It is nice to see that we are moving from huge and clumsy DNS servers (BIND) to smaller servers with a specific focus: unbound as resolver, NSD/Yadifa for authoritative servers.
Now that we have them, couldn't some core code be shared between all these projects and receive more scrutiny than it receives now? For example the code that parses incoming packets or generates replies could easily be shared (in theory).
I'm no fan of BIND though operationally having separate servers can be problematic: if you want to run both a recursive and an authoritative DNS server on the same host (pretty common for DNS servers on internal networks) you need two IP addresses. PowerDNS works around this by having their authoritative server forward recursive queries to a host/port that you specify.
Agreed that code sharing would be nice, and more important than ever since the rise of small servers with specific focus.
Re:Yadifa, new name server by .eu
by rhubarbquid on Monday July 02, 2012 @10:49PM
(#4192261)
> couldn't some core code be shared between all these projects
There are also advantages to having independent implementations for such crucial software. A fatal flaw that no one caught in one implementation may not take out the whole system.
While this is true for bigger design issues, I fear it is not true for smaller problems like off-by-one accesses and all the common parsing issues.
Smaller problems require a lot of time, attention and testing to be found. To have a single code base can do wonder for this kind of smaller, but often fatal, problems.
Agreed - but it seems that this is an authoritative-only name server, which means it shouldn't be susceptible to cache poisoning, which is where the most awful DNS server security vulnerabilities have been.