Subject: [dnsop] Comments on draft-ietf-dnsop-reflectors-are-evil-00.txt

From: Andrew Sullivan <[email-masked]>
Date: Fri, 19 May 2006 14:51:10 -0400

Dear colleagues,

These are some comments on the document
draft-ietf-dnsop-reflectors-are-evil-00.txt.  I have read this draft. 
I think it is basically sound, but I have some suggestions that I
think might make it stronger.  I want to thank the authors for good
work, and hope that these comments will be of use to them.

In section 2, we have this:

   3.  The PRNS proceeds with the resolution, caches the LRECORD and
       finally sends it to the target.  After this first packet, access
       to the authoritative name servers for AZONE is normally no longer
       necessary.  The LRECORD will remain cached for the duration of
       the TTL at the PRNS even if the AZONE is corrected.
   4.  Cleanup of the AZONE might, depending on the implementation used
       in the PRNS, afford a way to clean the cached LRECORD from the
       PRNS.

It isn't clear to me how (3) and (4) could be both true.  Something
more is needed there, I think.  (I can't suggest an alteration,
because I don't understand this, I suspect.)

We also have

   This amplification attack is possible because for historical reasons,
   out of times when the Internet was a much closer-knit community, some
   name server implementations have been made available with default
   configurations that when used for recursive name servers made the
   server accessible to all hosts on the Internet.

I think this isn't quite right: the attack is possible because people
can send packets pretending to come from somewhere else.  That's why
BCP38 is so important.  But the attack is certainly made easier
becuase there are all these handy open recursers around.  Here's a
suggested replacement:

    This amplification attack is possible because the ZCLIENTS can
    use the address of the target victim when querying the PRNS, but
    its popularity is partly a result of the number of name servers
    that provide recursive service to everyone on the Internet. 
    During the period in which these sorts of attacks were uncommon,
    it was reasonable for name server implementors to provide default
    configurations that, when used for recursive name servers, made
    the server accessible to all hosts on the Internet.  That period
    is over, and such default configurations can no longer be
    considered a service to the Internet community.

Someone who's a better writer can probably make that more elegant.

In the first paragraph of section 3, I would like to suggest the
addition of "only complete", so that the sentence reads, ". . . it
follows that the only complete solution to these sort of attacks is
the wide deployment of ingress filtering in routers. . . ."  The point
of this is to make plain that nobody thinks turning off all the open
recursers in the world will prevent amplification attacks.  It might
also help if the next paragraph had added to it a sentence about not
leaving available a small vulnerability, just because a big one is
near by (especially when the solution is relatively easy, as this one
is).  Perhaps, "It is prudent to reduce the ease with which this kind
of amplification attack can be performed."

Best regards,
A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
                                        +1 416 646 3304 x4110

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html