Re: djbdns misformats some long response packets; patch and example attack

A few followup comments.

On Wed, Feb 25, 2009 at 12:04 AM, Matthew Dempsky <[email protected]> wrote:
> However, neither the djbdns
> documentation nor standard practice warn potential .foo administrators
> that their domain will be at risk for poisoning if they were to add
> support for glue record sets.

I meant of course support for glue record sets _like this_.

> A perhaps more reasonable scenario is that the .foo servers fetch the
> contents of the x.foo domain over AXFR (removing any records from
> outside of x.foo) and then serve the records themselves.  axfr-get,
> the AXFR client from djbdns, would handle the above data set fine.

I noticed that axfr-get automatically strips out records outside of
the specified zone from the resulting data file, so it seems
reasonable that an admin might setup a script like

    #!/bin/sh -e
    cp data-me data.tmp
    for sub in x y z; do
      softlimit -d300000 -f1000000 \
        tcpclient a.ns.$sub.foo 53 axfr-get $sub.foo data-$sub data-$sub.tmp
      cat data-$sub >> data.tmp
    done
    mv data.tmp data
    tinydns-data

and expect this to prevent a.ns.{x,y,z}.foo from generating bogus
record sets that could poison .foo.  However, this is not the case if
the .foo domain is served using tinydns/axfrdns from unpatched djbdns
1.05.

> There's a similar service everydns.net.  They do claim to use tinydns
> (and so I assume axfrdns and axfr-get) and also provide AXFR slave
> support, but they did not allow me to register burlap.everydns.net.
> If they did, it would probably be possible to similarly poison
> everydns.net.

I've played with this a little bit today.  They support large TXT
records (>500 bytes), DNS queries over TCP, redundant NS records, and
records with non-printable characters in the name.  However, I wasn't
able to load the record set I already provided, and they only AXFR
pull once an hour, so I haven't had time to try many variations yet to
try to see what's breaking, but it seems reasonable to expect that
if/once I do, I could get the everydns.net servers to generate bogus
records for other domains they serve (unless they install my patch).
These wouldn't affect dnscache (because of how it implements
bailiwick), but they could theoretically poison other DNS caches.