New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dnsdist: Merge the client and server nonces to prevent replay attacks #4815

Merged
merged 1 commit into from Jan 19, 2017

Conversation

Projects
None yet
3 participants
@rgacogne
Member

rgacogne commented Dec 23, 2016

Short description

Instead of using the local nonce to send messages (and so the remote one for received ones), split and merge the local and remote nonces to create two new nonces, one for client to server and one for server
to client.
This makes us more resistant against reply attacks, but note that it does break compatibility with previous versions.

Checklist

I have:

@pieterlexis

This comment has been minimized.

Member

pieterlexis commented Dec 27, 2016

this is milestone'd for dnsdist 1.1. Due to the incompatible change, I suggest we delay and merge this first thing for dnsdist 1.2.

@rgacogne rgacogne modified the milestones: dnsdist-1.2.0, dnsdist-1.1.0 Dec 27, 2016

@neilcook

This comment has been minimized.

Contributor

neilcook commented Jan 5, 2017

Question:

#ifndef HAVE_LIBSODIUM
struct SodiumNonce
{
void init(){};
void merge(const SodiumNonce& lower, const SodiumNonce& higher);
void increment(){};
unsigned char value[1];
};
#else

Shouldn't merge be an empty implementation here like init() and increment()?

@rgacogne

This comment has been minimized.

Member

rgacogne commented Jan 5, 2017

Shouldn't merge be an empty implementation here like init() and increment()?

It absolutely should, nice catch!

dnsdist: Merge the client and server nonces to prevent replay attacks
Instead of using the local nonce to send messages (and so the remote
one for received ones), split and merge the local and remote nonces
to create two new nonces, one for client to server and one for server
to client.

@rgacogne rgacogne force-pushed the rgacogne:dnsdist-console-no-replay branch from 29693d2 to 333ea16 Jan 5, 2017

@rgacogne rgacogne merged commit 6fdfee3 into PowerDNS:master Jan 19, 2017

1 check passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details

@rgacogne rgacogne deleted the rgacogne:dnsdist-console-no-replay branch Jan 19, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment