BIND-DLZ cache corruption issue.

Hey all,

We recently ran into an issue where BIND-DLZ incurred complete cache
corruption due to a single bad entry in our zone.  We had an TXT/SPF record
in our zone that was accidentally set to over 255 characters in length.
 When the record was looked up and cached, BIND apparently read the first
255 bytes of the record and then truncated the rest (including the closing
quote) off.  This had the affect of making the entire cache unusable.
 Symptoms were initial lookups would work with a small delay in the lookup
while cache was checked, however all subsequent requests for cached entries
would not return a result.  This made our DNS completely unusable until the
issue was tracked down.

I know that there should be some sort of check in the data entry/management
application for the zone to validate that records entered in are correct,
however does it not make sense to do some sort of per entry check to make
sure a record is valid prior to accepting and returning a response to the
request.  BIND traditionally checks for these type of issues at startup,
however when utilizing DLZ this startup check is bypassed.  I guess I am
requesting that some form of record/entry checking be added to the code to
prevent issues which might make DNS completely unavailable.

Thoughts?

--M

-- 
Michael J. Ayers
Senior Systems Engineer

------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing.
http://p.sf.net/sfu/novell-sfdev2dev

_______________________________________________
Bind-dlz-testers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers