Re: Dealing with the NS RRSet [Re: Why *can* cached DNS replies be overwritten?]
Peter Koch <pk@DENIC.DE> Tue, 12 August 2008 17:15 UTC
Return-Path: <owner-namedroppers@ops.ietf.org>
X-Original-To: ietfarch-dnsext-archive@core3.amsl.com
Delivered-To: ietfarch-dnsext-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E82B3A6B7A; Tue, 12 Aug 2008 10:15:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.278
X-Spam-Level:
X-Spam-Status: No, score=-4.278 tagged_above=-999 required=5 tests=[AWL=-1.028, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PRRs5E40T345; Tue, 12 Aug 2008 10:15:27 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A34473A69CC; Tue, 12 Aug 2008 10:15:27 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1KSxOG-000NYv-4u for namedroppers-data@psg.com; Tue, 12 Aug 2008 17:10:36 +0000
Received: from [81.91.160.182] (helo=office.denic.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from <pk@DENIC.DE>) id 1KSxOC-000NYN-Md for namedroppers@ops.ietf.org; Tue, 12 Aug 2008 17:10:34 +0000
Received: from denic.de ([10.122.65.106]) by office.denic.de with esmtp id 1KSxOA-0003B1-Nz; Tue, 12 Aug 2008 19:10:30 +0200
Received: by unknown.office.denic.de (Postfix, from userid 501) id 9E6807E6401; Tue, 12 Aug 2008 19:10:24 +0200 (CEST)
Date: Tue, 12 Aug 2008 19:10:24 +0200
From: Peter Koch <pk@DENIC.DE>
To: IETF DNSEXT WG <namedroppers@ops.ietf.org>
Subject: Re: Dealing with the NS RRSet [Re: Why *can* cached DNS replies be overwritten?]
Message-ID: <20080812171024.GH39395@unknown.office.denic.de>
References: <20080811190427.GD9082@cgi.jachomes.com> <B33086268D53A0429A3AA2774C83892C02E6D330@KAEVS1.SIDN.local> <20080812120923.GB39395@unknown.office.denic.de> <alpine.LSU.1.10.0808121435400.19189@hermes-1.csi.cam.ac.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <alpine.LSU.1.10.0808121435400.19189@hermes-1.csi.cam.ac.uk>
User-Agent: Mutt/1.4.2.1i
Sender: owner-namedroppers@ops.ietf.org
Precedence: bulk
List-ID: <namedroppers.ops.ietf.org>
On Tue, Aug 12, 2008 at 02:38:22PM +0100, Tony Finch wrote: > Now about not NS RRSet based, but still ... > ;; QUESTION SECTION: > ;345678.example.org. IN A > > ;; ANSWER SECTION: > 345678.example.org. 3600 IN CNAME www.example.org. > www.example.org. 3600 IN A 192.0.2.80 ; evil Can be mitigated two ways: 1) do not believe anything after the (first) CNAME RR (DNAME with CNAME synthesis needs special consideration) 2) again, do not overwrite anything in the cache, unless the new response is _more_ credible (as opposed to "greater or equal") -Peter -- to unsubscribe send a message to namedroppers-request@ops.ietf.org with the word 'unsubscribe' in a single line as the message text body. archive: <http://ops.ietf.org/lists/namedroppers/>
- Re: Why *can* cached DNS replies be overwritten? Olafur Gudmundsson
- Why *can* cached DNS replies be overwritten? Jay R. Ashworth
- Re: Why *can* cached DNS replies be overwritten? bert hubert
- RE: Why *can* cached DNS replies be overwritten? Antoin Verschuren
- Dealing with the NS RRSet [Re: Why *can* cached D… Peter Koch
- Re: Dealing with the NS RRSet [Re: Why *can* cach… Tony Finch
- Re: Dealing with the NS RRSet [Re: Why *can* cach… Florian Weimer
- Re: Why *can* cached DNS replies be overwritten? Paul Vixie
- Re: Dealing with the NS RRSet [Re: Why *can* cach… Peter Koch
- Re: Dealing with the NS RRSet [Re: Why *can* cach… Tony Finch