Re: [Full-disclosure] Linux: telnet/ssh and other clients can connect to wrong host in case of mixed IPv4/IPv6 environment and search suffices are used in /etc/resolv.conf

[Juri Haberland <list-security.full-disclosure@xxxxxxxxxxxxxx>]

Peter Bieringer <pb@xxxxxxxxxxxx> wrote:
> During digging behind strange DNS requests receiving my DNS server I
> found, that there must be something broken in resolver/client address
> handling.

[snip]

> BTW: there is another issue that too much lookups are done, see the
> current query sequence here:
> 
> AAAA? test.unknown. (30)
> AAAA? test.unknown.1.getaddrinfo.bieringer.de. (57)
> AAAA? test.unknown.2.getaddrinfo.bieringer.de. (57) [successful AAAA]
> A? test.unknown. (30)
> A? test.unknown.1.getaddrinfo.bieringer.de. (57)
> A? test.unknown.2.getaddrinfo.bieringer.de. (57)
> A? test.unknown.3.getaddrinfo.bieringer.de. (57) [successful A]
> 
> I would expect a different order at all but I think this is a related
> problem.
> 
> AAAA? test.unknown. (30)
> A? test.unknown. (30)
> AAAA? test.unknown.1.getaddrinfo.bieringer.de. (57)
> A? test.unknown.1.getaddrinfo.bieringer.de. (57)
> AAAA? test.unknown.2.getaddrinfo.bieringer.de. (57) [successful AAAA]
> A? test.unknown.2.getaddrinfo.bieringer.de. (57)
> A? test.unknown.3.getaddrinfo.bieringer.de. (57) [successful A, but
> different name than successful AAAA, skipped!]

I would assume the following rules:

as IPv6 is superior to IPv4 I would try all IPv6 addresses before
falling back to IPv4.

Think of NFSv3 vs. NFSv2...

Cheers,
    Juri

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/