Hi,
Love the software, just an observation, the manual at
https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html states for
--no-ident:
*--no-ident*
Do not respond to class CHAOS and type TXT in domain bind queries.
Without this option being set, the cache statistics are also
available in the DNS as answers to queries of class CHAOS and type
TXT in domain bind. The domain names are cachesize.bind,
insertions.bind, evictions.bind, misses.bind, hits.bind, auth.bind
and servers.bind unless disabled at compile-time. An example command
to query this, using the *dig* utility would be
dig +short chaos txt cachesize.bind
However looking at the code (src/option.c):
6096 /* Add TXT records if wanted */
6097 #ifndef NO_ID
6098 if (!option_bool(OPT_NO_IDENT))
6099 {
6100 add_txt("version.bind", "dnsmasq-" VERSION, 0 );
6101 add_txt("authors.bind", "Simon Kelley", 0);
6102 add_txt("copyright.bind", COPYRIGHT, 0);
6103 add_txt("cachesize.bind", NULL, TXT_STAT_CACHESIZE);
6104 add_txt("insertions.bind", NULL, TXT_STAT_INSERTS);
6105 add_txt("evictions.bind", NULL, TXT_STAT_EVICTIONS);
6106 add_txt("misses.bind", NULL, TXT_STAT_MISSES);
6107 add_txt("hits.bind", NULL, TXT_STAT_HITS);
6108 #ifdef HAVE_AUTH
6109 add_txt("auth.bind", NULL, TXT_STAT_AUTH);
6110 #endif
6111 add_txt("servers.bind", NULL, TXT_STAT_SERVERS);
6112 }
6113 #endif
There's technically 3 further additional domain names which are not
documented:
* auth.bind
* *authors.bind*
* cachesize.bind
* *copyright.bind*
* evictions.bind
* hits.bind
* insertions.bind
* misses.bind
* servers.bind
* *version.bind*
This could lead a reader to not realise that "version.bind" is a
potential information disclosure issue (for those who worry about that
sort of thing, especially with the recent patched vulnerabilities) or
how one could disable that specifically.
Also may I respectfully suggest for your consideration:
1. auth.bind could do with explaining in the manual that it's the
"(number of authoritative queries answered)" and nothing to do with
authentication, DNSSEC auth-ed queries etc. etc.
2. servers.bind could also explain "(in the format <<Address#Port>>
<<TotalQueries>> <<FailedQueries>>)"
3. Maybe some DNSSEC stats could also be available in DNS (if all the
other stats are), "crypto.bind", "subqueries.bind", "sigfail.bind"
that appear in the usual statistics message?
4. Maybe access to the stale stats "stale.bind"?
Kind Regards,
Matthew
_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
