Re: Dishonest Forks? | Was - Re: [Namedroppers-honest] Brian Smith asks: Who is Dean Anderson?

So all this hoo-haa was about Jeff's merge-outgoing patch? What a laugh.

On Thursday, March 11, 2010 09:50 AM, Matthew Dempsky wrote:
> On Wed, Mar 10, 2010 at 4:33 PM, Dean Anderson<[email protected]>  wrote:
>> The piggybacking scheme re-uses ports for multiple queries.
>
> For the benefit of readers of the list, here's another example of
> Dean's misunderstanding of things.  Jeff King's patch to dnscache does
> not "reuse ports for multiple queries".  Instead, before transmitting
> an outbound DNS query, a Jeff King's patch modifies dnscache to check
> if an outstanding query for the same name/type already exists.  If so,
> it doesn't send the extra duplicate query, and instead uses the single
> response packet as an answer to both queries.
>
> How this affects the attack Kevin Day pointed out is it eliminates the
> benefit an attacker receives by flooding an open dnscache instance
> with query packets.  If each forged response packet can only match 1
> outstanding query rather than any of up to 200 outstanding queries,
> then it's roughly 200x harder for an attacker to forge a response.
>

Kevin Day says: "djbdns has two weaknesses that allow an attacker to 
poison its cache in very short amounts of time."

Regarding the merge-outgoing patch he says:

"This patch prevents a class of poisoning attack by combining identical 
requests from clients into one outgoing query. Without this patch, an 
attacker can coerce dnscache into launching hundreds of identical 
queries at once, making a specific type of attack several orders of 
magnitude easier."

No reward for this? So is it substantiated or not? I notice that 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4392 is still 
under review. More than a year for a security vulnerability like this?

>
> Note also DJB's response to Jeff's patch (from
> http://cr.yp.to/djbdns/forgery.html):
>
>      I haven't reviewed the patches that attempt to stop colliding
>      attacks against dnscache, BIND, etc. Even if these patches work
>      properly, they are at best a speed bump for blind attackers.
>      Saying "An attacker has to send billions of packets on average"
>      is like saying "An attacker has to download a movie"; yes, it
>      takes a little time, but it's not a serious obstacle.
>
> He's not outright rejecting it: he's disclaiming that he hasn't
> reviewed the patches, and he acknowledges that duplicate-query
> suppression can make dnscache more difficult for blind attackers to
> poison.


Personally, I would use Jeff's merge-outgoing patch so as to stop 
hammering the authoritative servers of others (you know, be a good 
neighbour and so on) even if this security claim proves false but 
perhaps after its performance impact has been improved.