Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A year of Rust and DNS

bluejekyll.github.io

Post reply on HN
Print view View original

51–60 of 109 posts

Re: A year of Rust and DNS

#51

Post by pjmlp »

yitchelle wrote: post #50
pjmlp wrote: post #46

Earlier quoted context omitted.

No, because some languages make it easier to deal with developers as if they were cogs (even if I hate how things are nowadays). For example, the use of automatic memory management or bounds checking, not only allows to remove an whole class of errors they remove the need to have a deep understanding of memory allocation patterns in the code. Similarly the way one can make use of strong type definitions like in Ada,…

Perhaps, but being a cog in the software team at entreprise level does not preclude problems such as understanding the design decisions made or system limitations that are placed on the software design etc. Sometimes the inscalabity of a design is language independent. The problems are probably emphasised when consultants are engaged to do the job.

I agree, just making the point that languages like Ada or Haskell also have features that make certain types of errors impossible in such scenarios.

Of course there are other types of errors that they still cannot avoid.

Re: A year of Rust and DNS

#52

Post by nly »

voltagex_ wrote: post #29

Great article. >Implementing rfc1035 was deceivingly easy This stuck out to me - RFC1035 is the first RFC I've read all the way through and had a shot at implementing. Then you realise it's RFCs all the way down and there's no easy way to navigate through all the overridden / deprecated parts.

Inded. The old RFCs are just the tip of the iceberg, and in the end you have to pretty much ask "What would BIND do?".

Zone master files are a great example of this. There's no official grammar and so there are subtle differences in the way different DNS servers parse them.

Its also easy to under-estimate and not notice for example, until you've written a lexer or two, that the grammar is context sensitive and ambiguous... so I'd almost guarantee that trust-dns can be made to interpret one differently to BIND, Knot, or unbound.

Re: A year of Rust and DNS

#54

Post by Matthias247 »

DigitalJack wrote: post #17

Just curious. Is this the normal way: let recursion_available = (0b1000_0000 & r_z_ad_cd_rcod) == 0b1000_0000 That just seems redundant. If you declared the var as a Boolean, would the == 0bxxxx part have been necessary?

It could be replaced with != 0. But an implicit conversion from integer to boolean like in C is not possible.

Re: A year of Rust and DNS

#55

Post by fractalb »

kbenson wrote: post #33
jmspring wrote: post #28

Earlier quoted context omitted.

The generalizations about the quality of C code is interesting...It is easy to criticize code that has been developed over years, multiple hands, etc. C code doesn't have to be terrible. And "terrible" often is in the eye of the beholder. I've heard people decry OpenSSL and it's various warts (it has many), but as a code base, it's worked well for years across an incredible range of platforms. Some claim the architec…

> I've heard people decry OpenSSL and it's various warts (it has many), but as a code base, it's worked well for years across an incredible range of platforms. That... really depends on what you consider "worked well". Being a cryptography library, I think I could make a strong argument that working well includes a very good track record with regard to exploits. I don't believe OpenSSL exhibits that[1]. Note the numb…

> I suspect that the vast majority of people would take a 50% performance hit if it yielded a library that had only half as many major flaws as we've seen

How would one know whether there are any major flaws in a code base?

Re: A year of Rust and DNS

#56

Post by yxhuvud »

feld wrote: post #20
bradleyjg wrote: post #7

Earlier quoted context omitted.

I thought DJB generally donates his code to the public domain. Hard to be "friendlier" than that.

Public domain code is actually illegal in some places, if I recall correctly

Here in Sweden, it is not illegal - it is more that there is no legal concept of a public domain which makes any license that try to transfer something to the public domain be nonsense and invalid.

Re: A year of Rust and DNS

#57

Post by [deleted] »

Matthias247 wrote: post #54
DigitalJack wrote: post #17

Just curious. Is this the normal way: let recursion_available = (0b1000_0000 & r_z_ad_cd_rcod) == 0b1000_0000 That just seems redundant. If you declared the var as a Boolean, would the == 0bxxxx part have been necessary?

It could be replaced with != 0. But an implicit conversion from integer to boolean like in C is not possible.

[deleted]

Re: A year of Rust and DNS

#58

Post by [deleted] »

bluejekyll wrote: post #45
cpeterso wrote: post #40

Earlier quoted context omitted.

This seems like a good use case for a bit mask query function. I see Rust has a bitflags crate: https://doc.rust-lang.org/bitflags/bitflags/index.html

I found that after I had already written a lot of that code. I haven't had much reason to go back and change it, but any PR's if someone wants to do it, would be accepted.

[deleted]

Re: A year of Rust and DNS

#59

Post by PandaPedantic »

SomeCallMeTim wrote: post #6

Love the idea of reimplementing DNS in Rust. Would love to see more efforts like this so that we have secure-by-design language implementation of core security services. But BIND isn't just failing because "it's written in C", it's failing because it's written in terrible C. That said, "terrible C" is probably most every C routine written by someone with less than 10 years of solid low level experience, so "writing g…

Well, djb's dns has bugs (zone corruption, lack of duplicate outbound surpression leading to trivial poisoning, query pool flushing) and missing essentials (IPv6, and most DNS since 2007). Some of these bugs were paid out in fact. There are patches, but not everything is fixed, and not all the patches play well together. The lack of maintenance and an upstream has caused some distros to consider dropping for security reasons.

I'd agree the C code is easier to read than Bind's heavy use of macros.

Probably the best part of djb's dns was the source port randomization. The logic was key to responding NS eviction attacks (Kaminsky's attack and its variations).

Re: A year of Rust and DNS

#60

Post by vog »

bluejekyll wrote: post #45
cpeterso wrote: post #40

Earlier quoted context omitted.

This seems like a good use case for a bit mask query function. I see Rust has a bitflags crate: https://doc.rust-lang.org/bitflags/bitflags/index.html

I found that after I had already written a lot of that code. I haven't had much reason to go back and change it, but any PR's if someone wants to do it, would be accepted.

What about simply replacing all "== 0b..." with "!= 0"?

That would already be a good improvement, both in terms of DRY and readability, without the need of adding another dependency.

Post reply on HN