<html><head></head><body>+1 to this approach.<br><br><div class="gmail_quote">On June 5, 2016 6:51:03 PM PDT, Mark Andrews <marka@isc.org> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail"><br />In message <20160606092634.32fddbf7@pallas.home.time-travellers.org>, Shane Kerr writes:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Paul,<br /><br /> At 2016-06-05 14:29:20 -0400<br /> Paul Wouters <paul@nohats.ca> wrote:<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> On Fri, 3 Jun 2016, Phil Regnauld wrote:<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #fcaf3e; padding-left: 1ex;"> ... apparently it doesn't do source port randomization. Ouch.<br /><br /> That's a real step backwards if that's the case.<br /></blockquote><br /> Ok, this was implemented in systemd 220:<br /><br /> <a
href="https://github.com/systemd/systemd/blob/master/NEWS">https://github.com/systemd/systemd/blob/master/NEWS</a><br /><br /> * systemd-resolved now implements RFC5452 to improve resilience against<br /> cache poisoning. Additionally, source port randomization is enabled<br /> by default to further protect against DNS spoofing attacks.<br /></blockquote><br /> systemd-resolved requires a forwarder. It is not a full DNS recursive<br /> server. So source port randomization is pretty useless as you are most<br /> likely just doing DNS on the local network.<br /></blockquote><br /> Minor point: According to Geoff Huston something like 10% of the users<br /> of the world use <a href="http://8.8.8.8">8.8.8.8</a> as their resolver, at least as of a couple<br /> years ago:<br /><br /> <a href="http://www.potaroo.net/ispcol/2014-11/resolvers.html">http://www.potaroo.net/ispcol/2014-11/resolvers.html</a><br /><br /> So the idea that stub resolvers talk to DNS on the local network is not<br
/> true in hundreds of millions of cases. Adding source port randomization<br /> will help the (admittedly crappy) protection against out-of-path<br /> spoofing for these users.<br /></blockquote><br />Adding DNS COOKIE support (RFC 7873) will do a even better job and<br />help with other issues. With working DNS COOKIE support you don't<br />need to do port randomisation.<br /><br />Mark<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Cheers,<br /> <br /> --<br /> Shane<br /></blockquote>-- <br />Mark Andrews, ISC<br />1 Seymour St., Dundas Valley, NSW 2117, Australia<br />PHONE: +61 2 9871 4742 INTERNET: marka@isc.org<br /><hr /><br />dns-operations mailing list<br />dns-operations@lists.dns-oarc.net<br /><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br />dns-jobs mailing list<br /><a
href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a><br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>