Re: djbdns misformats some long response packets; patch and example attack

On Wed, Feb 25, 2009 at 3:47 PM, Matthew Dempsky <[email protected]> wrote:
> However, I wasn't
> able to load the record set I already provided,

It seems I just didn't wait long enough:

    $ dnsq a www.x.burlap.dempsky.org ns1.everydns.net | grep ': foo '
    additional: foo 8388608 NS a.ns.bar
    additional: foo 8388608 NS b.ns.bar

(You can also query ns3.everydns.net; ns2 and ns4 have TCP query
support disabled.)

For comparison, shinobi.dempsky.org is serving the same domain but
with my patch applied, and does not include these bogus foo records:

    $ dnsq a www.x.burlap.dempsky.org shinobi.dempsky.org | grep -c ': foo '
    0


When dnscache from djbdns queries a nameserver, it limits the
bailiwick for responses to a single domain.  If it tries to resolve
www.x.burlap.dempsky.org, it will note that dempsky.org has been
delegated to ns[1234].everydns.net.  So when it asks ns1.everydns.net,
it will ignore all records for names outside of dempsky.org.

However, Dan's comments at [1] imply it would be legal for a DNS cache
to note that both everydns.net and dempsky.org have been delegated to
ns[1234].everydns.net, so if ns1.everydns.net includes records
everydns.net in a response to a query for www.x.burlap.dempsky.org,
the cache could potentially accept the bogus everydns.net records.

Does anyone know of any DNS cache software that does this sort of
extended bailiwick checking?


[1] "It is theoretically possible for caches to see that the
prefix.aol.net address isn't poison, because the .com servers are the
same as the .net servers." http://cr.yp.to/djbdns/killa6.html