7Nyse/on3PqrYNLPQgNocWnXfXnX+R
16tKWbax6NIjjb8i5qhvNV8anClvlXoz0BqLtSLHroPWOmiIcVGEvC9sEpjZO9sh
7/PtPi3AbNaqpCL/1I6Q75FcUm97vjxxzjyWuIxvZWbj2W5NIkXCKaaBbb98AhDA
d7VW23Vi2pyJ3LGhB8DrjEQGpJ48hA==
=SpSI
-----END PGP SIGNATURE-----