[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20200428030919.GR11469@brightrain.aerifal.cx>
Date: Mon, 27 Apr 2020 23:09:19 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: AD bit in outgoing DNS queries
In order to obtain information on whether the result is in a DNSSEC
signed zone, which is needed for some applications including
RFC-conforming use of DANE records, the AD bit must be set in the
outgoing DNS query, indicating support by the client.
musl's resolver library does not presently set the AD bit, and
historically (~5+ years ago) at least there were compatibility
problems with broken nameservers/firewalls/etc. failing to reply or
dropping packets if it was set. I'd really really like to just set it
unconditionally, since it's the modern, resonable, Right Thing to do,
and since making it configurable/stateful is nasty -- depending on how
you do it, it turns into either a:
- layer violation, if config affects res_mkquery rather than just
res_query, or a
- least-surprise violation, if config only affects res_send and causes
it to rewrite the header bits of the query at send-time.
We already don't support incredibly-broken nameservers like the
notorious ones on some home router appliances that drop concurrent A
and AAAA requests. But I don't want this to turn into some kinda big
regression if there are actually still broken setups in the wild.
Can anyone dig up information on whether this is non-issue like I hope
it is? So far I haven't turned up much reliable/recent information
either way.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
