I don't know if you're aware of this or not, but when implementing standards with dozens of haphazard extensions, often the best way to keep track of all of the extensions is via the IANA assignments (see http://www.iana.org/protocols). For DNS, the main page seems to be here: http://www.iana.org/assignments/dns-parameters/dns-parameter...
A year of Rust and DNS
21–30 of 109 posts
Re: A year of Rust and DNS
#22Love the idea of reimplementing DNS in Rust. Would love to see more efforts like this so that we have secure-by-design language implementation of core security services. But BIND isn't just failing because "it's written in C", it's failing because it's written in terrible C. That said, "terrible C" is probably most every C routine written by someone with less than 10 years of solid low level experience, so "writing g…
> But BIND isn't just failing because "it's written in C", it's failing because it's written in terrible C.
Yup. This has been the case for virtually all of the "core" open-source C projects I've opened up the covers on. In particular, bash's code base is terrifying. The more I look, the more I believe that nearly everything we build on top of needs to be thrown out and rewritten with a safer language (e.g., Rust) and with a focus on incorporating software development best practices we've learned since the past forty years.
Re: A year of Rust and DNS
#23Great post, great library. I used it in a CloudFlare dynamic dns client I wrote to play around with Rust. I'm still very new to Rust so these sorts of post are really helpful. Thank you bluejekyll!
Re: A year of Rust and DNS
#24Earlier quoted context omitted.
I thought DJB generally donates his code to the public domain. Hard to be "friendlier" than that.
Public domain code is actually illegal in some places, if I recall correctly
Not quite. As legal explained to me -- it's too legally ambiguous for some entities to feel comfortable using because your only fall back on public domain is copyright, which can be overly restrictive, and the usage rights are undefined and enforcement or rights can be applied or modified at will by the copyright holder in the absence of a clear license. And that copyright, even in the public domain, often exists inherently.
That's not an issue for me at my $corporation because they are sane, but apparently that's the argument.
Re: A year of Rust and DNS
#25Earlier quoted context omitted.
I thought DJB generally donates his code to the public domain. Hard to be "friendlier" than that.
Public domain code is actually illegal in some places, if I recall correctly
No illegal per se, would be closer to say it's undefined or that it has no value. IIRC Germany doesn't allow you to disclaim your copyright. A CC0 dedication is probably the best option for a portable public domain option.
Re: A year of Rust and DNS
#26much more fun to write in scala: https://github.com/MasseGuillaume/Scala-DNS/tree/master/src/...
Re: A year of Rust and DNS
#27Love the idea of reimplementing DNS in Rust. Would love to see more efforts like this so that we have secure-by-design language implementation of core security services. But BIND isn't just failing because "it's written in C", it's failing because it's written in terrible C. That said, "terrible C" is probably most every C routine written by someone with less than 10 years of solid low level experience, so "writing g…
> DJBDNS hasn't been updated in some time, so a more modern project isn't a bad idea.
How so? If it ain't broke...
Re: A year of Rust and DNS
#28Love the idea of reimplementing DNS in Rust. Would love to see more efforts like this so that we have secure-by-design language implementation of core security services. But BIND isn't just failing because "it's written in C", it's failing because it's written in terrible C. That said, "terrible C" is probably most every C routine written by someone with less than 10 years of solid low level experience, so "writing g…
The generalizations about the quality of C code is interesting...It is easy to criticize code that has been developed over years, multiple hands, etc.
C code doesn't have to be terrible. And "terrible" often is in the eye of the beholder.
I've heard people decry OpenSSL and it's various warts (it has many), but as a code base, it's worked well for years across an incredible range of platforms.
Some claim the architecture and quality is crap (often, it's more about style), some just know that's how it was developed and stick to the style and extend / fix / etc. A lot of the OpenSSL issues stem from the wide range of use and the lack of giveback by companies working with it (including donations, etc. This goes back nearly 15+ years).
A new and hot language does not make a new implementation any more secure (maybe it has different issues) than one that has been around awhile, had multiple eyes, etc.
Re: A year of Rust and DNS
#29Great article.
>Implementing rfc1035 was deceivingly easy
This stuck out to me - RFC1035 is the first RFC I've read all the way through and had a shot at implementing. Then you realise it's RFCs all the way down and there's no easy way to navigate through all the overridden / deprecated parts.
Re: A year of Rust and DNS
#30With Ironsides, that makes at least two of you using safest languages you can find to try to improve DNS. Good goal and tool to pick. :) http://ironsides.martincarlisle.com/ "Take a look at the full list sometime, I think roughly 50% of those could have been avoided by using (safe) Rust." This is true for most vulnerabilities I see in C-related apps. We also know there's techniques to prevent that with acceptable per…
> With Ironsides, that makes at least two of you using safest languages you can find to try to improve DNS I looked at that a while ago, I should take another. Thanks for pointing that out. > I think one of most valuable things you could do in this project is create a single specification of various things in DNS that cites parts of RFC's or advice from real-world implementations to justify each part. Kind of a walkt…
Happy to help with that (although I've uttered that phrase way too much this month). I've got a toy DNS server and I also hit the problem of specs not matching reality (whoda-thunkit).
Wireshark's DNS dissector is exceptionally useful here.
I agree that it's a project in and of itself.