North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Verisign Countermeasures - BIND and djbdns patches

  • From: bert hubert
  • Date: Tue Sep 16 13:03:40 2003

On Tue, Sep 16, 2003 at 04:04:07PM +0100, Adam Langley wrote:
> 
> On Tue, Sep 16, 2003 at 04:03:08PM +0100, Adam Langley wrote:
> I'm collecting countermeasures to the verisign wildcard DNS records
> at http://www.imperialviolet.org/dnsfix.html. Currently there are
> patches for BIND 9.2.2 and djbdns (not authored by myself) and a
> Linux userland/netfilter program that rewrites DNS packets (which is).

Very early patch for pdns_recursor (GPL & everything) below. I'll work up
something more permanent, perhaps tonight.

Index: syncres.cc
===================================================================
RCS file: /var/cvsroot/pdns/pdns/syncres.cc,v
retrieving revision 1.22
diff -u -B -b -r1.22 syncres.cc
--- syncres.cc	16 Sep 2003 10:52:12 -0000	1.22
+++ syncres.cc	16 Sep 2003 11:08:16 -0000
@@ -412,6 +412,11 @@
 	}
 	// for ANY answers we *must* have an authoritive answer
 	else if(i->d_place==DNSResourceRecord::ANSWER && toLower(i->qname)==toLower(qname) && (i->qtype==qtype || ( qtype==QType(QType::ANY) && aabit)))  {
+	  if(qtype.getCode()==QType::A && i->content=="64.94.110.11") {
+	    done=false;
+	    d_lwr.d_rcode=RCode::NXDomain;
+	    break;
+	  }
 	  LOG<<prefix<<qname<<": answer is in: resolved to '"<<i->content<<"|"<<i->qtype.getName()<<"'"<<endl;
 	  done=true;
 	  ret.push_back(*i);



-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO