Date: Mon, 13 Apr 2020 13:20:49 +0200 From: Christian <list-christian@....de> To: musl@...ts.openwall.com Subject: Re: Resolver routines, Postfix DNSSEC troubles - how to check for incompatibilities? Hi again, So Viktor did some digging: "The comment on line 25: https://github.com/runtimejs/musl-libc/blob/master/include/resolv.h#L25 is not encouraging. It suggests that _res is unused. If so, Postfix DNS does not work correctly with this C library. And not just for DANE, since Postfix is also unable to to control RES_DEFNAMES and RES_DNSRCH. Indeed searching the github repo for RES_USE_DNSSEC and RES_USE_EDNS0 finds hits only the header file, and similarly: https://raw.githubusercontent.com/runtimejs/musl-libc/master/src/network/res_state.c pretty much rules out support for configurable lookup options." and "The musl-libc resolver code also includes [...]: https://github.com/runtimejs/musl-libc/blob/master/src/network/__dns.c#L67-L69 So not terribly safe if using a remote resolver. Definitely no support for EDNS(0) or sending the "DO" or "AD" bits in the request. Always queries all resolvers in parallel without waiting for a short timeout from the first one (or use connect(2) for prompt notification of host/port unreachable). There is no support for truncated responses or TCP failover, so if a host has enough IP addresses, some may be dropped, and FcRDNS checks may fail spuriously." I guess this all shows the incompatibility. Big questions is now: Will/Can this be resolved? Out of what I can understand it makes Postfix with musl pretty much unusable, at least less secure (not only because of the lib itself, but as well as security features, like DANE get crippled without noticing). Also I am not sure why there are stubs build to "satisfy broken apps"? An exception would have showed right away that something is not working and prevented the use.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.