Re: djbdns/dnscache poisoning weakness

On Wed, Feb 11, 2009 at 12:45:50PM -0600, David Nicol wrote:

> On Tue, Feb 10, 2009 at 3:47 PM, Jeff King <[email protected]> wrote:
> > I wanted to
> > make clear why the patch was written the way it was.
> 
> Treating dnscache as a black box, the incoming/outgoing distinction
> evaporates.

For some definition of black box. If it is:

       incoming          outgoing
        queries           queries
clients -------> dnscache -------> authoritative servers
                 black box

then no, it's not the same. Each incoming query may generate an
arbitrary number of outgoing queries with arbitrary contents. So
limiting the incoming queries does _not_ limit the outgoing queries.

But if you mean "dnscache thinks of queries from clients and queries it
wants to make as a result of the resolution algorithm both as incoming",
then yes, those are the same as the outgoing queries.

-Peff