Dropping queries from some well-known ports

[Petr Menšík]

Hi!

Our internal support reached to me with question, why are some queries
bound to low ports silently dropped. I have found there is feature for
that, that will silently drop queries from selected ports.

I admit queries from such low ports are wrong. But why are some ports
allowed when some ports are not? Should not it be configured by firewall
instead?

Just try this command:
$ sudo dig @127.0.0.1 -b 127.0.0.1#32 localhost

If bind is running on local interface, it will drop the query. If any
other server is running there, it will respond.

Does such feature make sense in year 2018? Can you remember what was
motivation to implement it? Is it wise to still enable it by default,
without at least configure option to disable it?

1.
https://gitlab.isc.org/isc-projects/bind9/commit/05d32f6b0f6590ca22136b753309f070ce769000
-- 
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: pemensik at redhat.com  PGP: 65C6C973