Re: [Sks-devel] [PATCH] auto-refresh membership DNS

[Kim Minh Kaplan]

Phil Pennock writes:

> So, the IP addresses will be held internally after all?

Yes.  In fact they are already.

> How long for?  When do they expire?

Until the next time sks recon process tries to connect to a partner, at
which point a knew DNS lookup is done for *this* particular partner and
it refreshes this partner's cache entry.

> How is this different in effect on DNS being
> cached unreasonably from using -membership_reload_interval with a value
> similarly sized (0.5 or whatever)?

When connecting to a partner as a client a fresh lookup is used.

On incoming connections stale IPs may still occur but the client recon
will still refresh maintain the cache in acceptable freshness.
Ultimately the authentication of peers should be done in another way.

I just posted a fix for the DoS possibility you mentionned in the
original thread.

Kim Minh.