From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/12668 Path: news.gmane.org!.POSTED!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: [PATCH v5] resolver: mitigate bad interactions concering inconsistent DNS search domains with ndots usage Date: Sat, 31 Mar 2018 18:47:00 -0400 Message-ID: <20180331224700.GW1436@brightrain.aerifal.cx> References: <20180331094004.4153-1-nenolod@dereferenced.org> <20180331172232.5i4vxm27pbkeq3qq@sinister.lan.codevat.com> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: blaine.gmane.org 1522536314 24389 195.159.176.226 (31 Mar 2018 22:45:14 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Sat, 31 Mar 2018 22:45:14 +0000 (UTC) User-Agent: Mutt/1.5.21 (2010-09-15) To: musl@lists.openwall.com Original-X-From: musl-return-12682-gllmg-musl=m.gmane.org@lists.openwall.com Sun Apr 01 00:45:10 2018 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.84_2) (envelope-from ) id 1f2PFG-0006EK-CO for gllmg-musl@m.gmane.org; Sun, 01 Apr 2018 00:45:10 +0200 Original-Received: (qmail 24016 invoked by uid 550); 31 Mar 2018 22:47:14 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 23975 invoked from network); 31 Mar 2018 22:47:12 -0000 Content-Disposition: inline In-Reply-To: <20180331172232.5i4vxm27pbkeq3qq@sinister.lan.codevat.com> Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:12668 Archived-At: On Sat, Mar 31, 2018 at 10:22:32AM -0700, Eric Pruitt wrote: > On Sat, Mar 31, 2018 at 09:40:04AM +0000, William Pitcock wrote: > > In certain cases where the Kubernetes guest is configured with a clusterwide domain that is > > hosted by a certain large CDN provider (*ahem* Cloudflare), the resolver may process > > erroneous replies sent from that CDN provider that have an empty A/AAAA record set. > > [...] > > - if ((abuf[0][3] & 15) == 0) return EAI_NONAME; > > + if ((abuf[0][3] & 15) == 0) { > > + /* A certain large CDN provider's DNS service erroneously responds to queries with > > + * a NOERROR(0) response code, while also returning an empty record set. Accordingly, > > + * check for this and handle it as we would an NXDOMAIN(3) if the record set is empty > > + * for both A and AAAA records. */ > > + if (nq == 2 && (ctx.recordcnt[0] + ctx.recordcnt[1]) == 0) return 0; > > + else return EAI_NONAME; > > If you're going to call out Cloudflare in the commit message, why not do > it in the code comment, too? If someone runs into this later without > having read this mailing list post and they're using a release copy of > musl (something without revision history like a tar ball), poorly > obscuring Cloudflare's name just adds unnecessary friction to debugging > the problem. Generally names of services/users/products are not put in either the commit log or comments in musl. The main exception is toolchain (compiler, binutils) stuff where we're talking about explicit interactions with those components. Rich