Re: djbdns/dnscache poisoning weakness

On Mon, Feb 09, 2009 at 01:41:37PM -0600, Kevin Day wrote:
>
> Dnscache's weaknesses:
>
>
> 1) Dnscache treats "SOA" requests as uncacheable.
>
> There are several types of DNS query types, used to ask for different 
> information about a domain. The "Start of Authority" (SOA) type is used to 
> ask for certain data about the management and cache policies for the domain. 
> When receiving a reply from the real server about an SOA request, it tells 
> the client who requested it everything it found, then immediately forgets 
> the reply. This makes the "Kaminsky" attack (described above) much simpler, 
> and improves its efficiency slightly.

The meaning of this may be obvious to people familiar with dnscache
internals, but I'm confused.  If the reply is immediately forgotten, how
is the cache corrupted?

Does dnscache forget only the SOA record but caches the glue?  Does the
glue address record for ns1.example.com obtained from the example.com.
server override the cached address already obtained from the com.
server?  If the answer to both these questions is "yes", then I can see
why this would be a problem for a public dnscache.  But then the poison
would be flushed by the first SOA query after the attack ends, right?

This is all academic to most of us who run only local dnscaches, but I
would still like to understand what the actual problem is.