Re: Dishonest Forks? | Was - Re: [Namedroppers-honest] Brian Smith asks: Who is Dean Anderson?

On Wed, Mar 10, 2010 at 4:33 PM, Dean Anderson <[email protected]> wrote:
> The piggybacking scheme re-uses ports for multiple queries.

For the benefit of readers of the list, here's another example of
Dean's misunderstanding of things.  Jeff King's patch to dnscache does
not "reuse ports for multiple queries".  Instead, before transmitting
an outbound DNS query, a Jeff King's patch modifies dnscache to check
if an outstanding query for the same name/type already exists.  If so,
it doesn't send the extra duplicate query, and instead uses the single
response packet as an answer to both queries.

How this affects the attack Kevin Day pointed out is it eliminates the
benefit an attacker receives by flooding an open dnscache instance
with query packets.  If each forged response packet can only match 1
outstanding query rather than any of up to 200 outstanding queries,
then it's roughly 200x harder for an attacker to forge a response.


Note also DJB's response to Jeff's patch (from
http://cr.yp.to/djbdns/forgery.html):

    I haven't reviewed the patches that attempt to stop colliding
    attacks against dnscache, BIND, etc. Even if these patches work
    properly, they are at best a speed bump for blind attackers.
    Saying "An attacker has to send billions of packets on average"
    is like saying "An attacker has to download a movie"; yes, it
    takes a little time, but it's not a serious obstacle.

He's not outright rejecting it: he's disclaiming that he hasn't
reviewed the patches, and he acknowledges that duplicate-query
suppression can make dnscache more difficult for blind attackers to
poison.

(Unfortunately, on this page Dan also uses the similar sounding terms
"duplicate-query" and "query repetition", which have very different
security consequences, and Dean fails to distinguish.)