Re: "djbdns and nxdspecial patch"

On Sat, Apr 24, 2010 at 12:27 PM, Marco <[email protected]> wrote:
> On Fri, Apr 23, 2010 at 08:48:33PM -0500, Mark Johnson wrote:
>> Jeff King has an updated version of his query merging patch:
>>
>> http://marc.info/?l=djbdns&m=123859517723684&w=1
>>
>> Be aware of the possible performance impact:
>>
>> http://marc.info/?l=djbdns&m=124047690620137&w=1
>
> mmm, this argument is more complex for me and I do not understand....

Unless you expect your dnscache instance to be answering over a
thousand queries per second, don't worry about it.

>> http://sourceforge.net/projects/zinq
> Ok, but zinq-djbdns integrates all importants security patch? It seem a
> very good project!!!

There are two known djbdns vulnerabillities: CVE-2008-4392 and
CVE-2009-0858.  Patches for both are included in zinq-djbdns:

  http://sourceforge.net/project/shownotes.php?release_id=686089

Keep in mind, there are other djbdns forks:

  http://linuxmafia.com/faq/Network_Other/dns-servers.html#djbdns

FYI, I don't think dbndns ever merged in all of Jeff King's patches
for CVE-2008-4392 (query merging).  I believe the maintainer, Gerrit
Pape, preferred a different solution.

>> I might see if I can extract that out of some of the patches that
>> include it and get it to apply to zinq-djbdns.  I don't know that I'd
>> merge it in and ship it, but that might give you what you're looking
>> for.
>
> ... if yes , I will try to install zinq hoping in future it can do also
> a functionality like nxdspecial patch.

Well, I don't know that would ever be included in a release, but if I
did anything, it would at least be a patch against zinq-djbdns that
would apply cleanly.  I'll try and take a look at that this weekend.