musl - Re: Resolver routines, Postfix DNSSEC troubles - how to check for incompatibilities?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4524b127ea99b2d1edcd8c91555a9af21e46a9b3.camel@web.de>
Date: Mon, 13 Apr 2020 13:20:49 +0200
From: Christian <list-christian@....de>
To: musl@...ts.openwall.com
Subject: Re: Resolver routines, Postfix DNSSEC troubles - how to
 check for incompatibilities?

Hi again,

So Viktor did some digging:

"The comment on line 25:

https://github.com/runtimejs/musl-libc/blob/master/include/resolv.h#L25

is not encouraging.  It suggests that _res is unused. If so, Postfix
DNS does not work correctly with this C library.  And not just for DANE, since Postfix is also unable to to control RES_DEFNAMES and RES_DNSRCH.

Indeed searching the github repo for RES_USE_DNSSEC and RES_USE_EDNS0
finds hits only the header file, and similarly:

https://raw.githubusercontent.com/runtimejs/musl-libc/master/src/network/res_state.c

pretty much rules out support for configurable lookup options."

and

"The musl-libc resolver code also includes [...]:

https://github.com/runtimejs/musl-libc/blob/master/src/network/__dns.c#L67-L69

So not terribly safe if using a remote resolver. Definitely no support
for EDNS(0) or sending the "DO" or "AD" bits in the request.

Always queries all resolvers in parallel without waiting for a short
timeout from the first one (or use connect(2) for prompt notification of host/port unreachable).

There is no support for truncated responses or TCP failover, so if a
host has enough IP addresses, some may be dropped, and FcRDNS checks may fail spuriously."

I guess this all shows the incompatibility.

Big questions is now: Will/Can this be resolved?

Out of what I can understand it makes Postfix with musl pretty much
unusable, at least less secure (not only because of the lib itself, but
as well as security features, like DANE get crippled without noticing).

Also I am not sure why there are stubs build to "satisfy broken apps"?
An exception would have showed right away that something is not working
and prevented the use.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.