Subject: [DNSOP] I-D Action: draft-ietf-dnsop-cookies-06.txt

From: [email-masked]
Date: Mon, 19 Oct 2015 14:31:07 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Domain Name System Operations Working Group of the IETF.

        Title           : Domain Name System (DNS) Cookies
        Authors         : Donald E. Eastlake
                          Mark Andrews
	Filename        : draft-ietf-dnsop-cookies-06.txt
	Pages           : 30
	Date            : 2015-10-19

Abstract:
   DNS cookies are a lightweight DNS transaction security mechanism that
   provides limited protection to DNS servers and clients against a
   variety of increasingly common denial-of-service and amplification /
   forgery or cache poisoning attacks by off-path attackers. DNS Cookies
   are tolerant of NAT, NAT-PT, and anycast and can be incrementally
   deployed.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-cookies/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dnsop-cookies-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-cookies-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Donald Eastlake <[email-masked]>
Date: Mon, 19 Oct 2015 17:33:49 -0400

This revision incorporated editorial improvements and improvements in
explanatory and motivational text based on comments on the WG mailing
list.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

On Mon, Oct 19, 2015 at 5:31 PM, <[email-masked]> wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sat, 24 Oct 2015 21:49:50 +0200

On Mon, Oct 19, 2015 at 05:33:49PM -0400,
 Donald Eastlake <[email-masked]> wrote 

> explanatory and motivational text based on comments on the WG mailing

I've read it and diffed it and I believe it is OK. Section 5.2 is now,
IMO, much clearer and it addresses the problem reported in
<https://mailarchive.ietf.org/arch/msg/dnsop/QrrLtnCXhVI8usZsvAd5PU_b1Y4>,
thanks.

Editorial: "correct souce addresses" -> "correct source addresses",
"improves the probablity" -> "improves the probability". Also, "a
client MUST send client COOKIEs" is not a consistent casing of
cookie. It should be Client Cookies, to follow the convention of the
rest of the draft. Same thing for "a server MUST send server COOKIEs".

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 27 Oct 2015 18:03:54 -0400

Hi Stephane,

Sorry for slow response, I've been traveling on vacation.

> <https://mailarchive.ietf.org/arch/msg/dnsop/QrrLtnCXhVI8usZsvAd5PU_b1Y4>,

Thanks.

> rest of the draft. Same thing for "a server MUST send server COOKIEs".

OK.  I could produce an updated draft with fixes for those typos to
upload during IETF meeting week but I'm not sure if other changes are
desired.

Thanks,
Donald

---

From: Mark Andrews <[email-masked]>
Date: Wed, 28 Oct 2015 09:20:31 +1100

As a aside.  EDNS cookie responses with server cookies have been
seen outside of test servers.  Two .au servers from those serving
Alexa top 1M zones responded with server cookies.

discountbookshop.com.au. @223.27.29.230 (ns.discountbookshop.com.au.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok,cookie
saxton.com.au. @203.24.17.201 (ns.esupport.net.au.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok optlist=ok,cookie

Mark

In message <CAF4+nEE34U_dF=[email-masked]>
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 29 Oct 2015 15:17:32 +0900

> upload during IETF meeting week but I'm not sure if other changes are

Please feel free.  We've been through WGLC some time back and we've 
gotten strong consensus, with the editorial caveats that you have 
addressed. The chairs feel it's ready to be moved along, unless 
something major appears from this last update.

tim