| Subject: | id sequence is predictable and the same in all child processes. |
The sequence of ids is determined in Net::DNS::Header.pm:
{
my $id = int rand(MAX_ID);
sub nextid {
return $id++ % (MAX_ID + 1);
}
}
This sets $id when the Module is used. After that it is simply
incremented. This has two negative consequences:
1) The sequence is easily predictable which simplifies DNS spoofing attacks.
2) If Net::DNS is used in a forking server, it will normally be used in
the parent process. Unless the parent process makes DNS queries between
accepting requests, each child will start with the same value of $id and
go through the same sequence of ids. Since the source port may also be
fixed (at least on some Linux systems, although I don't yet understand
why), it is quite possible that one child may receive an answer to a
query sent by a previous child.
This has been noticed with qpsmtp and spamassassin. See the thread
starting at
http://www.nntp.perl.org/group/perl.qpsmtpd/;msgid=20060314190403.GC19939[at]teal.hjp.at
and
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=3D3997
Fix (proposed by Robert Spier in
http://www.nntp.perl.org/group/perl.qpsmtpd/;msgid=87ac1o9o7k.wl_rs[at]pobox.com)
:
Just return a random id:
sub nextid {
return rand(MAX_ID);
}