Re: "djbdns and nxdspecial patch"

On Sat, Apr 24, 2010 at 07:40:52PM -0500, Mark Johnson wrote:
> Date: Sat, 24 Apr 2010 19:40:52 -0500
> From: Mark Johnson <[email protected]>
> Subject: Re: "djbdns and nxdspecial patch"
> To: [email protected]
> 
> On Sat, Apr 24, 2010 at 12:27 PM, Marco <[email protected]> wrote:
> > On Fri, Apr 23, 2010 at 08:48:33PM -0500, Mark Johnson wrote:
> >> Jeff King has an updated version of his query merging patch:
> >>
> >> http://marc.info/?l=djbdns&m=123859517723684&w=1
> >>
> >> Be aware of the possible performance impact:
> >>
> >> http://marc.info/?l=djbdns&m=124047690620137&w=1
> >
> > mmm, this argument is more complex for me and I do not understand....
> 
> Unless you expect your dnscache instance to be answering over a
> thousand queries per second, don't worry about it.
> 
> >> http://sourceforge.net/projects/zinq
> > Ok, but zinq-djbdns integrates all importants security patch? It seem a
> > very good project!!!
> 
> There are two known djbdns vulnerabillities: CVE-2008-4392 and
> CVE-2009-0858.  Patches for both are included in zinq-djbdns:
> 
>   http://sourceforge.net/project/shownotes.php?release_id=686089
> 
> Keep in mind, there are other djbdns forks:
> 
>   http://linuxmafia.com/faq/Network_Other/dns-servers.html#djbdns
zinq is my choice....
> 
> FYI, I don't think dbndns ever merged in all of Jeff King's patches
> for CVE-2008-4392 (query merging).  I believe the maintainer, Gerrit
> Pape, preferred a different solution.
> 
> >> I might see if I can extract that out of some of the patches that
> >> include it and get it to apply to zinq-djbdns.  I don't know that I'd
> >> merge it in and ship it, but that might give you what you're looking
> >> for.
> >
> > ... if yes , I will try to install zinq hoping in future it can do also
> > a functionality like nxdspecial patch.
> 
> Well, I don't know that would ever be included in a release, but if I
> did anything, it would at least be a patch against zinq-djbdns that
> would apply cleanly.  I'll try and take a look at that this weekend.

I wait with hope....