Subject: Re: [dnsop] WGLC for draft-ietf-dnsop-reflectors-are-evil-02.txt

From: "Olaf M. Kolkman" <[email-masked]>
Date: Fri, 3 Nov 2006 16:09:14 +0100

For the record, I already stated my consent with publishing this doc in:
    http://darkwing.uoregon.edu/~llynch/dnsop/msg03897.html

> Given the title, the history and the purpose of this draft  
> (remember the
> attacks launched at the beginning of this year?), vulnerability of  
> other
> systems or server types to (becoming an accomplice in) reflection or
> amplification attacks and their specific counter measures is out of  
> scope
> for this particular document.

Personally I'd welcome any idea that would describe how to protect  
authoritative servers too. I am not sure if there are solutions in  
the 'DNS operational' realm. There may be milage in protocol  
modifications like Donald Eastlake's proposed cookies.

But I agree with keeping the issue out of scope for this document.

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: Peter Koch <[email-masked]>
Date: Wed, 8 Nov 2006 20:03:11 +0100

Dear WG,

just as a reminder, we have a working group last call open for

> 	"Preventing Use of Recursive Nameservers in Reflector Attacks"
> 		draft-ietf-dnsop-reflectors-are-evil-02.txt
> 
> to be published as a BCP. The WGLC will end Sat, 2006-11-11 23:59 UTC.
> 
> Please review and comment on this draft on this mailing list. The chairs
> will not forward the document to the AD unless at least five reviewers
> have indicated their support (for both the draft and the intended status).
> Vendors' indication to follow (or not) the recommendation would be appreciated.

-Peter
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Pekka Savola <[email-masked]>
Date: Thu, 9 Nov 2006 13:51:23 +0200 (EET)

> > to be published as a BCP. The WGLC will end Sat, 2006-11-11 23:59 UTC.

I do not support publishing it as is.  My comments from July 7 have 
not been addressed or responded; it seems these are still relevant in 
the -02 version.  I haven't seen it worth the time to review it again.

http://darkwing.uoregon.edu/~llynch/dnsop/msg03742.html

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 9 Nov 2006 14:24:51 +0100

On Thu, Nov 09, 2006 at 01:51:23PM +0200,
 Pekka Savola <[email-masked]> wrote 
 a message of 22 lines which said:

> My comments from July 7 have not been addressed or responded; it
> seems these are still relevant in the -02 version.  

Let's see them:

1) The attacker could just use whatever 3rd party DNS records that
already exist, right? 

I replied to it (the variant you describe is possible but does not
seem to be the main concern right now).

2) If the attacker always used its own LRECORDs, the attack would be
traceable just by looking at who owns the zone, right? But as the
attacker may also use 2rd party LRECORDs, the owner of LRECORD doesn't
help in figuring out who was responsible for the attack.

Correct. But, in practice, it may be difficult to find the "owner" of
mysubsubzone.subzone.zone.example.

3) I'd also add reference to BCP84

It seems OK.

So, I would say that your comments are valid but should not block the
document. As it is, it describes the *current* problem, and may be
completed in the future by a more general document.
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Pekka Savola <[email-masked]>
Date: Thu, 9 Nov 2006 15:59:13 +0200 (EET)

> seem to be the main concern right now).

Yes, I saw that, but I believe whether it's the main concern or not is 
irrelevant -- the question to ask should be, "is this variation of 
attack relevant to the scope of the document?"

Unless this, as well, gets ruled out of scope in the document, I 
believe the answer is "yes".

---

From: Ólafur Guðmundsson<[email-masked]>
Date: Thu, 09 Nov 2006 13:55:08 -0500

I have reviewed the document and generally support it advancement.

The only nit I have is with the recommendation section is that the
recommended default configuration to be recursion-off is easy to miss
I would like to see text to the effect of:

by default nameservers SHOULD not offer recursive service to external 
networks.

         Olafur

At 12:34 26/10/2006, Peter Koch wrote:
>Dear WG,
>
>this message initiates a working group last call for
>
>Please also include editorial comments; there will be a -03 anyway since
>the current draft does not yet have an IANA considerations section.
>
>Given the title, the history and the purpose of this draft (remember the
>attacks launched at the beginning of this year?), vulnerability of other
>amplification attacks and their specific counter measures is out of scope

.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 9 Nov 2006 21:44:36 +0100

On Fri, Oct 27, 2006 at 09:03:47PM +0300,
 Pekka Savola <[email-masked]> wrote 
 a message of 19 lines which said:

> While I agree that the text need not necessarily be so absolute, I
> would not consider [such] ingress filtering proper or wide-scale
> deployment.  Better than nothing, to be sure, but not enough.

