Re:Systemd-resolved DNS cache poisoning
by agwa on Wednesday November 12, 2014 @11:16AM
(#8596242)
> "a pretty complete caching DNS and LLMNR stub resolver"
That quote is gold. Most of DNS isn't implementing the protocol, but implementing all the protections against cache poisoning, many of which are not intuitive.
But as the oss-sec email says: "systemd-resolved does not implement any of the hardening recommendations of rfc5452."
That quote is gold. Most of DNS isn't implementing the protocol, but implementing all the protections against cache poisoning, many of which are not intuitive.
But as the oss-sec email says: "systemd-resolved does not implement any of the hardening recommendations of rfc5452."