[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAO_RewaaFU=RmDPHNwpaCg=FsoG+dqr4NV-QXY=fAkVYnsS-Jw@mail.gmail.com>
Date: Thu, 22 Oct 2015 14:24:11 -0700
From: Tim Hockin <thockin@...gle.com>
To: musl@...ts.openwall.com
Subject: Re: Would love to see reconsideration for domain and search
Hi all,
I saw this thread on the web archive but am not sure how to respond to
the thread directly as a new joinee of the ML. I hope this finds its
way...
I am one of the developers of Kubernetes and I own the DNS portion, in
particular. I desperately want to use Alpine Linux (based on musl)
but for now I have to warn people NOT to use it because of this issue.
On Fri, Sep 04, 2015 at 02:04:29PM -0400, Rich Felker wrote:
> On Fri, Sep 04, 2015 at 12:11:36PM -0500, Andy Shinn wrote:
>> I'm writing the wonderful musl project today to open discussion
>> about the future possibility of DNS search and domain keyword
>> support. We've been using musl libc (by way of Alpine Linux) for
>> new development of applications as containers that discover each
>> other through DNS and other software defined networking.
>>
>> In particular, we are starting to use applications like SkyDNS,
>> Consul, and Kubernetes, all of which rely on local name
>> resolution in some way using search paths. Many users of the
>> Alpine Linux container image have also expressed their desire for
>> this feature at
>> https://github.com/gliderlabs/docker-alpine/issues/8.
>>
>> On the functional differences between glibc page, the domain and
>> search keyword "Support may be added in the future if there is
>> demand". So please consider this request an addition to whatever
>> demand for the feature already exists.
>>
>> Thank you for your time and great work on the musl libc project!
>
> I think this is a reasonable request. I'll look into it more.
>
> One property I do not want to break is deterministic results, so
> when a search is performed, if any step of the search ends with
> an error rather than a positive or negative result, the whole
> lookup needs to stop and report the error rather than falling
> back. Falling back is not safe and creates a situation where DoS
> can be used to control which results are returned.
I understand your point, though the world at large tends to disagree.
Everyone has a primary and secondary `nameserver` record (or should).
If the first one times out, try the second. Most resolver libs seem
to accept a SERVFAIL response or a timeout as a signal to try the next
server, and I would encourage you to do the same.
Stopping on positive response or NXDOMAIN seems to be commonly
accepted with a caveat. You can't query all nameservers and just take
the first NXDOMAIN to respond. You can only accept NXDOMAIN if all of
the higher-priority (listed first in resolv.conf) nameservers have
timed out or SERVFAIL'ed. You can issue queries in parallel, but you
must process responses in order, which is what you describe below.
> While it would be possible to parallelize the search while
> serializing the results (i.e. waiting to accept a result from the
> second query until the first query finished with a negative
> result), I think the consensus during the last round of
> discussion of this topic was that the complexity cost is too
> great and the benefit too small. Ideally, the first query should
> always succeed, anyway.
The real world is not ideal. Not all nameservers are identically
scoped - you MUST respect the ordering in resolv.conf - to do
otherwise is semantically broken. If implementation simplicity means
literally doing queries in serial, then that is what you should do.
Similarly, you can't just search all search domains in parallel and
take the first response. The ordering is meaningful.
> I also have a few questions:
>
> 1. Do you need multiple search items, or just a single domain?
> Any setup with multiple searches necessarily has suboptimal
> performance because ndots is not sufficient to make the right
> initial choice of query. If you do need this functionality, a
> unioning proxy dns server may be a better option than resolv.conf
> domain search; it would give much better performance.
We use multiple search paths and ndots > 1. I'm not sure what you
mean by "unioning" here. Search path ordering is as meaningful as
nameserver ordering. You can't avoid making the query for each search
suffix in the worst case, and it has the same restriction as
nameserver - the search order must be respected.
There does seem to be some different implementations that search for
the "naked" query first vs last, though. I think the semantically
correct (but pessimal performance) is to search for that last.
> 2. For your intended applications, is there a need to support
> ndots>1? Such configurations are generally not friendly to
> applications that expect to be able to resolve normal internet
> domain lookups, and performance for such lookups will be very bad
> (because the search domains first have to fail).
DNS is a very lightweight protocol. We have not measured any
practical detriment for having 6 search domains and ndots=5. In the
normal case it fails very quickly. That aside, it should be my
business if I want to (mis)configure my system that way :)
> 3. The glibc behavior is just to swap the order of search when
> the query string has >=ndots dots in it, but would it be
> acceptable never to try the search domains at all in this case?
> That would yield much better performance for nxdomain results and
> avoid unexpected positive results due to weird subdomains
> existing in your search domain (e.g. a wildcard for
> *.us.example.com would cause *.us to wrongly resolve for
> non-existant .us domains).
I think that would be correct. If I have 3 dots and ndots=2, search
paths should be ignored.
Tim
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
