Re: dns.c modification patch for getting TLSA RR records

Erwin Hoffmann <[email protected]> Sat, 26 May 2018 15:09:11 +0200

Newsgroups	gmane.mail.qmail.general
Message-ID	<[email protected]>

Hi Manvendra,

thanks for the interesting patch and your ever supporting work ;-)

"4. In the course of writing, discovered and fixed an extremely
  minor memory leak in dns_mxip(). How did djb miss it?"

Code in dns.c:

 42 - if (!nummx) return dns_ip(ia,sa); /* e.g., CNAME -> A */
 43 + if (!nummx) {
 44 +  alloc_free(mx); /*- how did djb forget to free this in original qmail-1.03?. Proves that he is a mortal */
 45 +  return dns_ip(ia,sa); /* e.g., CNAME -> A */
 46 + }


Hm. I don't think it is a real problem here: qmail-remote has finished it's job and mail will be delivered (or not). In this case, the qmail-remote process is decommissioned and the OS will free the memory it has given anyway.

In my qmail-smtpd and regarding the SPF piece I also did not clean up the allocated memory. It will be freed whatsoever. Maybe that should be considered 'bad style', but on the other hand, it saves some CPU cycles. Of course, considering long-running daemons this is a different story.

---

Apart from that: The use of TLSA records (and perhaps CAA) together with CurveDNS (given it's lookup) is certainly as 'safe' as with DNSSEC, though the RFC just require the later.

Regards.
--eh.


> Am 26.05.2018 um 13:46 schrieb Manvendra Bhangui <[email protected]>:
> 
> https://sourceforge.net/projects/indimail/files/netqmail-addons/tlsarr.patch.gz

Dr. Erwin Hoffmann | FEHCom | http://www.fehcom.de | PGP Key-Id 7E4034BE

signature.asc (application/pgp-signature, 833 B)