[nsd-users] * CNAME loop

[Roy Arends]

Interesting…

The combination of wildcards and cnames with a nonexistent canonical name in a single record is not a good idea in general. If these records can be found in the wild, on an NSD-only server pool, this can lead to denial of service attacks against resolvers.

There is some clarifications of wildcards in the DNS that deals with CNAME. That can be found in RFC 4592. I’ve quickly glanced over it, and it seems that the behaviour is consistent with that RFC. (I might be wrong though).

Roy


On 19 Nov 2013, at 14:14, Chris LaVallee <clavallee at edgecast.com> wrote:

> Hi,
> 
> I'm testing:
> 
> $ sudo nsd-control status
> version: 4.0.1
> verbosity: 2
> 
> I found a loop problem with this record:
> *         IN  CNAME   none
> ("none" means no matching record in zone and therefore match * again)
> 
> Queries that use "* CNAME" will result in a loop. The response will use TCP and will be limited to 65k bytes
> 
> $ dig @127.0.0.1 sdfgsfg.test.com
> 
> ;; Truncated, retrying in TCP mode.
> 
> ; <<>> DiG 9.8.1-P1 <<>> @127.0.0.1 sdfgsfg.test.com
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30440
> ;; flags: qr aa tc rd; QUERY: 1, ANSWER: 4678, AUTHORITY: 0, ADDITIONAL: 0
> ;; WARNING: recursion requested but not available
> 
> ;; QUESTION SECTION:
> ;sdfgsfg.test.com.        IN    A
> 
> ;; ANSWER SECTION:
> sdfgsfg.test.com.    6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> .
> .
> .
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> none.test.com.        6400    IN    CNAME    none.test.com.
> 
> ;; Query time: 85 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Tue Nov 19 08:36:52 2013
> ;; MSG SIZE  rcvd: 65531
> 
> --------------------------------------------
> 
> A more likely example of this problem is below 
> *         IN  CNAME  www.google.com    (ending dot is missing)
> 
> ;; QUESTION SECTION:
> ;sdfgsf.test.com.               IN      A
> 
> ;; ANSWER SECTION:
> sdfgsf.test.com.        6400    IN      CNAME   www.google.com.test.com.
> www.google.com.test.com. 6400   IN      CNAME   www.google.com.test.com.
> www.google.com.test.com. 6400   IN      CNAME   www.google.com.test.com.
> www.google.com.test.com. 6400   IN      CNAME   www.google.com.test.com.
> www.google.com.test.com. 6400   IN      CNAME   www.google.com.test.com.
> www.google.com.test.com. 6400   IN      CNAME   www.google.com.test.com.
> www.google.com.test.com. 6400   IN      CNAME   www.google.com.test.com.
> www.google.com.test.com. 6400   IN      CNAME   www.google.com.test.com.
> 
> 
> Chris
> 
> 
> 
> _______________________________________________
> nsd-users mailing list
> nsd-users at NLnetLabs.nl
> http://open.nlnetlabs.nl/mailman/listinfo/nsd-users

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.nlnetlabs.nl/pipermail/nsd-users/attachments/20131119/b7f1f3b0/attachment.bin>