![]() |
|
Message-ID: <Pine.BSM.4.64L.2406231849390.22076@herc.mirbsd.org> Date: Sun, 23 Jun 2024 18:52:54 +0000 (UTC) From: Thorsten Glaser <tg@...bsd.de> To: musl@...ts.openwall.com cc: Jan Mercl <0xjnml@...il.com>, Lance Yang <ioworker0@...il.com> Subject: Re: [PATCH 1/1] improve DNS resolution logic for parallel queries Lance Yang dixit: >I understand your concern that continuing the search after receiving an >NXDOMAIN response might pose a security risk. Will look into this issue It’s not (just) a security risk, it’s how DNS works. NXDOMAIN means “I am a nameserver responsible for resolving your query, and I can state with confidence that the entry you requested does not exist” so no other responsible nameserver’s response can rightly differ. If you need to merge different zones together, the normal method is running a caching nameserver like dnscache from DJBDNS and configuring it to ask specific upstream nameservers for specific zones, for example “echo 192.168.178.1 >/service/dnscache/root/servers/box”, then it will ask the normal root zone for normal requests but for *.box it’ll ask a local Fritz!box instead. bye, //mirabilos -- Solange man keine schmutzigen Tricks macht, und ich meine *wirklich* schmutzige Tricks, wie bei einer doppelt verketteten Liste beide Pointer XORen und in nur einem Word speichern, funktioniert Boehm ganz hervorragend. -- Andreas Bogk über boehm-gc in d.a.s.r
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.