I'm going to talk about something which is not yet DNS because it happens before DNS is executed and who I am. I'm Linux user for some time.
I was the bien passionate at the bien user at the university time, but I am for almost any year's earth
hit or now so I switched in Ferrora and I maintain some packages mostly DNS stuff and I have also become of a high it's kind of related to this.
So what was my motivation?
The pickle application does not use a DNS course directly. It uses a jelipsy library stuff or on Linux. It uses jelipsy.
And that's typical by calling get other info library call.
And their application can specify what others want to use and usually those applications allow also from command line user to specify if they want to limit for something because
functionality sometimes it's needed.
And it's required for link local IPv6 addresses because if you want to connect with those somewhere you have to specify
interface at the address and this is quite a ugly one a long time ago we have sometimes only nips now.
So what do we have on get other info? We have of course name of service we want to resolve.
We specify by name or by number service which we are trying to reach and we can use hints and that's all.
This will be better because it's the same.
We specify hints and there are very important for what I'm talking about because there you specify which kind of others you want.
If you don't care and what every other is which is the most common it should be most common but there are some.
I didn't know thank you for my mark and use from IC.
These was specified during IPv6 edition kind of when I was at university long time ago.
Let's see what we can use there. There are a couple of flags where we can modify something for example.
You can say don't do DNS at all. This is either address or file. We can specify also this is for listening socket not connecting somewhere which is also interesting for me and financially.
There's the other family socket time whether you want TCP or UDP protocol.
I don't know how to use it for anything else than zero and there are of course this is which for hints don't make sense.
So you will even empty which is interesting you also received canonical name which is kind of if you have CNN chain there you can resist the name of a host how it's called the NDS the host itself like final a CNN target and because you can receive multiple addresses.
There is next point and you can receive much more than single address that's fine.
Why I even started looking into this because I was solving the question why often we generate IPv6 Quote address queries when nobody really needs them especially if you are on IPv4.
IPv4 only network and that's unfortunately very common. Why does it ask for IPv6 address how how it will use them because if you got use connect on a list of those addresses you have only failure.
So what's it useful and it seems windows already restricts them somehow and connect OS does it too and we kind of only on Linux request them all the time unless the user specified specific address family which is not the default on any good application.
And this applies also for IPv6 networks that's why we should look into that even though I would like to sometimes have IPv only network like common thing and call IPv4 only network.
A legacy network that's not yet through most of times and I don't have such network available at my work or not my home so.
And the problem is also IPv6 addresses stunning that it doesn't exist when they do break the NSEC that's the problem for me too I would like the NSEC used everywhere.
So what if my machine ask it only queries it actually needs and as I said if you use connect for results from get other info that's that's the way you want.
But if there is any IPv6 out a leading for example leading to VPN connection only and otherwise you don't have any.
Any route you need to start resolving IPv6 addresses too that's where I think failed system years already which had this condition implemented but they kind of checked wrong think I think.
They tested only default route and you should test any route which is not link local or not local has the only address and if you just prevent asking that does not break the NSEC validation because there was no no fake response it's I think that's the correct thing.
So I propose the G ellipsi change by a result of options but the problem with that that's not it match anyway so.
This is the proposal but it doesn't work well on mobile network when condition change very quickly for example here if you have flaky Wi-Fi and connect often disconnect and so on it needs a faster reaction.
Dynamic changes are best handled if you can process them by local service and I started looking what service can we use for that and I unfortunately I don't know much with them.
The problem is get other info how it was defined is stateless so it doesn't even detect an EDNS 0 which is also over 20 years old and you have to specify it explicitly if you want to use it that's a shame.
So and there is a multi q type support which I would like to see there is often some some non support for and for example there are proposed to be used for.
DNS SD by Apple which uses a lot.
But I think it's very useful for AF and spec when when in fact now request always a address and what a address and I think today.
And those are also requesting for every single host name HDDPS address which is nice handling is somehow there is a link if you want to look into what it's not implemented anywhere as far as know that multi q types.
So what we can offer what we can use everything is obsolete it or is system years of this so there are no good choices I know.
So NFCD kind of is exactly this it catches only gyripsics calls and it's obsolete it holds a caching so.
It could be fixed by but I don't know that code system years of the has also own plugin and could be used but at least for me working with system the upstream is kind of difficult and I want to avoid them if I can.
And then I remember I in all times at the year as it I actually configured something called lightweight resolver that is LWRS which is implemented or was implemented in bind until 911 and day unfortunately they drop the support or.
Because at how they implemented I think it indeed did not make much sense but.
There is a problem gyripsid interface how it's specified now does not pass.
Just and there's family and neither can pass flex used when I specify when I show data before so.
It can't direct on those and I think it should be fixed but it's not yet possible.
