Re: [musl] Resolver routines, Postfix DNSSEC troubles - how to check for incompatibilities?

[Florian Weimer <fw@deneb.enyo.de>]

* Rich Felker:

> On Tue, Apr 14, 2020 at 11:57:17AM +0200, Florian Weimer wrote:
>> * Rich Felker:
>> 
>> > On Mon, Apr 13, 2020 at 05:52:34PM +0200, Florian Weimer wrote:
>> >> * Christian:
>> >> 
>> >> > So Viktor did some digging:
>> >> >
>> >> > "The comment on line 25:
>> >> >
>> >> > https://github.com/runtimejs/musl-libc/blob/master/include/resolv.h#L25
>> >> >
>> >> > is not encouraging.  It suggests that _res is unused. If so, Postfix
>> >> > DNS does not work correctly with this C library.  And not just for DANE, since Postfix is also unable to to control RES_DEFNAMES and RES_DNSRCH.
>> >> 
>> >> Are these changes to the RES_DEFNAMES and RES_DNSRCH flags really
>> >> necessary? Why doesn't Postfix use res_query (or perhaps res_send) as
>> >> appropriate?
>> >
>> > But to actually answer these questions, modifying the flags is
>> > presumably because traditional req_query builds an rfc1035 query or
>> > edns query based on these flags derived from from resolv.conf, and
>> > Postfix either assumes or wants to support the case where resolv.conf
>> > is not already configured for edns, perhaps because it was generated
>> > by a dhcp client.
>> 
>> In my comment above, I specifically meant RES_DEFNAMES and RES_DNSRCH.
>> 
>> RES_USE_EDNS0 seems different; I would expect applications to use
>> their own DNS libraries if they need to access DNSSEC data and
>> non-address record types (where there is no benefit gained form
>> integrating with /etc/hosts or other data sources).
>
> Oh. For those it seems to be to suppress search domains, so that when
> looking up the MX or TLSA for example.com it doesn't get records for
> example.com.searchdomain.
>
> I don't know why they poke at flags in _res rather than just appending
> a . to the name, and/or comparting the name in the result to ensure
> that it matches.

It doesn't work when the data doesn't come out of DNS.

> Also res_query is *documented* not to use search domains.

Exactly, that's why I don't understand why changing the flags is
needed.  res_search for searching, res_query for not searching.