different fix for dns [was Re: Dishonest Forks?]

On 3/10/2010 8:50 PM, Matthew Dempsky wrote:
> He's not outright rejecting it: he's disclaiming that he hasn't
> reviewed the patches, and he acknowledges that duplicate-query
> suppression can make dnscache more difficult for blind attackers to
> poison.

rather than -- or in addition to -- duplicate query suppression, what 
about another approach (that holds no water against DJB's argument 
that we need a real fix):

set up your random source port, e.g.: 10000
then x more, e.g.: 9000, 12500, 13000

listen on all.  if a packet comes in on x with data that we were 
looking for on 10000, we know we're under attack.

we can either
  (a) retry with TCP*
  (b) wait for response on port 10000, and retry the whole process, 
making sure we get the same answer*
  (c) b+a
  (d) start the process over*
  (e) accept/provide the possibly forged answer, but set TTL way low?
  (f) ... ?
  (g) profit!


a: DoS in a box ?, not all servers do authoritative/tcp ?
b: what about an authoritative server that purposefully gives a 
random/random set of RR ?
d: if the attack continues, we block answers for a long time

-- 

Jeremy Kister
http://jeremy.kister.net./