<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jun 28, 2012, at 1:37 PM, Vernon Schryver wrote:</div><blockquote type="cite"><div><font class="Apple-style-span" color="#000000"><br></font>A separate aspect of this supposedly much, much longer window is that<br>it seems to assume that after the client has received a truncated or<br>TC=1 response and is going through the DNS/TCP dance, it will still<br>accept forged, evil DNS/UDP responses from the attacker. Is that true<br>of common resolving servers and resolver libraries? It's not how I'd<br>write a resolver. Instead I'd discard all of the state needed to<br>accept apparently stale UDP responses before the TCP SYN is sent.<br></div></blockquote></div><br><div>Please correct me if I misunderstand the following statement. "A slip rate of 2 drops 50% of the outgoing answers for a specific tuple, and returns a truncated response for the other 50%." If I do not understand that behavior, ignore the rest of the message and I'll re-evaluate my concerns. Also, is the default slip rate 2?</div><div><br></div><div>If that is the case, then if a legitimate query comes into an auth server which is currently being rate limited, the reply will be dropped 50% of the time. So, half the time it gets no response (== timeout) and the other half it gets a truncated response, thereby translating into TCP (which is another whole can of worms I'm leaving for later.)</div><div><br></div><div>If it gets a truncated response, all is well enough. If it gets no response, the additional time it waits will leave the window open for spoofing, using whatever lengths it has configured or defaults to.</div><div><br></div><div>I'm not worried about the TC=1 response case here, although I would point out that an attacker being able to change the behavior of a system just by attacking it seems scary as well, and causing a server to have to fall back to TCP more often and an auth server to have to respond to more TCP than it otherwise would seems like a major behavioral change, and I can think of several interesting attacks based on that alone.</div><div><br></div><div>--Michael</div><div><br></div></body></html>