[Fwd: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile distinfo]

[Ian Smith]

On Sat, 12 Jul 2008, Mark Andrews wrote:
 > 
 > > Is there a way to restrict the ports which BIND selects -- perhaps
 > > at the expense of a small amount of entropy -- such that it doesn't
 > > try to use UDP ports which are administratively blocked (e.g. ports
 > > used by worms, or insecure Microsoft network utilities)? We don't 
 > > dare turn these port blocks off, or naive users will fall prey to 
 > > security holes in Microsoft products. But if BIND doesn't know to
 > > work around them, lookups will occasionally (and infuriatingly!)
 > > fail.
 > 
 > % grep avoid doc/misc/options 
 >         avoid-v4-udp-ports { <port>; ... };
 >         avoid-v6-udp-ports { <port>; ... };
 > % 

This seems to imply that you can't specify ranges of UDP ports to avoid
here.  For example perhaps, the range traceroute uses .. 

Doug responded with a new option for a range of ports to use, but an
intersection of ports to use and ^ports to avoid, including range(s),
would cover all the bases ..

cheers, Ian