May be but it does not seem that BCP 38, lauded as the Ultimate and
Everlasting solution to Everything, strongly warns the ISP about
that. It seems it contains no discussion or advice about the best
place to put the antispoofing filters. (Some examples or sentences
mention filters which are close to the customer, some do not.)
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Mohsen Souissi <[email-masked]>
Date: Thu, 9 Nov 2006 23:31:33 +0100

I reviewd the draft version 02 and I approve moving it forward to a
 BCP RFC.

However, if there's a version 03 in preparation, I think it should
show more clearly the recommendation of turning off recursion for or
restricting it to a "trusted" audience, as mentioned by Olafur.

Moreover and FWIW, even if BCP 38 wide deployment could be the best solution, I
believe that "education" on anti-spoofing measures should be
widened/extended to reach the whole community of Network
administrators (and not only those working for ISPs). Would it
possible for example to recommend complementing ingress filtering on
the ISP side by "egress filtering" on the customer's side? That
consists on the customer's side in filtering out all traffic not
originated from IP addresses belonging to the customer, stopping
consequently at an earlier stage spoofed traffic (in case the attacker
has not privileged access on the site's edge router/firewall :-)

By the way, early egress filtering may be viewed at least as an
anti-spoofing enforcement and may be even more useful in case the ISP
doesn't (properly) apply ingress filtering.

Mohsen.

 On 08 Nov, Peter Koch wrote:
 | Dear WG,
 | 
 | just as a reminder, we have a working group last call open for
 | 
 | > 	"Preventing Use of Recursive Nameservers in Reflector Attacks"
 | > 		draft-ietf-dnsop-reflectors-are-evil-02.txt
 | > 
 | > to be published as a BCP. The WGLC will end Sat, 2006-11-11 23:59 UTC.
 | > 
 | > Please review and comment on this draft on this mailing list. The chairs
 | > will not forward the document to the AD unless at least five reviewers
 | > have indicated their support (for both the draft and the intended status).
 | > Vendors' indication to follow (or not) the recommendation would be appreciated.
 | 
 | -Peter
 | .
 | dnsop resources:_____________________________________________________
 | web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
 | mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Jakob Schlyter <[email-masked]>
Date: Fri, 10 Nov 2006 18:43:20 -0800

hi,

I've read version -02 of this draft and I supports its publication as  
BCP.

	jakob

.

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 13 Nov 2006 10:07:58 -0500

> to be published as a BCP. The WGLC will end Sat, 2006-11-11 23:59 UTC.

I have read the -02 document, and the previous objections I had have
been addressed.  I support the document going forward.

I've sent a "nits" note to the authors off-list.

A

-- 
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
jabber: [email-masked]                 +1 416 646 3304 x4110
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 14 Nov 2006 10:40:51 +0100

On Thu, Nov 09, 2006 at 03:59:13PM +0200,
 Pekka Savola <[email-masked]> wrote 
 a message of 18 lines which said:

> Yes, I saw that, but I believe whether it's the main concern or not
> is irrelevant -- the question to ask should be, "is this variation
> of attack relevant to the scope of the document?"

My opinion is "No". If we decide it is relevant, the document will
take several more months of work to cover a whole class of attacks.
 
.

---

From: Pekka Savola <[email-masked]>
Date: Wed, 15 Nov 2006 15:51:55 +0200 (EET)

> mention filters which are close to the customer, some do not.)

Which is why I referred to BCP84/RFC3704, which _does_ include this 
discussion.

---

From: Joao Damas <[email-masked]>
Date: Wed, 15 Nov 2006 15:36:59 +0100

Pekka, during the meeting we mentioned we would be adding a reference  
to BCP84 in addition to BCP 38

Joao

.

---

From: Peter Koch <[email-masked]>
Date: Tue, 21 Nov 2006 12:15:45 +0100

Dear WG,

> > to be published as a BCP. The WGLC will end Sat, 2006-11-11 23:59 UTC.

as requested during the San Diego meeting, the WGLC period will be extended.
The new deadline is Friday this week, 2006-11-24 23:59 UTC.

-Peter
.