From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.4 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: (qmail 11743 invoked from network); 13 Apr 2020 11:21:03 -0000 Received-SPF: pass (mother.openwall.net: domain of lists.openwall.com designates 195.42.179.200 as permitted sender) receiver=inbox.vuxu.org; client-ip=195.42.179.200 envelope-from= Received: from mother.openwall.net (195.42.179.200) by inbox.vuxu.org with UTF8ESMTPZ; 13 Apr 2020 11:21:03 -0000 Received: (qmail 21524 invoked by uid 550); 13 Apr 2020 11:21:01 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 20477 invoked from network); 13 Apr 2020 11:21:01 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=web.de; s=dbaedf251592; t=1586776849; bh=pLCHsnRXqecFHDpwKGir+gNMW+AEs0r0wH3xYSNpRRc=; h=X-UI-Sender-Class:Subject:From:To:Date:In-Reply-To:References; b=NtXp5VItgVf+9XTmr6ojdZA+uC2bQMeTtdiHuTbrK4bQJrEGboiEwuK+kvrWY6hnC v7PHIKDLZQZK6uDL3QtFjfnXnWvG6sYfQC9nWUwhMTW3Gwjv6F+8knFEpL9rHbgf/B PK7eHKJnJTKdqLlysExvD6typF2w3eNFJpZb4SXk= X-UI-Sender-Class: c548c8c5-30a9-4db5-a2e7-cb6cb037b8f9 Message-ID: <4524b127ea99b2d1edcd8c91555a9af21e46a9b3.camel@web.de> From: Christian To: musl@lists.openwall.com Date: Mon, 13 Apr 2020 13:20:49 +0200 In-Reply-To: <9832107bf742db3145a3960c28cde867f924fe1f.camel@web.de> References: <9832107bf742db3145a3960c28cde867f924fe1f.camel@web.de> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.28.5-0ubuntu0.18.04.1 Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:EP0GNIiKqn7ZDDJDWRP5wHQDDHz/UntWWT5VKJS9UutmQssoIoq PEKpSgJ/QPRB2W8G0kQ3As1HiNM080Q5ChoJ57HkYsUNz08gVSrzsBEktRAGegIv9ADkl9Y 4sxbOh1JymCcFaRjpXPogZg+fFBysGSktfghqIjeoDgbOFtUN7gKZo8RaCFkf92TOQMqYwy BaROQlrzqPTYTUadFu8xA== X-UI-Out-Filterresults: notjunk:1;V03:K0:KxLmeOp0hOM=:NmmwWmLAA79498se0kdcff UEy0ADa0J6KbOrfidNDq9zWoxdqW9XM19XawOqA7pWuKcol/i7iuQ8gP8xIvxvtTDKXDwVVL9 O3rc0mMnZYeOnK3/PSSWeDgvIYw7x7ael00SbwfhrWEFQffRfEPkUFXV7HlfWTA7NCFhxq5TE AeH5SIANNdn9h2KDqgw7Ho7sA8ifOvlIxZ4mDaYWcDPXz0U8ezy4/xWcMzeDh8GbJJR1trm0j bR8MPV5AX0EWyUqMEGyw0aXyHfAZ7XDYmCa1LXsPLitXNolqd1RGYm5rrQVG7EKJcWht8xgUd 85zZrCP3xiPZnc7djRcU2eWCvlRY/lboEZoM0xor1rwUpcOtZrn/YAO5p1Us9WyMfOCc7+doY 8gOjHUNzNhzrp10R1eNUpZpt+zIsaChBFSHenVyWc2flGxmH9c9sKvP6AGeX/QUfMPFvDkef2 ZOSeqsKGwIQ8PANh7GYrM9ASGt+it3JkjQ9pb/Xygjss5TMjIbeFWPVwbMbnCwMy7qEn+0bGg OPqNMBXyrqMPJYe+GudvK6+rzwRL0w8xQGpqp2OVGpnkFP7fHFeOmuKXcc+PGa9uBsRmI2a2X sSZxTverm5nto4wG+D+O47TiRSBv9+tuP1kcx5nzEXCYO9BWODrAND1ti067K226irxIibm2A pNHnhqC5m2dIfnXxkMMmpus9Lz8z0OKZgiyxqqeZYaI0KURVFVkO0rnB9nnzo6sngJALpIe0k tN6KLXFGaXL7F5L7fXCa32SS5/VQwSPIenOWd0bSrRyf1nZZDoY4gqM4Gf5NtQHMD0G01LiEg rFjr4gKLZcaPKLu9UtY4y2aICjWTXYjNt/wGjW8SZsP45q+38y5J0xJTCM+8mLEW3TKgM3bsX yjfwGK2b2FrwSDkGcQlw1dMRz8cYvzwjCcx8pkhEscz7FHvR0ik8HcdIiUxB+KeMitd1roCgm ftZPQNy4oEniRLKOInthzisTRnXj/phv9D2KUQFAvPvM2i+Wo111w5CDr1W7dW61db5VDgtxw XGI+Rck0k0TKwWLr+UaS6aFdHrx7apKZ8QZ4zR1F9FiB343Fy0LvMV+pcKYtZRvjsxIHAT6VG nZsvhQlX63kzQenEU8TNNuVSBhJFQs5LsAhEQc1KzE9uCLYdVT9jfXchb42C0qw3ZYt+69xb+ 0t5o7o2rTFoAV9F5mZaLSBNAroh27yQmd0fj+ynJ96Hmajx0agttGC80LtlGEpZvJT9nUJsB2 Yi9JhA0tg4DP6s21v Subject: Re: [musl] Resolver routines, Postfix DNSSEC troubles - how to check for incompatibilities? Hi again, So Viktor did some digging: "The comment on line 25: https://github.com/runtimejs/musl-libc/blob/master/include/resolv.h#L25 is not encouraging. It suggests that _res is unused. If so, Postfix DNS does not work correctly with this C library. And not just for DANE, s= ince Postfix is also unable to to control RES_DEFNAMES and RES_DNSRCH. Indeed searching the github repo for RES_USE_DNSSEC and RES_USE_EDNS0 finds hits only the header file, and similarly: https://raw.githubusercontent.com/runtimejs/musl-libc/master/src/network/r= es_state.c pretty much rules out support for configurable lookup options." and "The musl-libc resolver code also includes [...]: https://github.com/runtimejs/musl-libc/blob/master/src/network/__dns.c#L67= -L69 So not terribly safe if using a remote resolver. Definitely no support for EDNS(0) or sending the "DO" or "AD" bits in the request. Always queries all resolvers in parallel without waiting for a short timeout from the first one (or use connect(2) for prompt notification of h= ost/port unreachable). There is no support for truncated responses or TCP failover, so if a host has enough IP addresses, some may be dropped, and FcRDNS checks may f= ail spuriously." I guess this all shows the incompatibility. Big questions is now: Will/Can this be resolved? Out of what I can understand it makes Postfix with musl pretty much unusable, at least less secure (not only because of the lib itself, but as well as security features, like DANE get crippled without noticing). Also I am not sure why there are stubs build to "satisfy broken apps"? An exception would have showed right away that something is not working and prevented the use.