MESSAGE
| DATE | 2016-02-21 |
| FROM | Rick Moen
|
| SUBJECT | Re: [Hangout-NYLXS] security with glibc and gethostbyname
|
Quoting Ruben Safir (ruben-at-mrbrklyn.com):
> On 02/21/2016 01:52 AM, Rick Moen wrote:
> > (Wouldn't it be nice if glibc were no longer
> > using BIND8 spaghetti code?)
>
> clarify please
OK, no problem. You probably know that glibc is not a single library
but rather a bundle of related libraries. Sure, you get libc-2.*.so
(say), but also you get ld-*.so and ld-lunux-*.so (the dynamic linker),
a bunch of libnss_*-2.*.so libs, libpthread-2.*.so, libutil-2.*.so, and
a number of others.
Among those others is libresolv-2.*.so. This is what is called a 'stub
DNS resolver library. 'A stub resolver is a minimal resolver which will
only work with a DNS (an area resolver) that does support recursive
queries, specifically stub-resolvers cannot follow referrals.'
(quoting http://www.zytrax.com/books/dns/apa/resolver.html) (libresolv-2.*.so
is the C library's basic glue for default host-internal handling of DNS
queries from application software. This is the network library for which
/etc/resolv.conf is a configuration file.
The problem is that libresolv is a dreadful, buggy piece of code for the
simple reason that it was abstracted from one of the worst pieces of
1990s spaghetti code in general use, BIND8.
You can minimise the damage by putting 127.0.0.1 (or ::1) as the first
entry in /etc/resolv.conf, and deploy a decent recursive nameserver like
Unbound as the system nameserver daemon. But, honetly, libresolv is
junk, and ought to be scrapped in favour of something better.
Once upon a time, there was a project at ISC to create something called
lwres, a 'lightweight resolver' that could then be hooked in via special
directives in resolv.conf and nsswitch.conf, but it was orphaned in an
incomplete state about a decade ago.
_______________________________________________
hangout mailing list
hangout-at-nylxs.com
http://www.nylxs.com/
|
|
