mailing list of musl libc
 help / color / Atom feed
* [musl] AD bit in outgoing DNS queries
@ 2020-04-28  3:09 Rich Felker
  0 siblings, 0 replies; only message in thread
From: Rich Felker @ 2020-04-28  3:09 UTC (permalink / raw)
  To: musl

In order to obtain information on whether the result is in a DNSSEC
signed zone, which is needed for some applications including
RFC-conforming use of DANE records, the AD bit must be set in the
outgoing DNS query, indicating support by the client.

musl's resolver library does not presently set the AD bit, and
historically (~5+ years ago) at least there were compatibility
problems with broken nameservers/firewalls/etc. failing to reply or
dropping packets if it was set. I'd really really like to just set it
unconditionally, since it's the modern, resonable, Right Thing to do,
and since making it configurable/stateful is nasty -- depending on how
you do it, it turns into either a:

- layer violation, if config affects res_mkquery rather than just
  res_query, or a

- least-surprise violation, if config only affects res_send and causes
  it to rewrite the header bits of the query at send-time.

We already don't support incredibly-broken nameservers like the
notorious ones on some home router appliances that drop concurrent A
and AAAA requests. But I don't want this to turn into some kinda big
regression if there are actually still broken setups in the wild.

Can anyone dig up information on whether this is non-issue like I hope
it is? So far I haven't turned up much reliable/recent information
either way.


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-28  3:09 [musl] AD bit in outgoing DNS queries Rich Felker

mailing list of musl libc

Archives are clonable: git clone --mirror

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone