Hacker News Reader

Comment by fapjacks | Hacker News Reader

Disclaimer: I think this is fucking stupid.

> Unfortunately the most common users of ANY queries in practice are people trying to perform DNS reflection attacks, exploiting the unusual length of the ANY responses.

This seems like a red herring. I bet there is pure business reasoning behind this decision. ANY queries are extremely useful for testing and debugging, as mentioned, and I cannot believe for one second that it's not trivial to implement something like fail2ban for ANY requests. How hard can it be to handle denying or dropping queries that are obviously an attack? Cloudflare can't handle simple reflection attack without tanking the usefulness of the query? It makes me rethink if Cloudflare is actually as good as it says on the tin.

View on HN

If you read the article to the end you'll see they say there is indeed a business case:

> Attempting to handle ANY queries creates enormous complexity in our DNS server code base. It's almost impossible to generate a proper response, anyway. Consider load-balancing, geoip, CNAME flattening features, and on-the-fly answer generation.

It isn't like they are saying no one should ever implement them, just that they aren't because of low utility in their environment vs relatively high cost.

Yes, you're right, but A) Cloudflare is in a position to significantly influence the behavior of others and B) low utility is not the same thing as not useful. One of my past lives would have been enormously more difficult without this specific capability. Generating a useful response also is not necessarily the same thing as generating a proper response. If there were something to take the place of ANY queries, I think it wouldn't be so bad.

> If there were something to take the place of ANY queries, I think it wouldn't be so bad.

But there are. Make the individual record type calls you need, and failing that, use a "axfr" transfers if you're permitted to based on IP security rules.

It should not be difficult to limit ANY queries on Linux systems. Something such as this perhaps (which could be tweaked in various ways):

    iptables -A INPUT -p udp --dport 53 -m string --from 50 --algo bm --hex-string "|0000FF0001|" -m recent --rcheck --seconds 10 --hitcount 5 -j DROP

For IPv6, just replace 'iptables' with 'ip6tables'. I imagine OpenBSD's PF could do this as well.

…or simply configure your DNS server to do rate limiting. I know that Bind supports it.

May I ask what exactly you want to debug using ANY? (assuming you are hosting DNS on cloudflare of course)

Exactly what depends on what exactly the problem turns out to be once diagnosed. Issuing an ANY query is often the first step in the diagnostic process.

> assuming you are hosting DNS on cloudflare of course

That doesn't have much to do with it. Most of the DNS problems I run into involve 3rd parties. So the question becomes "how likely is it they're using Cloudflare?", the answer being "increasingly so."

Reply on news.ycombinator.com