Date: Tue, 14 Apr 2020 18:54:48 +0200 From: Florian Weimer <fw@...eb.enyo.de> To: Rich Felker <dalias@...c.org> Cc: musl@...ts.openwall.com, Christian <list-christian@....de> Subject: Re: Resolver routines, Postfix DNSSEC troubles - how to check for incompatibilities? * Rich Felker: > On Tue, Apr 14, 2020 at 11:57:17AM +0200, Florian Weimer wrote: >> * Rich Felker: >> >> > On Mon, Apr 13, 2020 at 05:52:34PM +0200, Florian Weimer wrote: >> >> * Christian: >> >> >> >> > So Viktor did some digging: >> >> > >> >> > "The comment on line 25: >> >> > >> >> > https://github.com/runtimejs/musl-libc/blob/master/include/resolv.h#L25 >> >> > >> >> > is not encouraging. It suggests that _res is unused. If so, Postfix >> >> > DNS does not work correctly with this C library. And not just for DANE, since Postfix is also unable to to control RES_DEFNAMES and RES_DNSRCH. >> >> >> >> Are these changes to the RES_DEFNAMES and RES_DNSRCH flags really >> >> necessary? Why doesn't Postfix use res_query (or perhaps res_send) as >> >> appropriate? >> > >> > But to actually answer these questions, modifying the flags is >> > presumably because traditional req_query builds an rfc1035 query or >> > edns query based on these flags derived from from resolv.conf, and >> > Postfix either assumes or wants to support the case where resolv.conf >> > is not already configured for edns, perhaps because it was generated >> > by a dhcp client. >> >> In my comment above, I specifically meant RES_DEFNAMES and RES_DNSRCH. >> >> RES_USE_EDNS0 seems different; I would expect applications to use >> their own DNS libraries if they need to access DNSSEC data and >> non-address record types (where there is no benefit gained form >> integrating with /etc/hosts or other data sources). > > Oh. For those it seems to be to suppress search domains, so that when > looking up the MX or TLSA for example.com it doesn't get records for > example.com.searchdomain. > > I don't know why they poke at flags in _res rather than just appending > a . to the name, and/or comparting the name in the result to ensure > that it matches. It doesn't work when the data doesn't come out of DNS. > Also res_query is *documented* not to use search domains. Exactly, that's why I don't understand why changing the flags is needed. res_search for searching, res_query for not searching.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.