Subject: [DNSOP] SSAC: "Testing Firewalls for IPv6 and EDNS0 Support"

From: Peter Koch <[email-masked]>
Date: Fri, 5 Jan 2007 21:14:04 +0100

Dear WG,

RSSAC and SSAC are soliciting feedback on firewall behaviour against responses
to "priming queries": <http://www.icann.org/committees/security/sac016.htm>.

In this context it might be useful to define "priming queries" and the
technical expectations from the resolver author and/or operator perspective.

-Peter

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Mark Andrews <[email-masked]>
Date: Sat, 06 Jan 2007 09:10:49 +1100

> technical expectations from the resolver author and/or operator perspective.

	While not crucial to the "priming queries" issue this should
	be extend to cover NAT boxes and their handling of out of
	order fragmented responses.

	It would be useful to have a additional column in the table
	which specifies the maximum fragemented UDP response those
	firewalls support.

	Could the test box please be configured to specify a minimum
	IPv4 mtu on the interface in question.  This will verify that
	the firewalls in question do correctly handle fragmented UDP
	responses.  It would be nice if the first fragment could be
	sent last, perhaps a second box could delay the initial fragment
	by 20 ms or so.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Sat, 06 Jan 2007 09:10:49 +1100

Mark

---

From: Kenji Rikitake <[email-masked]>
Date: Sun, 7 Jan 2007 00:04:22 +0900

In the message <[email-masked]>
dated Sat, Jan 06, 2007 at 09:10:26AM +1100,
> 	which specifies the maximum fragemented UDP response those

It would also be useful to have an additional test case of the default
handling procedure (allowance/denial) of fragmented IPv4 packets for
each firewall product.  

On FreeBSD 4.11-RELEASE ipf, I had to write a rule set to explicitly
allow fragmented IPv4 packets; I suspect denying the fragmented packets
is the default setting for many firewall products.  

// Kenji Rikitake

---

From: Kenji Rikitake <[email-masked]>
Date: Sun, 7 Jan 2007 00:04:22 +0900

// Kenji Rikitake