5 ms·
If I'm understanding your question correctly, the Matasano post outlines why/how.
by silencio 18y ago
If I'm understanding your question correctly, the Matasano post outlines why/how.
- axod 18y agoLast paragraph: "It also contained Additional RRs pointing WWW.VICTIM.COM to 6.6.6.0. Those records are in-bailiwick: Bob is in fact interested in VICTIM.COM for this query." Why would it accept a record for www.victim.com for a query against aaaaa.victim.com, when www.victim.com isn't needed for that particular query? Surely the fix is to further restrict fix 2: "The RR set poisoning attack is fixed by bailiwick checking, which is a quirky way of saying that resolvers simply remember that if they’re asking where WWW.VICTIM.COM is, they’re not interested in caching a new address for WWW.GOOGLE.COM in the same transaction." Change that to say they are only interested in addresses that help them resolve the current query, and they will only use those intermediate addresses for the current query, and not globally.
- silencio 18y agoOkay, I misunderstood it. Yes, what you're suggesting (basically to only keep the glue for the current query and not to cache it, right?) would be a fix. Buuuut you'd have to consider that legitimate glue usage includes A records for NS records.