From: Rich Felker <dalias@libc.org>
To: musl@lists.openwall.com
Subject: [musl] AD bit in outgoing DNS queries
Date: Mon, 27 Apr 2020 23:09:19 -0400 [thread overview]
Message-ID: <20200428030919.GR11469@brightrain.aerifal.cx> (raw)
In order to obtain information on whether the result is in a DNSSEC
signed zone, which is needed for some applications including
RFC-conforming use of DANE records, the AD bit must be set in the
outgoing DNS query, indicating support by the client.
musl's resolver library does not presently set the AD bit, and
historically (~5+ years ago) at least there were compatibility
problems with broken nameservers/firewalls/etc. failing to reply or
dropping packets if it was set. I'd really really like to just set it
unconditionally, since it's the modern, resonable, Right Thing to do,
and since making it configurable/stateful is nasty -- depending on how
you do it, it turns into either a:
- layer violation, if config affects res_mkquery rather than just
res_query, or a
- least-surprise violation, if config only affects res_send and causes
it to rewrite the header bits of the query at send-time.
We already don't support incredibly-broken nameservers like the
notorious ones on some home router appliances that drop concurrent A
and AAAA requests. But I don't want this to turn into some kinda big
regression if there are actually still broken setups in the wild.
Can anyone dig up information on whether this is non-issue like I hope
it is? So far I haven't turned up much reliable/recent information
either way.
Rich
reply other threads:[~2020-04-28 3:09 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200428030919.GR11469@brightrain.aerifal.cx \
--to=dalias@libc.org \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).