From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: (qmail 15527 invoked from network); 13 Apr 2020 16:07:53 -0000 Received-SPF: pass (mother.openwall.net: domain of lists.openwall.com designates 195.42.179.200 as permitted sender) receiver=inbox.vuxu.org; client-ip=195.42.179.200 envelope-from= Received: from mother.openwall.net (195.42.179.200) by inbox.vuxu.org with UTF8ESMTPZ; 13 Apr 2020 16:07:53 -0000 Received: (qmail 26395 invoked by uid 550); 13 Apr 2020 16:07:51 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 26371 invoked from network); 13 Apr 2020 16:07:51 -0000 Date: Mon, 13 Apr 2020 12:07:39 -0400 From: Rich Felker To: Florian Weimer Cc: Christian , musl@lists.openwall.com Message-ID: <20200413160739.GU11469@brightrain.aerifal.cx> References: <9832107bf742db3145a3960c28cde867f924fe1f.camel@web.de> <4524b127ea99b2d1edcd8c91555a9af21e46a9b3.camel@web.de> <87imi32xj1.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87imi32xj1.fsf@mid.deneb.enyo.de> User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] Resolver routines, Postfix DNSSEC troubles - how to check for incompatibilities? On Mon, Apr 13, 2020 at 05:52:34PM +0200, Florian Weimer wrote: > * Christian: > > > So Viktor did some digging: > > > > "The comment on line 25: > > > > https://github.com/runtimejs/musl-libc/blob/master/include/resolv.h#L25 > > > > is not encouraging. It suggests that _res is unused. If so, Postfix > > DNS does not work correctly with this C library. And not just for > > DANE, since Postfix is also unable to to control RES_DEFNAMES and > > RES_DNSRCH. > > Are these changes to the RES_DEFNAMES and RES_DNSRCH flags really > necessary? Why doesn't Postfix use res_query (or perhaps res_send) as > appropriate? What I'd really like to see Postfix doing is not trying to poke at/override configuration, and assuming option edns0 is set in resolv.conf if the user wants it. Then, if it's set and the resolver supports making edns queries with DNSSEC result flags available, it can act on them and treat "valid result for signed domain" differently from "valid result for unsigned domain". My preferred behavior if not, that's compatible with what's always been the intended musl stub resolver usage model, is that treat all DNSSEC behavior as outsourced to the configured nameserver and simply lookup records. (If wanted, the user's local nameserver can then drop TLSA records for unsigned domains, or report them to be honored as if they were signed, according to the wishes of whoever set it up.) But it might be unrealistic to expect Postfix to do this. Rich