[Pydns-developer] TID

[Stuart D. G. <st...@bm...>]

I recently added a simple TID to pydns (Base.py:62) because certain firewalls
refuse to pass DNS requests with duplicate TID that have been responded to
(seems too smart for their own good to me).  Previously, pydns always put 0 in
TID.  

I used a simple random number - not at all cryptographically strong.  I didn't
think it mattered much for pyspf - the cache is only kept for one MAIL FROM,
and the worst an attacker can do is cause a false positive or negative via
cache poisoning.  However, with targeted phishing attacks, this could become
important.

What is a good but simple source of TIDs that are unpredictable to an
attacker?  I could use SystemRandom (which uses /dev/urandom or equivalent),
but that is not available on all systems.  I suppose use SystemRandom, and use
the default if not available.  (Mersenne Twister with system time as seed - and
netscape learned the hard way that current time makes a terrible random seed
for crypto purposes.) 

I also thought about efficiency.  (Although this has already been
addressed in dnspython and twisted, pydns is very lightweight, and 
if improving it keeps it that way, all the better.)
Currently, a fresh socket is created for each DNS request.  This keeps
the logic simple, but creates a lot of sockets (and they depend on Cpython
reference counting to get closed in a timely manner).  I wonder if a 
connection pool would be worthwhile.

-- 
	      Stuart D. Gathman <st...@bm...>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flammis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.