Re: djbdns-1.05-ignoreip2.patch
Matthew Dempsky <[email protected]>
| Newsgroups | gmane.network.djbdns |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Apr 30, 2009 at 2:30 PM, Mark Johnson <[email protected]> wrote: > It looks like the only thing zinq-djbdns is missing at the moment > from Jeremy Kister's djbdns-1.05.isp.patch is Russ Nelson's > djbdns-1.05-ignoreip2.patch (If we count checked-into-source-control > as opposed to shipped-in-a-release, anyway). Is there still a need > for the latter nowadays? Anybody using it? I haven't been keeping > tabs on all the sitefinder clones... The way this patch works has some minor unintentional side effects. E.g., if 1.2.3.4 is in ignoreip, dnscache queries for MX foo.com, and the authoritative server returns foo.com MX a.mx.foo.com a.mx.foo.com A 1.2.3.4 the resulting behavior is that dnscache caches an NXDOMAIN for foo.com instead of a.mx.foo.com. I'd be surprised to find a way for an attacker to exploit this, but I would still suggest fixing it before including the patch. That said, is this patch really necessary? Most of the TLDs mentioned in the patch no longer have wildcards, and the ones that still do are using different IP addresses. I don't like the thought of dnscache administrators blacklisting certain IPs that might later change ownership. Obviously the TLD administrators are being obnoxious with their behavior, but it is their domain...