Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dnsdist: Merge the client and server nonces to prevent replay attacks #4815

Merged
merged 1 commit into from Jan 19, 2017

Conversation

@rgacogne
Copy link
Member

@rgacogne rgacogne commented Dec 23, 2016

Short description

Instead of using the local nonce to send messages (and so the remote one for received ones), split and merge the local and remote nonces to create two new nonces, one for client to server and one for server
to client.
This makes us more resistant against reply attacks, but note that it does break compatibility with previous versions.

Checklist

I have:

@pieterlexis
Copy link
Member

@pieterlexis pieterlexis commented Dec 27, 2016

this is milestone'd for dnsdist 1.1. Due to the incompatible change, I suggest we delay and merge this first thing for dnsdist 1.2.

@rgacogne rgacogne modified the milestones: dnsdist-1.2.0, dnsdist-1.1.0 Dec 27, 2016
@neilcook
Copy link
Contributor

@neilcook neilcook commented Jan 5, 2017

Question:

#ifndef HAVE_LIBSODIUM
struct SodiumNonce
{
void init(){};
void merge(const SodiumNonce& lower, const SodiumNonce& higher);
void increment(){};
unsigned char value[1];
};
#else

Shouldn't merge be an empty implementation here like init() and increment()?

@rgacogne
Copy link
Member Author

@rgacogne rgacogne commented Jan 5, 2017

Shouldn't merge be an empty implementation here like init() and increment()?

It absolutely should, nice catch!

Instead of using the local nonce to send messages (and so the remote
one for received ones), split and merge the local and remote nonces
to create two new nonces, one for client to server and one for server
to client.
@rgacogne rgacogne force-pushed the rgacogne:dnsdist-console-no-replay branch from 29693d2 to 333ea16 Jan 5, 2017
@rgacogne rgacogne merged commit 6fdfee3 into PowerDNS:master Jan 19, 2017
1 check passed
1 check passed
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@rgacogne rgacogne deleted the rgacogne:dnsdist-console-no-replay branch Jan 19, 2017
cedricdubois pushed a commit to cedricdubois/python-dnsdist that referenced this pull request Feb 10, 2019
Since version 1.2.0, dnsdist uses merged nonces to send/receive
messages.

PowerDNS/pdns#4815
tresni added a commit to tresni/python-dnsdist that referenced this pull request Mar 14, 2019
* Compatibility to dnsdist 1.2.0+

Since version 1.2.0, dnsdist uses merged nonces to send/receive
messages.

PowerDNS/pdns#4815

* Don't merge nonces by default for BC
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants