Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

I wrote:
> But look at dnscache.c:u_drop() - dnscache doesn't do anything to
> tell the kernel to forget about those previous ports.  As far as the
> kernel knows, dnscache is still waiting for responses on those
> ports.  If the kernel ultimately receives a response for one of
> those previous outgoing queries, it will still deliver that response
> to dnscache.  Only when dnscache looks through its udpclient table
> will it discover that the response is no longer of interest.

That's not quite right - the kernel will indeed make the response
available for dnscache to read, but dnscache won't ever read it.
dnscache will eventually close the socket without ever reading the
response.

But the main point still holds: a scan or similar detection of ports
in use depends on the kernel's knowledge, not dnscache's; the kernel
doesn't find out that the old socket is no longer in use until
dnscache closes it; closing the socket doesn't happen until dnscache
is about to send a new outgoing query; with qmerge, dnscache won't
send a new duplicate query, so the old socket isn't closed soon enough
to help the attacker.


paul