Re: Extra records in zone transfers

[Masataka Ohta <[e-mail]>]

Dan;

> Andreas Gustafsson writes:
>   [ aol.com records in a zone transferred from princeton.edu ]
> > it may be used as glue in referrals
> 
> No. That is completely unacceptable from a security perspective.
> 
> Consider, as an easy example, a server handling both the .net zone and
> the microsoft.net zone. Suppose the microsoft.net people say
> 
>    blah.microsoft.net NS ns.slashdot.net
>    ns.slashdot.net A 207.46.232.37
> 
> in an AXFR response to this server. It is essential for the server to
> discard the glue A record; otherwise it will poison caches, because
> caches trust ns.slashdot.net information from .net servers.

In an AXFR, exactly what is contained in the master zone file
is transferred.

The primary server transmit exactly what is contained in a master
zone file of a zone.

Secondary servers transmit exactly what is received from upstream
server.

AXFR and IXFR has nothing to do with caching.

> My servers use a redesigned unified configuration-file format,

Your server is wrongly implemented, then.

(FYI, last time I checked BIND code in detail several years ago, it was
wrong too.)

Glue information is local to a zone (actually, local to a referral point
that same name server may have different A records referral by referral,
though such information can not be represented by standard zone file or
zone transfer format), that same name server may have different A
records zone by zone.

That is the reality of the database and the behaviour is not forbidden
by the specification.

Thus, glue information may be chached not in global cache but in
cache local to a zone (or, better, local to a referral point).

Then, different A records from different referral points can be cached
independently and replies can choose appropriate chache.

Note that your server is wrongly implemented in a way not directly
related to AXFR nor IXFR that, if you want to continue this thread
on correct chaching, you should better use a subject like "multiple
chache".

							Masataka Ohta


to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.