Re: djbdns/dnscache poisoning weakness

On Feb 10, 2009, at 9:28 AM, Simon Casady wrote:

>
> Some time ago I implemented a change to dnscache to deal  with a  
> slow, congested  connection to the Internet.  Queries were being  
> pushed off the list before a reply could get through so I added a  
> time check to the queries.  Queries must have a minimum age before  
> they are dropped if they are not old enough new queries are dropped  
> instead.  This helps prevents DOS attacks and reduces the threat of  
> poisoning.  How much it is reduced is not obvious but since a real  
> reply can now always get through it is significant.
>
> The code was quite simple if anyone is interested.
>
>
>
We'd actually looked at this approach, and it has a lot of merit. The  
one obstacle that we weren't able to resolve was the situation where  
an attacker wanted to intentionally break dnscache.

Currently to accomplish this, you have to perform a very high traffic  
DoS - hundreds/thousands of packets per second. Racing with real  
replies to keep forcing the queue entries off.

Forcing old queries to stay open and dropping new queries turns this  
into a very slow DoS (a couple of packets per second) if an attacker  
intentionally filled all the slots with queries that were going to  
time out because the server was unreachable. All the slots are filled  
with useless queries from the attacker, and none of the real clients  
can manage to squeeze in.

It's an area that I definitely want to look more into. There seem to  
be tradeoffs on every queue management approach.

-- Kevin