Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 4 Dec 2022 06:45:59 +0100
From: Markus Wichmann <>
Subject: Re: lookup_name issue with search domains

On Sun, Dec 04, 2022 at 12:02:54AM -0400, Kenny MacDermid wrote:
> The issue arises when it queries my cloudflare hosted domain (which also
> uses dnssec). That query does not have the reply code flags set to 3.
> Instead it's set to 0. This results in name_from_dns() returning

I think we had that report before. The problem is that cloudflare is
wrong here. DNS response with empty data section and NOERROR status
means the domain name exists, but has no records of the requested type.
If cloudflare is reporting that for a name where that isn't true, they
are making a mistake.

This is a cloudflare-specific break with the DNS standards (don't ask me
which, though), so we probably won't change musl to deal with this.
Simplest solution for the known-bad actor is to write a proxy server
that turns the wrong answers into correct ones.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.