Re: BIND

From: Alexei Polkhanov (usenet_at_monteaureus.com)
Date: 04/27/04


Date: Mon, 26 Apr 2004 18:58:32 -0400

On Mon, 26 Apr 2004 19:36:36 +0000, Lutz Donnerhacke wrote:

> * Warren W. Gay VE3WWG wrote:
>> I think instead, the discussion should be centered on how it
>> can succeed. It is always easier to criticize than to create.
Agree!

50% of success is in good plan!

Requirements, good design - only rest is coding and testing.
I am surprised why this problem was approached from another
end - choice of programming language ??? :)

>
> First: Downsize the goals.
I would merge DHCP and DNS together in a single product. There is several
reasons for that.

> Second: Implement a simple DNS proxy for NS, SOA, A, MX, CNAME and PTR.
Sounds almost trivial.

> Third: Implement authoritive zones.
I suppose support for RDBMS and HUGE ZONES is what we need here. If you
have 2,000,000 record zone it takes 20 min to reload it. BIND has an
"rndc" tool which reloads zone files without restarting whole
thing. When you have such big zone you expect many changes to it too.
This problem needs some speacial approach.

> Fourth: Extent the software to other types namely to IPv6.
IPv6 is would be a small implementation detail, don't make it look like a
major undertaking, AAAA records plus some IPv6/IPv4 migration stuff.

National languages support, special records and extentions which need to
be taken care of. Latest I've heard is an extention for IP Phones.

"www.domain.com" notation is very technical, network - centric, so some
people trying to comeup with more human - readable names, and that going
to be in next versions of BIND. Why I cannot type "Congress Library" but I
have to go and type "dsgdsgf.dsfgdsfg.hfdhdf.gov" ? So most of us ill go
to Google because they cannot remember domain name and then will type it
in browser - why can't we skip this step ?

> Fifth: Rewrite the whole package from scratch to implement DNSSEC.
Yeah! Here is a Huge piece of code which is not the best part of BIND and
sounds like we already have some issues like encryption libraries. Nothing
I know of except thin bindings to OpenSSL.

Also there is TSIG, and SPLIT DNS (when you have all zone records divided
into subsets with different access rules or permissions). Right now this
feature "implemented" by config files hackery and having multiple
instances of BIND running on different machines sharing only parts of zone
records.

> Sixth: Restart this process for the directory protocol used now.
>
> I'd contribute:
> Stream_Text_IO (Basic Text_IO over Ada.Streams.Root_Stream_Type'Class)
> Skip_Stream and Memory_Stream (indexable Stream_Type over Storage_Elements)
> UDP and TCP server handling packages

Would be nice to have this thing working on MOST unix platforms, so sounds
like Florist can be used here...

> Ringbuffer for Queuing
>
> But I can't contribute it to sourcefourge, because I have enought trouble
> developing at work.

Means it also nice to find a _sponsor_ at least for some UNIX hardware and
some network for testbed...

---
Alexei Polkhanov
Sr. Consultant/Software Systems Analyst
Tel: (604) 719-2515
E-mail: usenet@monteaureus.com
http://www.monteaureus.com/


Relevant Pages

  • Re: recursive DNS servers DDoS as a growing DDoS problem
    ... (list of trusted peers who can request your zone files) ... allow-query {locals;}; ... This lets anyone on your network, and others you might trust, full ... Copy the bind config fully so you have two copies. ...
    (Bugtraq)
  • ISC BIND 9.7.0b1 is now available
    ... BIND 9.7.0b1 is the first beta release of BIND 9.7.0. ... Simplified configuration of DNSSEC Lookaside Validation. ... Support for RFC 5011 automated trust anchor maintenance ... simplified tools for zone signing and key ...
    (comp.protocols.dns.bind)
  • Re: [SLE] dynamic DNS updates using nsupdate - which view is updated?
    ... to the same ip network in which they are. ... > My BIND name-server serves two different views depending on the client. ... > The two views both include the same zone, ... If I were to use nsupdate to do dynamic updates of this ...
    (SuSE)
  • Re: [opensuse] Why Bind dies, where is its log file?
    ... I want to debug my system but I am not sure where bind error log file is? ... The following is part of a server howto I put together so I don't have to reinvent the wheel when I install a new server for the office. ... This is my configuration for bind where dhcpd provides dynamic update to the zone files. ...
    (SuSE)
  • BIND 9.6.2b1 is now available.
    ... BIND 9.6.2b1 is a maintenance release for BIND 9.6. ... dnssec-signzone man page. ... for NSEC3 signed zones. ... the NSEC3 parameters used to sign the zone change. ...
    (comp.protocols.dns.bind)