Re: djbdns/dnscache poisoning weakness

On Wed, Feb 11, 2009 at 3:00 PM, Jeff King <[email protected]> wrote:
>> Treating dnscache as a black box, the incoming/outgoing distinction
>> evaporates.
>
> For some definition of black box. If it is:
>
>       incoming          outgoing
>        queries           queries
> clients -------> dnscache -------> authoritative servers
>                 black box
>
> then no, it's not the same. Each incoming query may generate an
> arbitrary number of outgoing queries with arbitrary contents. So
> limiting the incoming queries does _not_ limit the outgoing queries.
>
> But if you mean "dnscache thinks of queries from clients and queries it
> wants to make as a result of the resolution algorithm both as incoming",
> then yes, those are the same as the outgoing queries.
>
> -Peff

I have not looked at your patch.  I had imagined a state machine,
where a query, either from a client or intermediate, is either (1)
cached within timeout or (2) unknown.  And I imagined the combination
process could be implemented by introducing a third state, (3) query
in process for this information with attendant query attachment
mechanism.