From: Christian <list-christian@web.de>
To: musl@lists.openwall.com
Subject: Re: [musl] Resolver routines, Postfix DNSSEC troubles - how to check for incompatibilities?
Date: Mon, 13 Apr 2020 13:20:49 +0200 [thread overview]
Message-ID: <4524b127ea99b2d1edcd8c91555a9af21e46a9b3.camel@web.de> (raw)
In-Reply-To: <9832107bf742db3145a3960c28cde867f924fe1f.camel@web.de>
Hi again,
So Viktor did some digging:
"The comment on line 25:
https://github.com/runtimejs/musl-libc/blob/master/include/resolv.h#L25
is not encouraging. It suggests that _res is unused. If so, Postfix
DNS does not work correctly with this C library. And not just for DANE, since Postfix is also unable to to control RES_DEFNAMES and RES_DNSRCH.
Indeed searching the github repo for RES_USE_DNSSEC and RES_USE_EDNS0
finds hits only the header file, and similarly:
https://raw.githubusercontent.com/runtimejs/musl-libc/master/src/network/res_state.c
pretty much rules out support for configurable lookup options."
and
"The musl-libc resolver code also includes [...]:
https://github.com/runtimejs/musl-libc/blob/master/src/network/__dns.c#L67-L69
So not terribly safe if using a remote resolver. Definitely no support
for EDNS(0) or sending the "DO" or "AD" bits in the request.
Always queries all resolvers in parallel without waiting for a short
timeout from the first one (or use connect(2) for prompt notification of host/port unreachable).
There is no support for truncated responses or TCP failover, so if a
host has enough IP addresses, some may be dropped, and FcRDNS checks may fail spuriously."
I guess this all shows the incompatibility.
Big questions is now: Will/Can this be resolved?
Out of what I can understand it makes Postfix with musl pretty much
unusable, at least less secure (not only because of the lib itself, but
as well as security features, like DANE get crippled without noticing).
Also I am not sure why there are stubs build to "satisfy broken apps"?
An exception would have showed right away that something is not working
and prevented the use.
next prev parent reply other threads:[~2020-04-13 11:21 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-13 9:25 Christian
2020-04-13 11:20 ` Christian [this message]
2020-04-13 15:29 ` Rich Felker
2020-04-13 15:52 ` Florian Weimer
2020-04-13 16:07 ` Rich Felker
2020-04-13 16:38 ` Rich Felker
2020-04-13 17:51 ` Christian
2020-04-13 18:04 ` Rich Felker
2020-04-14 9:57 ` Florian Weimer
2020-04-14 15:53 ` Rich Felker
2020-04-14 16:54 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4524b127ea99b2d1edcd8c91555a9af21e46a9b3.camel@web.de \
--to=list-christian@web.de \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).