Re: Poison in a zone

[gson@nominum.com (Andreas Gustafsson)]

D. J. Bernstein writes:
> Yes or no: Does the specific attack described on my web page work
> against BIND 9?

It does not.  BIND 9 is currently incapable of storing out-of-domain
glue records (i.e., records whose owner name is not a subdomain of the
zone apex), whether it is acting as a primary or a secondary.
Therefore, it will discard such records whether they are loaded from a
master file or received as part of a zone transfer.  This might be
considered either a security feature or a bug depending on your point
of view.

> > where the ISP is the *master* for the domains
> 
> Different situation, but same solution: discard all records outside the
> source's bailiwick. End of problem.

Yes, requiring all authoritative servers (masters and slaves) to
discard out-of-domain glue would solve the problem you described.  If
we do this, slaves to conformant masters will never actually discard
any records because anything that the slave would discard has already
been discarded by the master, and the integrity of the zone will be
preserved as required in axfr-clarify section 4.

> > more discriminate anti-spoofing rules
> 
> Namely? Exactly what would you suggest in place of the de-facto-standard
> bailiwick rule?

What Masataka Ohta suggested in August 2001:

 Ohta> I have been suggesting that these records be put in a referral-local
 Ohta> cache content of which is not used for usual A query nor glue A of
 Ohta> other referral points.

-- 
Andreas Gustafsson, gson@nominum.com