[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 06 Dec 2018 19:46:02 +0000
From: "Laurent Bercot" <ska-dietlibc@...rnet.org>
To: musl@...ts.openwall.com
Subject: Re: DNS resolver patch
>The musl resolver should be able to handle a resolver returning NODATA.
>That is popular for having a separate extranet infrastructure - your
>extranet DNS only contains records for your local domain and returns
>NODATA for requests outside that domain.
No, you are talking about servers containing data. The musl client
(which is not a resolver, because it only performs recursive queries)
should not contact those directly. It should contact a real resolver,
a.k.a. cache, and the cache will contact the servers containing data.
If the domain has been configured properly, the servers are never asked
for data that are outside that domain.
It is the single most annoying, most bug-prone, and most confusing
flaw of DNS to have "communication between the DNS client and the DNS
cache" (recursive queries) and "communication between the DNS cache
and the DNS server" (non-recursive queries) happen on the same port.
I'd even take a different _protocol_ if it could stop people from
misconfiguring DNS.
The default usage of BIND, which was "one single daemon is both a
cache and a server and we entertain the confusion", did a lot of harm
to the Internet. As your post illustrates, this harm pertains to this
day.
--
Laurent
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
