dnsdb/dnsdbq

possible bug in how limits are applied with sorting

djw1149 opened this issue · 1 comments

As observed by Nate Meyer: Sorting with a limit fetches default amount of rows, sorts, then applies the specified limit.

$ dnsdbq -S -k last -n ns5.dnsmadeeasy.com -l 1000000 -t ns

will not return enough answers; instead it will return dnstli's configured default limit, normally 10K, instead of the 1M rows requested.

There is a strong benefit with the current behavior since it is closer to what the user might want.
Two possible changes:

  1. Apply the -l limit in the dnsdb query, then sort.
  2. Do # 1 plus add a new option, -L, which is a limit to apply post-sorting.

If JSON format results are desired, then change # 2 could be done using a head or tail command on the output from change # 1.

Sorting with jq is possible too:

$ dnsdbq -l xxx -j .... | jq -s 'sort_by((.zone_time_first,.zone_time_last) ? // (.time_first,.time_last))'

will use jq to sort, after limit is applied. Or can do 'sort_by(.count)' for sort by count.

But I have not figured out one problem with it: the results using the jq -s option come out inside an array:

$ dnsdbq -l 1  -j -n farsightsecurity.com | jq -s 'sort_by((.zone_time_first,.zone_time_last) ? // (.time_first,.time_last))'
[
  {
    "count": 7,
    "time_first": 1380044973,
    "time_last": 1380141734,
    "rrname": "207.4.20.149.in-addr.fsi.io.",
    "rrtype": "PTR",
    "rdata": "farsightsecurity.com."
  }
]

If I can remove, preferably using jq, the array notation, then this output could be fed back into dnsdbq with the -J option to output non-JSON formats.

vixie commented

fix was accepted.