Systemd-resolved DNS cache poisoning

Re:Systemd-resolved DNS cache poisoning by amluto on Wednesday November 12, 2014 @10:56AM (#8596073)

I find the design of systemd-resolved to be very strange. It uses dbus to talk to glibc, and it seems to be a new, from-scratch implementation of a DNS resolver. To be clear, I don't really think it matters whether systemd-resolved is under the systemd umbrella, but I do think that the design has a lot of unnecessary NIH syndrome.

It turns out that there's a very well-specified protocol by which clients can ask a local cache on their system to answer DNS queries. That protocol is called DNS :) I don't see why routing something DNS-like over dbus makes any sense in contrast to doing it using DNS itself on port 53.

Fedora is experimenting with running unbound as a local caching resolver [1]. This gives caching, DNSSEC validation, and all the benefits from the fact that unbound is probably much better hardened than the average libc or application-side DNS client implementation.

[1] http://fedoraproject.org/wiki/Features/DNSSEC_on_workstation...

[ Parent | on HN ]

Re:Systemd-resolved DNS cache poisoning by digi_owl on Wednesday November 12, 2014 @06:02PM (#8598858)

Poettering and crew seems to have such a hardon for dbus that they want to get their own variant into the Linux kernel (kdbus).

Hell, i have recently seen a fedora bug regarding the use of su -. Where Poettering argued that people should not use su because it broke dbus.

Instead he seemed to advocate that people ssh into 127.0.0.1 to do their thing with a different account.

[ Parent | on HN ]