Re: Verisign Countermeasures - BIND and djbdns patches

[bert hubert <ahu () ds9a nl>]

On Tue, Sep 16, 2003 at 04:04:07PM +0100, Adam Langley wrote:
> On Tue, Sep 16, 2003 at 04:03:08PM +0100, Adam Langley wrote:
> I'm collecting countermeasures to the verisign wildcard DNS records
> at http://www.imperialviolet.org/dnsfix.html. Currently there are
> patches for BIND 9.2.2 and djbdns (not authored by myself) and a
> Linux userland/netfilter program that rewrites DNS packets (which is).

Very early patch for pdns_recursor (GPL & everything) below. I'll work up
something more permanent, perhaps tonight.

Index: syncres.cc
===================================================================
RCS file: /var/cvsroot/pdns/pdns/syncres.cc,v
retrieving revision 1.22
diff -u -B -b -r1.22 syncres.cc
--- syncres.cc  16 Sep 2003 10:52:12 -0000      1.22
+++ syncres.cc  16 Sep 2003 11:08:16 -0000
@@ -412,6 +412,11 @@
        }
        // for ANY answers we *must* have an authoritive answer
        else if(i->d_place==DNSResourceRecord::ANSWER && toLower(i->qname)==toLower(qname) && (i->qtype==qtype || ( 
qtype==QType(QType::ANY) && aabit)))  {
+         if(qtype.getCode()==QType::A && i->content=="64.94.110.11") {
+           done=false;
+           d_lwr.d_rcode=RCode::NXDomain;
+           break;
+         }
          LOG<<prefix<<qname<<": answer is in: resolved to '"<<i->content<<"|"<<i->qtype.getName()<<"'"<<endl;
          done=true;
          ret.push_back(*i);



-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO