Please correct http://linuxmafia.com/faq/Network_Other/dns-servers.html

On Sat, Apr 24, 2010 at 07:40:52PM -0500, Mark Johnson wrote:
> Keep in mind, there are other djbdns forks:
> 
>   http://linuxmafia.com/faq/Network_Other/dns-servers.html#djbdns
> 
> FYI, I don't think dbndns ever merged in all of Jeff King's patches
> for CVE-2008-4392 (query merging).  I believe the maintainer, Gerrit
> Pape, preferred a different solution.

Hi Rick,

there's wrong information about the Debian djbdns and dbndns packages
published through your web page

 http://linuxmafia.com/faq/Network_Other/dns-servers.html

Please see my comments below and fix the web page for those who don't
follow the link to the Debian package sources, and so don't discover the
errors in your web page.

http://linuxmafia.com/faq/Network_Other/dns-servers.html states:
> Debian djbdns/dbndns: (link) Debian developer Gerrit Pape maintains two
> Debian binary packages (dbndns, djbdns) based on one Debian source
> package (djbdns). Pape applies these changes to Bernstein's v. 1.05:
> 
> In both binary packages "djbdns" and "dbndns":
> Supplied manpages (by Gerrit Pape).

Okay.

> Patched to use glibc, system errno.h headers.

No, the packages simply follow upstream's installation instructions, and
do "echo 'gcc -O2 -g -include /usr/include/errno.h' >conf-cc" before
running "make".

> Patched dnscache to update obsolete root nameservers list.

No, there's no such patch.  The packages adjust /etc/dnsroots.global, no
changes to dnscache are applied.

> Patched to support parallel build through "make -j".

No, I don't know about such a patch.

> Patched to install binaries into /usr/bin.

No, the packages simply do "echo /usr >conf-home" before running "make".

> Patched to no longer require daemontools, ucspi-tcp.

Not at all, I wouldn't do that.  Quite the opposite, when installing the
packages on Debian, daemontools and ucspi-tcp will be installed
automatically by default.  Additionally there's a package dnscache-run
that conveniently sets up a dnscache service listening on 127.0.0.1:53,
using daemontools.

> Patched dnscache to update obsolete root nameservers list.

DUP!

> Patched axfrdns and tinydns to correct a security-damaging bug in
> large-packet TCP data handling that permits a limited form of cache
> poisoning.

I don't grasp this, axfrdns and tinydns aren't caches.

If you mean http://article.gmane.org/gmane.network.djbdns/13864, yes, I
include this patch recommended by the upstream author in both packages.
If not, no, I don't know about such a patch.

> Patched dnscache to set initial cache size to 1*10^9 bytes, and triple
> the upstream code's cache limit to 3*10^9 bytes.

No, I don't know about such a patch.

> Applied to binary package "dbndns" only:
> Patched tinydns to add native IPV6 support.

+ Patched to allow a maximum of 20 concurrent outgoing SOA queries

But I'll possibly remove the patch again, it was created to convince the
Debian security team, but that failed.

Thanks, Gerrit.