libc-coord - New options for /etc/resolv.conf, RES

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <8734pgufp0.fsf@oldenburg.str.redhat.com>
Date: Fri, 14 Jun 2024 09:49:31 +0200
From: Florian Weimer <fweimer@...hat.com>
To: libc-coord@...ts.openwall.com
Subject: New options for /etc/resolv.conf, RES_OPTIONS

I posted patches today to add new options to the glibc stub resolver:

* In /etc/resolv.conf and the RES_OPTIONS, option flags can now be
  prefixed with “-” to clear previously set flags.  For example, if
  /etc/resolv.conf contains “options no-aaaa”, a process running with
  the RES_OPTIONS=-no-aaaa environment variable performs AAAA DNS
  queries when the glibc DNS stub resolver is used.

* The DNS stub resolver now supports the strict-error option.  If
  activated, getaddrinfo for the AF_UNSPEC address family (with dual
  A/AAAA DNS lookups) attemps to obtain a A/AAAA response pair from
  another DNS server if one of the responses indicates failure.  Without
  the strict-error option, getaddrinfo returns the A record data it has
  obtained even if the AAAA query failed.  The new strict error mode is
  incompatible with some DNS environments which do not follow the RFCs,
  which is why this mode is not enabled by default.  A future version
  of the library may turn it on by default, however.

<https://inbox.sourceware.org/libc-alpha/cover.1718345824.git.fweimer@redhat.com/>

Regardingg the “-” option negation, I could not find any precedent, so I
had to make up something new.

Regarding strict error processing, Rich Felker said on glibc bug 27929

  Lax stub resolver interpretation of ServFail allows DNSSEC bypass 
  <https://sourceware.org/bugzilla/show_bug.cgi?id=27929>

that this issue is not glibc-specific:

| Multiple other stub resolver implementations were found to have the
| same behavior here.

For other systems that layer things different, ignoring partial failures
in getaddrinfo (or not) may be more usefully controlled by a flag in
/etc/gai.conf.

Thanks,
Florian

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.