[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+MmhbPij34S1dCdsGTS7nAWf6+gpq1MSLuvnth9eBEfCvFX3A@mail.gmail.com>
Date: Fri, 23 Oct 2015 17:30:32 +0200
From: Jan Broer <jasiu.79@...il.com>
To: musl@...ts.openwall.com
Subject: Re: Re: Would love to see reconsideration for domain and search
A very interesting discussion going on here.
> You can't query all nameservers and just take
> the first NXDOMAIN to respond. You can only accept NXDOMAIN if all of
> the higher-priority (listed first in resolv.conf) nameservers have
> timed out or SERVFAIL'ed. You can issue queries in parallel, but you
> must process responses in order, which is what you describe below.
GNU libc resolver gives priority to the primary nameserver because it
assumes that this is the one with the lowest RTT / highest availability.
This priorization was never understood as meaning that the primary's
servers records are more "authorative" than those of secondary nameservers.
> My view has always been that multiple
> nameservers in resolv.conf are for redundancy, not for serving
> conflicting records.
I agree.
>I have to disagree. Some non-forwarding DNS servers use SERVFAIL to
>indicate "I am not serving for that domain" specifically to make the
>client move to their next nameserver. if ns1 returns SERVFAIL, try
>ns2. If ns1 times out, try ns2. Otherwise what good is ns2?
This kind of result unioning you want from musl-libs isn't even supported
by GNU libc resolver. Yes it works for you - but this is because your DNS
server is breaking DNS RFC specs: SERVFAIL is not a technically legal
response for "I am not serving for that domain". It's just WRONG. When an
authorative server (which the Kubernetes DNS server is) doesn't serve a
specific zone it has to respond with NXDOMAIN. Of course if your server
would follow the rules than that type of result unioning doesn't work
because GNU libc resolver does not failover to secondary servers when the
response is NXDOMAIN.
It's just a weak argument to essentially say: "The GNU libc resolver does
exactly what i want when i point it to my broken DNS server, why can't
musl-libc?".
The bottom line:
Leave nameserver querying logic as it is: Check!
Implement search paths: Check!
Consider ndots option in resolv.conf: Check!
query name <= ndots: search first
query name > ndots : never search
LGTM!
Jan
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
