Additional filtering of responses

[Wouter Wijngaards <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

A new version of my resolver (Unbound) with additional filtering of
responses to counter the recently disclosed vulnerability at blackhat
was just released. This filtering is in addition to the bailiwick
checking. I would like to say what I did, here, because this is easy to
do, and effective against certain types of 'the Kaminsky attack'.

1) Stuff in the additional section. RFC2181. Understand why Masataka and
Paul think it is very important, and worth bickering over. Just mentioning.

2) CNAME chains.  The first CNAME, that starts with the query name, is
OK. Everything after that, especially if in-bailiwick and giving nice
hints about www.example.com and so on is ignored from incoming messages.
Instead, the target of the CNAME is queried again. I think BIND already
does this.

3) DNAMEs. Unvalidated DNAMEs are not used from the cache. I believe
BIND also does this already.  Thus, a new request is done for every
query under a (not DNSSEC validated) DNAME, receiving a new redirection
for that one query.

So, only stuff that exactly matches the query is left in the answer
section.  The rest is ignored (basically, I delete it immediately).

This simply rejects a couple of loopholes without great additional
complexity or bother. It does not protect fully against 'The Kaminsky
Attack', only some variations are stopped.

The best solution is of course DNSSEC. Crypto signatures instead of
randomisation games. Enable DNSSEC validation now.

Best regards,
~   Wouter

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkia1eMACgkQkDLqNwOhpPjkHACgpT1+jYxsi5q5MjmZqUVvt1M9
SMQAn1Uk6LvvArsB65qeqXxT9jR+9FyC
=jEVJ
-----END PGP SIGNATURE-----

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>