Subject: heads up: some practical DNS real life things you might want to know

From: bert hubert <[email-masked]>
Date: Fri, 14 Apr 2006 09:42:27 +0200

Hi namedroppers,

Thanks for the verbose and useful answers to my recent question about
127.in-addr.arpa and other important zones. In the not too far future, the
PowerDNS recursor will get a small authoritative part to serve these zones,
out of the box.

Some things I want to share:

1) Mandatory compression
There are domestic routers out there that proxy DNS queries, so computers
behind it configure the router as their nameserver. In the course of
migrating a large access provider to the PowerDNS recursor, the helpdesk
received a slow trickle of calls from owners of certain brands of router who
lost the ability to resolve domains, and hence use the internet.

A long period of study later it was discovered a recent change in PowerDNS
disabled compression of the first DNS answer against the original question,
and that these routers consider 'c0 0c' to be a magic 'Start of Answer'
marker. And crash when they can't find it. More gory detail over at
http://blog.netherlabs.nl

So be aware, in the real world, compression is no longer optional but
mandatory.

2) question count = 0

There is a nameserver implementation out there that zeroes the original
question upon replying for domains it is not authoritative for:

$ dig ds9a.nl @xx.1x9.1.61

; <<>> DiG 9.3.1 <<>> ds9a.nl @xx.1x9.1.61
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 33769
;; flags: qr rd ra; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; Query time: 35 msec
;; WHEN: Fri Apr 14 09:37:06 2006
;; MSG SIZE  rcvd: 12

$ dig +norecurs ds9a.nl @xx.1x9.1.61

; <<>> DiG 9.3.1 <<>> +norecurs ds9a.nl @xx.1x9.1.61
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 15698
;; flags: qr ra; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; Query time: 35 msec
;; WHEN: Fri Apr 14 09:37:51 2006
;; MSG SIZE  rcvd: 12

fpdns.pl outputs:
q0r?1,IQUERY,0,0,1,1,0,0,REFUSED,0,0,0,0

This makes the PowerDNS spoofing detection act up, so I'm special casing the
question count = 0 case.

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Fri, 14 Apr 2006 14:39:07 +0200

> http://blog.netherlabs.nl

Oooh, that is so wrong. Good catch! What did the e-tech folks say? 
 
> This makes the PowerDNS spoofing detection act up, so I'm special casing 
the

I'd love to add this thing to the fpdns list. Please let me know if you've 
figured out which code this is, or if you need any help fingerprinting it. 

Roy

---

From: bert hubert <[email-masked]>
Date: Fri, 14 Apr 2006 14:50:53 +0200

> Oooh, that is so wrong. Good catch! What did the e-tech folks say? 

About as wrong as your lotus notes client mailing the namedroppers-owner,
Roy! :-) I'm still trying to penetrate the e-tech helpdesk. 

> figured out which code this is, or if you need any help fingerprinting it. 

I know who owns it and will ask.

---

From: Edward Lewis <[email-masked]>
Date: Fri, 14 Apr 2006 10:17:50 -0400

>So be aware, in the real world, compression is no longer optional but

An age-old dilemma; when do you engineer to the way things are and 
when do you engineer for the way things need to be?

I think the fault here lies with the bad heuristics of the security 
software.  But I can see why the DNS implementation is the "victim" 
and has to "get fixed."

While "fixing" PowerDNS I hope you also got a whip and beat the 
security coders mercilessly. ;)

>This makes the PowerDNS spoofing detection act up...

It's always the security, isn't it? ;)

The first question in enforcing security is "is everything as it 
should be?"  That's why we have these security failures - when the 
sensed environment changes, security needs to react.  The unfortunate 
part is that the reaction is not always right - security entities 
sometimes (or "often" it seems when you are getting bit by it) 
misinterpret change, i.e., use bad heuristics.  It's not that 
security folks are weaker than other folks when it comes to protocol 
and network engineering, it's that a faulty effect is more noticeable.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Nothin' more exciting than going to the printer to watch the toner drain...