And that's because this call this is what actual plugin implements and you see here the name here is the where the responses will be put buffer is just for storing message.
A result code and it's interesting here you can see a TTL but that's not exposed anywhere so you can't use it.
For example I think a browser is like far folks need that it year to correctly cache the responses.
This is the structure of the response where you see family kind of where to format a where you can study others here you can store scope ID which you need for a link local resolutions.
And so what what it's needed in my opinion then I think we should send a request from the application to some.
Some service local service which can maintain some state and do EDS 0 auto detection do multi Q type auto detection and we should use unique sockets for that.
Because it offers quite interesting thing not available in original implementation which did not accept queries for over unix domain socket in original code.
Good thing on that is you don't share one port with a whole system so every user can run the all encation service which don't have to collide and then send a.
Forward to one common system service and so on there quite nice possible possible ways we can reuse that so.
I tried to download the code and I did not know at the that moment this was never code by ISE this was some third party it died long ago.
It uses even get hosted by name two which is very long obsolete it specifies only name and there's family host and which is not get added in for it's not it does not contain a for example that scope ID we need for local resolution.
And the kind of asked only for give me or everything you got by the rest family that's not actually what I can use unless I remember very lot of missing stuff which I pan to do but fair to do that so far.
And by 90 level it still had the unix domain support and people from ISE and unfortunately any move that supports from lighter versions because they don't use it for anything.
I would love to heavy the back but I guess I would have to implement it myself and that would took time.
So as I already said LWS never used the unix domain sockets for accepting queries I think that should be the only thing it should be doing and it should not listen on any IP address at all.
It should not do but in a root service emulation and rely on whatever DMS that I was specified in it is here itself called and it was kind of special name the service it was even only simply to name the compile from that.
And I had that one version and why I looked into that is because I still maintain it on era 8 and I kind of know the code so it was better than other alternatives for me.
What is interesting it supports different views including caches it can have separate caches for separate clients and I think that's what we want to use.
All already said that bind has quite an useful cache default for just small service running on machine what's which is a purpose for something different than doing cache for network so it has 90% it uses 90% of RAM on that machine and that's definitely what I don't want to use.
It kind of up to 1% is enough for most of the stuff.
I don't want any DNS ag validation at this service because it should be done by whatever DNS cache running on the same house on or the remote host it doesn't matter.
And it's interesting on something somewhere in Slasharan on sockets stream because that's the best supported variant on all platforms.
And I think it should not require any configuration at all just starting in that that would be.
How looks.
Unix socket and it's kind of very unused and it's not good for anything but what is much more interesting are socket options peer credentials and peer security.
I don't know context or what's the call and I use it for a severe fix for other he first when I played and where I was hit by the thing I did not add that moment and that is it is Linux specific.
It's not implemented the same way on other systems of this is what what can you get from every unix domain client and this is much more interesting than than just name of use socket so you have process ID of process which makes query you have UID or less use group ID but.
The problem is there exists a similar variant from free base D but it's called different way uses different structure kind of we are mostly interested in UID and process ID and we have those groups less obvious kind of one is manual page is different section so it's kind of.
And it has for the grammar.
Should use different structure also we can't use that.
So socket is not useful but what is interesting is who is asking but if we want to look something user friendly we need to do extra call and it can contact remote service which fetches remote from somewhere else so it's not free either and.
Kind of includes some delay which would be unwanted.
But from process ID you can fetch more interesting details like which which what the program asking for example is it being is it cool or is it Firefox is it something else.
And at least on Linux you can fetch C groups which is something system D uses heavy and if you want to be a Linux specific you can get slice which is kind of user slice or system slice or get unit so you can monitor only system be service doing.
By multiple processes different processes and you can watch what's this unit asking for.
For queries and you can do this only by DNS protocol over internet protocol even to local host.
And the great thing is it can be something like option location before your your application even though it's a DNS itself.
And if it can answer from cash it doesn't need any configuration at all.
Except watching yourself because it should rely on that and some core feature would be if you can run the service as user yourself it can watch your own files and you can customize addresses you want.
You can even use some service managing some kind of special records which is not possible now as far as I know and it would be from time to time important for me.
And of course you can use it this for creating block list as an advantage user on the system which I think would be cool also.
And you can use it for watching changes of example so you then don't have to do an action and it should be always up to date.
And I don't think if you know what selenux is or s elenux is is kind of things we use on federal and can stop even a root user process for touching some selected files on something.
And we can use the unix domain sockets to restrict local processes to ask for remote names very similar way because we can ask among other things remote credential.
Okay it's time is up so but I'm kind of finished.
Yeah yeah and it's a you can use it for mnr or mdns request because because that's a protocol a non specific interface anyway so you then have to present something so that's it are there any questions.
There's no time for no time for no solution.