Re: Introducing CurveDNS a DNSCurve forwarding name server

Hi Hauke,

On 24-10-2010 08:15, Hauke Lampe wrote:
> 
> On 23.10.2010 20:14, Harm van Tilborg wrote:
> 
>> We are happy to announce the first forwarding DNSCurve solution: CurveDNS.
> 
> Nice work.
> 
> I installed it on a test server:
> 
> dig curvetest.openchaos.org SOA
> (fwiw, the zone is also DNSSEC-signed, verifiable via dlv.isc.org)

Haven't checked it myself yet, but DNSSEC queries

> 
> I had a problem at first where curvedns would bind the listening ports
> but could not forward UDP queries when not run as root.

curvedns usually binds to port 53 to listen for incoming queries, which
implies root privileges are needed (since port < 1024). After curvedns
has bound itself to that port, it degrades itself to the user that is
specified in the UID and GID environment variables.

> That problem vanished somehow, I don't know why.
> 
> A more serious problem was that curvedns did not select a specific
> outbound address and I need it to do that, so the authoritative
> nameserver responds from the correct view.

I see why this would be handful for people.

> 
> I patched it to use the first local address of matching address family,
> but it would probably be better if the outgoing addresses could be
> configured separately:
> https://www.hauke-lampe.de/linkedstuff/curvedns-0.86-outgoing-addr.patch

I will release a new version that will include a patch similar to this
one (probably tomorrow). However, instead of using one of the listening
addresses, I agree that specifying an address specifically for outgoing
contact with the authoritative name server sounds better. Probably some
environment variable like `CURVEDNS_OUTGOING_SOURCE_IP' will house this
IP address.

Thanks for the patch!

> 
> Ubuntu users find binary and source packages here:
> https://launchpad.net/~hauke/+archive/dnscurve/+packages
> 

Wow, nicely done! I see you have packaged NaCl separately. How did that go?

> 
> 
> Hauke.
> 
> 

-- 
Kind regards,
Harm van Tilborg