Re: djbdns: Current recommended patches?

On Tue, May 19, 2009 at 5:19 PM, David Nicol <[email protected]> wrote:
> http://cr.yp.to/djbdns/forgery.html specifies "query repetition" as an
> effective mechanism to prevent forgery.  By merging identical outgoing
> requests, one ceases to repeat queries.

That's a different kind of query repetition.

Jeff King's patches eliminate *inadvertent* query repetition; i.e.,
where dnscache coincidentally sends multiple queries for a single
name/type at once, improving the chances for an attacker to forge a
response to one of them.

On forgery.html, Dan is talking about *intentional* query repetition;
i.e., having a cache send a query multiple times and checking that the
results are "the same".  (Defining "the same" is heuristic at best,
because DNS makes no guarantees that two queries for the same name
will return the same response.)