RHEL, Centos, Fedora rpm 9.11.1-P2

2017-06-29 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 http://www.five-ten-sg.com/mapper/bind contains links to the source rpms, and build instructions. -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.14 (GNU/Linux) iEYEAREKAAYFAllVdXcACgkQL6j7milTFsG/SQCggBDFBEwmgOb92nESct8cg3IS gOoAn2KXPunBCbmHxvc

CVE-2017-3142 and CVE-2017-3143 -- TSIG-related BIND vulnerabilities

2017-06-29 Thread Michael McNally
Today ISC announced two significant BIND vulnerabilities (via our bind-announce list -- https://lists.isc.org/mailman/listinfo/bind-announce) They are CVE-2017-3142 and CVE-2017-3143 and both are related to errors in our TSIG support. These are unusual CVEs for BIND -- many of the vulnerabilities

Re: [E] Re: strange problem with query being dropped/ignored by the BIND process

2017-06-29 Thread Marc Richer
Hi Bob, > I tend to distrust "CPU(30%)" if it is averaged over more than one > cpu. Could you run "top" and hit the number "1" so that it shows each > cpu separately? With 8 cpu's, "30%" could be one cpu at 100% and others > lower, where the one cpu at 100% is your bottleneck. I checked that w

Re: strange problem with query being dropped/ignored by the BIND process

2017-06-29 Thread Bob Harold
On Thu, Jun 29, 2017 at 9:51 AM, Marc Richter wrote: > Hi Dennis, > > > Do you have any adjustments in /etc/system ? > > No. And as mentioned before this is a Solaris 11 system, so /etc/system is > (mostly) irrelevant, as the IP settings are all done with ipadm now. > > > > > # ndd -get /dev/ip \

Re: RPZ zone name label length limit

2017-06-29 Thread Jim Yang
Hi Mukund, Yes, I will send the report with a sample RPZ zone that contains the name to bind-b...@isc.org. Thanks, Jim On 6/29/17, 2:40 PM, "Mukund Sivaraman" wrote: Hi Jim On Thu, Jun 29, 2017 at 01:57:16PM +, Jim Yang wrote: > Hi, > > What is the DNS name label

Re: RPZ zone name label length limit

2017-06-29 Thread Mukund Sivaraman
Hi Jim On Thu, Jun 29, 2017 at 01:57:16PM +, Jim Yang wrote: > Hi, > > What is the DNS name label length limit? As per RFC 1035, it is 63 > characters. I tested a few DNS names that contains a label that is > longer than 63 characters, and found that these records were > successfully loaded

Re: RPZ zone name label length limit

2017-06-29 Thread Tony Finch
Jim Yang wrote: > > What is the DNS name label length limit? As per RFC 1035, it is 63 > characters. I tested a few DNS names that contains a label that is > longer than 63 characters, and found that these records were > successfully loaded in RPZ zone. On the wire the length limit is 63. In pre

RPZ zone name label length limit

2017-06-29 Thread Jim Yang
Hi, What is the DNS name label length limit? As per RFC 1035, it is 63 characters. I tested a few DNS names that contains a label that is longer than 63 characters, and found that these records were successfully loaded in RPZ zone. I wonder if this is a BIND RPZ feature or bug (it allows DNS n

Re: strange problem with query being dropped/ignored by the BIND process

2017-06-29 Thread Marc Richter
Hi Dennis, > Do you have any adjustments in /etc/system ? No. And as mentioned before this is a Solaris 11 system, so /etc/system is (mostly) irrelevant, as the IP settings are all done with ipadm now. > > # ndd -get /dev/ip \? | grep "read" > # ndd -get /dev/tcp \? | grep "read" > That, as w

Re: strange problem with query being dropped/ignored by the BIND process

2017-06-29 Thread Dennis Clarke
On 06/29/2017 12:52 PM, Marc Richter wrote: Hi again, I have checked this again today. Send & receive buffers are both 1MB, the Server has 8 CPUs and during startup BIND is reporting this: found 8 CPUs, using 8 worker threads using 7 UDP listeners per interface using up

Re: strange problem with query being dropped/ignored by the BIND process

2017-06-29 Thread Marc Richter
Hi again, I have checked this again today. Send & receive buffers are both 1MB, the Server has 8 CPUs and during startup BIND is reporting this: found 8 CPUs, using 8 worker threads using 7 UDP listeners per interface using up to 32768 sockets We only have about 1.500 qu