bind-9-packages: RPS and both '--enable-static' and '--disable-static'?

[James]

Thank you for the https://www.isc.org/blogs/bind-9-packages/ blog post
and various binary distributions mentioned in it.

I am an end user, not a programmer, and I rely on Linux distributions
and application packages and so having up-to-date content from
authoritative sources is both helpful and very reassuring.

As a result of this, I now have the "stable" currently-9.12.2 version
from https://launchpad.net/~isc/+archive/ubuntu/bind installed on Ubuntu
18.04 here on my home desktop in order to hack away at something.

***

And that something is RPS... slight wrinkle: it doesn't seem to be
enabled in this build.

*Question:* Would it cause any problems to enable RPS the next time you
have a reason to kick off a build for this package?

This is not a crisis. However, over on my server, a year ago I learned
how to use Perl to write nfqueue handlers for use with nftables and one
of the things that I put in place was IPv4-and-IPv6 UDP DNS request
filtering with PCRE patterns figuring prominently in the logic.

The scary part is how well it works. 12 months of real-world experience
indicates that well over 99% of those requests that I do want to block
a) arrive on UDP and b) fit into the first packet, and after that it's
the amazing collection of Perl libraries that do all the heavy lifting
so that I just need to glue it together with some pretty ugly script...
but it works!

So I was looking forward to RPS having the effect of adding TCP to the
mix and doing a much more respectable job of extracting the queries.

Which does lead to the question about some RPS documentation but that's
sorta moot at this point.

***

Also, when running "named -V", I see both '--enable-static' and
'--disable-static' in the output. I have no idea if this is sensible or
not but it sure looks a little funny:

user@pc:~$ named -V
BIND 9.12.2-P2-1+ubuntu18.04.1+deb.sury.org+1-Ubuntu <id:b2bf278>
running on Linux x86_64 4.15.0-34-generic #37-Ubuntu SMP Mon Aug 27
15:21:48 UTC 2018
built by make with '--build=x86_64-linux-gnu' '--prefix=/usr'
'--includedir=/usr/include' '--mandir=/usr/share/man'
'--infodir=/usr/share/info' '--sysconfdir=/etc' '--localstatedir=/var'
'--disable-silent-rules' '--libdir=/usr/lib/x86_64-linux-gnu'
'--libexecdir=/usr/lib/x86_64-linux-gnu' '--disable-maintainer-mode'
'--disable-dependency-tracking' '--libdir=/usr/lib/x86_64-linux-gnu'
'--sysconfdir=/etc/bind' '--with-python=python3' '--localstatedir=/'
'--enable-threads' '--enable-largefile' '--with-libtool'
'--enable-shared' '--enable-static' '--with-gost=no'
'--with-openssl=/usr' '--with-gssapi=/usr' '--with-libidn2'
'--with-libjson=/usr' '--with-lmdb=/usr' '--with-gnu-ld'
'--with-geoip=/usr' '--with-atf=no' '--enable-ipv6' '--enable-rrl'
'--enable-filter-aaaa' '--disable-static' '--disable-native-pkcs11'
'--enable-dnstap' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2
-fdebug-prefix-map=/build/bind-BNj4_3/bind-9.12.2.P2+dfsg=.
-fstack-protector-strong -Wformat -Werror=format-security
-fno-strict-aliasing -fno-delete-null-pointer-checks -DNO_VERSION_DATE
-DDIG_SIGCHASE' 'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro
-Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2'
compiled by GCC 7.3.0
compiled with OpenSSL version: OpenSSL 1.1.0g 2 Nov 2017
linked to OpenSSL version: OpenSSL 1.1.0g 2 Nov 2017
compiled with libxml2 version: 2.9.4
linked to libxml2 version: 20904
compiled with libjson-c version: 0.12.1
linked to libjson-c version: 0.12.1
compiled with zlib version: 1.2.11
linked to zlib version: 1.2.11
threads support is enabled
user@pc:~$

--

- James

[Michał Kępień]

Hi James,

> Thank you for the https://www.isc.org/blogs/bind-9-packages/
> blog post and various binary distributions mentioned in it.
>
> I am an end user, not a programmer, and I rely on Linux
> distributions and application packages and so having up-to-date
> content from authoritative sources is both helpful and very
> reassuring.
>
> As a result of this, I now have the "stable" currently-9.12.2
> version from https://launchpad.net/~isc/+archive/ubuntu/bind
> installed on Ubuntu 18.04 here on my home desktop in order to
> hack away at something.

Thanks for giving our packages a shot!

> So I was looking forward to RPS having the effect of adding TCP
> to the mix and doing a much more respectable job of extracting
> the queries.
>
> Which does lead to the question about some RPS documentation
> but that's sorta moot at this point.

I am not sure if you are aware of it but writing a library implementing
the DNSRPS API is not something entirely straightforward. See the
"librpz_0_t" type in lib/dns/include/dns/librpz.h for a list of methods
comprising the library interface. Also note that the only working
implementation whose existence I am aware of is a proprietary one.

Given the above, a strong enough motivation for using --enable-dnsrps in
the packages we build and support is lacking. Note that Debian and its
derivatives provide tools which make rebuilding a source package with
different compile-time options fairly convenient.

> Also, when running "named -V", I see both '--enable-static' and
> '--disable-static' in the output. I have no idea if this is
> sensible or not but it sure looks a little funny:

Thank you for catching this, we will fix it.

--
Best regards,
Michał Kępień