mailing list of musl libc
 help / color / mirror / code / Atom feed
From: Florian Weimer <fw@deneb.enyo.de>
To: musl@lists.openwall.com
Subject: Re: [musl] TCP support in the stub resolver
Date: Sun, 03 May 2020 10:46:55 +0200	[thread overview]
Message-ID: <874ksxmmm8.fsf@mid.deneb.enyo.de> (raw)
In-Reply-To: <CAGxPR-_nqn7cLd_2Qk_NbN+giTyDZBKR6mPqQZLgxASEAebTNw@mail.gmail.com> (Bartosz Brachaczek's message of "Sun, 3 May 2020 00:52:22 +0200")

* Bartosz Brachaczek:

> On Sat, May 2, 2020 at 5:44 PM Rich Felker <dalias@libc.org> wrote:
>
>> On Sat, May 02, 2020 at 05:28:48PM +0200, Florian Weimer wrote:
>> > * Rich Felker:
>> >
>> > > On Tue, Apr 21, 2020 at 07:26:08PM +0200, Florian Weimer wrote:
>> > >> * Rich Felker:
>> > >>
>> > >> >> I'm excited that Fedora plans to add a local caching resolver by
>> > >> >> default.  It will help with a lot of these issues.
>> > >> >
>> > >> > That's great news! Will it be DNSSEC-enforcing by default?
>> > >>
>> > >> No.  It is currently not even DNSSEC-aware, in the sense that you
>> > >> can't get any DNSSEC data from it.  That's the sad part.
>> > >
>> > > That's really disappointing. Why? Both systemd-resolved and dnsmasq,
>> > > the two reasonable (well, reasonable for distros using systemd already
>> > > in the systemd-resolved case :) options for this, support DNSSEC fully
>> > > as I understand it. Is it just being turned off by default because of
>> > > risk of breaking things, or is some other implementation that lacks
>> > > DNSSEC being used?
>> >
>> > It's systemd-resolved.  As far as I can tell, it does not provide
>> > DNSSEC data on the DNS client interface.
>>
>> According to this it does:
>>
>> https://wiki.archlinux.org/index.php/Systemd-resolved#DNSSEC
>>
>> However it's subject to downgrade attacks unless you edit a config
>> file. Note that the example shows:
>>
>>     ....
>>     -- Data is authenticated: yes
>>
>> so it looks like it's setting the AD bit like it should.
>>
>
> Relevant info:
> https://fedoraproject.org/wiki/Changes/systemd-resolved#DNSSEC

This section talks about DNSSEC validation.  As far as I can tell,
running systemd-resolved as the stub resolver prevents applications
from accessing DNSSEC data and doing their own validation (or just
looking add DNSSEC record types), independently of how
systemd-resolved is built and configured.

  reply	other threads:[~2020-05-03  8:47 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <fce05ab0ed102dec10e4163dd4ce5d8095d2ffd7.camel@web.de>
     [not found] ` <20200412211807.GC41308@straasha.imrryr.org>
     [not found]   ` <d64b1b8801cc5350e9d27dd109dd2446e7d4b860.camel@web.de>
     [not found]     ` <20200413024746.GD41308@straasha.imrryr.org>
     [not found]       ` <b38668e94b2781003a14c6dca3d41edf33e347e2.camel@web.de>
     [not found]         ` <A2FE67B5-A9A9-4A0F-A59D-78FF2AB992B7@dukhovni.org>
     [not found]           ` <f79a9f0c369607fc38bef06fec521eaf3ab23d8c.camel@web.de>
     [not found]             ` <6E8A9D4F-18CE-4ADA-A5B4-D14DB30C99E5@dukhovni.org>
     [not found]               ` <25e70f31f0c4629f7a7d3957649d08be06144067.camel@web.de>
     [not found]                 ` <CECAFB36-DA1B-4EFB-ACD1-294E3B121B2E@dukhovni.org>
2020-04-13 18:35                   ` [musl] Re: Outgoing DANE not working Rich Felker
     [not found]                     ` <20200413190412.GF41308@straasha.imrryr.org>
     [not found]                       ` <20200413193505.GY11469@brightrain.aerifal.cx>
     [not found]                         ` <20200413214138.GG41308@straasha.imrryr.org>
     [not found]                           ` <20200414035303.GZ11469@brightrain.aerifal.cx>
     [not found]                             ` <87v9m0hdjk.fsf@mid.deneb.enyo.de>
     [not found]                               ` <20200415180149.GH11469@brightrain.aerifal.cx>
     [not found]                                 ` <87imi0haf7.fsf@mid.deneb.enyo.de>
     [not found]                                   ` <20200417034059.GF11469@brightrain.aerifal.cx>
     [not found]                                     ` <878siucvqd.fsf@mid.deneb.enyo.de>
2020-04-17 16:07                                       ` Rich Felker
2020-04-18 17:14                                         ` [musl] TCP support in the stub resolver (was: Re: Outgoing DANE not working) Florian Weimer
2020-04-19  0:03                                           ` Rich Felker
2020-04-19  8:12                                             ` [musl] TCP support in the stub resolver Florian Weimer
2020-04-20  1:24                                               ` Rich Felker
2020-04-20  6:26                                                 ` Florian Weimer
2020-04-20 17:39                                                   ` Rich Felker
2020-04-21  9:48                                                     ` Florian Weimer
2020-04-21 15:02                                                       ` Rich Felker
2020-04-21 17:26                                                         ` Florian Weimer
2020-05-01 22:02                                                           ` Rich Felker
2020-05-02 15:28                                                             ` Florian Weimer
2020-05-02 15:44                                                               ` Rich Felker
2020-05-02 22:52                                                                 ` Bartosz Brachaczek
2020-05-03  8:46                                                                   ` Florian Weimer [this message]
2020-05-03 16:51                                                                     ` Rich Felker
2020-05-03 17:19                                                                       ` Florian Weimer
2020-05-03 18:18                                                                 ` Florian Weimer
2020-05-03 19:09                                                                   ` Rich Felker
2020-05-03 19:34                                                                     ` Florian Weimer
2020-05-03 19:45                                                                       ` Rich Felker
     [not found]                             ` <20200414061620.GI41308@straasha.imrryr.org>
     [not found]                               ` <20200414160641.GC11469@brightrain.aerifal.cx>
     [not found]                                 ` <20200414215951.GJ41308@straasha.imrryr.org>
2020-05-19  1:37                                   ` [musl] Re: Outgoing DANE not working Rich Felker
     [not found]                                     ` <20200519023814.GN68966@straasha.imrryr.org>
2020-05-19  5:44                                       ` Rich Felker
     [not found]                                         ` <20200519090610.GO68966@straasha.imrryr.org>
2020-05-19 14:00                                           ` Rich Felker
2020-05-19 14:23                                             ` Wietse Venema
2020-05-19 14:28                                               ` Rich Felker

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=874ksxmmm8.fsf@mid.deneb.enyo.de \
    --to=fw@deneb.enyo.de \
    --cc=musl@lists.openwall.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.vuxu.org/mirror/musl/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).