Date: Fri, 23 Oct 2015 17:30:32 +0200 From: Jan Broer <jasiu.79@...il.com> To: musl@...ts.openwall.com Subject: Re: Re: Would love to see reconsideration for domain and search A very interesting discussion going on here. > You can't query all nameservers and just take > the first NXDOMAIN to respond. You can only accept NXDOMAIN if all of > the higher-priority (listed first in resolv.conf) nameservers have > timed out or SERVFAIL'ed. You can issue queries in parallel, but you > must process responses in order, which is what you describe below. GNU libc resolver gives priority to the primary nameserver because it assumes that this is the one with the lowest RTT / highest availability. This priorization was never understood as meaning that the primary's servers records are more "authorative" than those of secondary nameservers. > My view has always been that multiple > nameservers in resolv.conf are for redundancy, not for serving > conflicting records. I agree. >I have to disagree. Some non-forwarding DNS servers use SERVFAIL to >indicate "I am not serving for that domain" specifically to make the >client move to their next nameserver. if ns1 returns SERVFAIL, try >ns2. If ns1 times out, try ns2. Otherwise what good is ns2? This kind of result unioning you want from musl-libs isn't even supported by GNU libc resolver. Yes it works for you - but this is because your DNS server is breaking DNS RFC specs: SERVFAIL is not a technically legal response for "I am not serving for that domain". It's just WRONG. When an authorative server (which the Kubernetes DNS server is) doesn't serve a specific zone it has to respond with NXDOMAIN. Of course if your server would follow the rules than that type of result unioning doesn't work because GNU libc resolver does not failover to secondary servers when the response is NXDOMAIN. It's just a weak argument to essentially say: "The GNU libc resolver does exactly what i want when i point it to my broken DNS server, why can't musl-libc?". The bottom line: Leave nameserver querying logic as it is: Check! Implement search paths: Check! Consider ndots option in resolv.conf: Check! query name <= ndots: search first query name > ndots : never search LGTM! Jan Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.