Subject: [Asrg] Problems with wildcards in combined IPv4 + IPv6 DNS blacklists

From: [email-masked]
Date: Thu, 26 May 2011 18:33:39 -0400

http://tools.ietf.org/html/rfc5782#section-2.4

For both IPv4 and IPv6 addresses, the records end up as:

  [reversed IP].[zone]

There's a problem when you use wildcards on IPv4 addresses:

  *.0.0.2.zone.example.com

Matches IPv6 2.0.0.* (2.0.0.0/8), but it also matches IPv6 2000/12.
Any IPv6 address starting with "200", as many do.

I think the RFC should be changed to add something to the IPv6 records to
differentiate them, just about anything but an integer from 0-255, like:

  [reversed IP].v6.[zone]

Is there a problem with doing that?

Examples of this problem showing up can be found here:
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6484#c25

-- 
"We will be dead soon. Is this how we want to live?"
http://www.ChaosReigns.com

---

From: "John Levine" <[email-masked]>
Date: 26 May 2011 23:01:18 -0000

>Any IPv6 address starting with "200", as many do.

Indeed, but basically nobody serves DNSBLs from servers that use BIND
style zone files and wildcards, so it's unlikely to be an issue in
practice.

>Is there a problem with doing that?

RFCs are by long tradition immutable so, no, it can't be changed.  You
can call your DNSBLs whatever you want, including using a different
base name for the v4 and v6 BLs, if it works better for you.

Due to the cache problems that any sort of per-IP queries are likely
to cause on production IPv6 networks (see previous discussion on this
list) I doubt there will ever be a lot of use of 5782 format IPv6 BLs,
so it doesn't seem like a good use of anyone's time to try to produce
a new version of the RFC with that change.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: "John Levine" <[email-masked]>
Date: 26 May 2011 23:06:33 -0000

>Any IPv6 address starting with "200", as many do.

By the way, the last paragraph of section 2.4 in RFC 5782 points out
this exact situation, so I hope it didn't come as a big surprise to
anyone.

R's,
John

---

From: [email-masked]
Date: Fri, 27 May 2011 13:23:29 -0400

> style zone files and wildcards, so it's unlikely to be an issue in

The link I included provided examples of where it's a problem in practice:

TXT records for:

2.6.5.e.5.6.e.f.f.f.9.0.d.1.2.0.5.0.0.0.2.0.0.0.0.0.6.1.1.0.0.2.asn.routeviews.org.
2.6.5.e.5.6.e.f.f.f.9.0.d.1.2.0.5.0.0.0.2.0.0.0.0.0.6.1.1.0.0.2.origin.asn.cymru.com.

As the rest of that comment shows, they're both returning values for IPv4
2.0.0.0/16.

> RFCs are by long tradition immutable so, no, it can't be changed.  You

A new RFC can obsolete an existing one.

> base name for the v4 and v6 BLs, if it works better for you.

Lack of standardization is going to make that unpleasant to deal with.

> this exact situation, so I hope it didn't come as a big surprise to

Only that the RFC was published with that problem intact.

-- 
"Of course there's strength in numbers. But there's strength in sharp
weaponry too. Ironically, this lead to what we call 'civilization'."
- spore
http://www.ChaosReigns.com

---

From: "John Levine" <[email-masked]>
Date: 28 May 2011 00:03:18 -0000

I reread RFC 5782.  I don't see any place that it tells people to
use the same name for IPv4 and IPv6 DNSBLs.  The last paragraph in
section 2 says:

   A single DNSxL could in principle contain both IPv4 and IPv6
   addresses, since the different lengths prevent any ambiguity.  If a
   DNSxL is represented using traditional zone files and wildcards,
   there is no way to specify the length of the name that a wildcard
   matches, so wildcard names would indeed be ambiguous for DNSxLs
   served in that fashion.

If you think it does tell people to use the same name, please say
where, preferably citing page and line numbers.

Also, if you're not familiar with the RFC series, some RFCs are
standards, most aren't.  This one isn't.  It says so right at the
top.

R's,
John

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 28 May 2011 13:32:45 +0200

> 2.6.5.e.5.6.e.f.f.f.9.0.d.1.2.0.5.0.0.0.2.0.0.0.0.0.6.1.1.0.0.2.asn.routeviews.org.

asn.routeviews.org is documented to map IPv4 addresses to ASNs. No
mention of IPv6 addresses.

> 2.6.5.e.5.6.e.f.f.f.9.0.d.1.2.0.5.0.0.0.2.0.0.0.0.0.6.1.1.0.0.2.origin.asn.cymru.com.

origin.asn.cymru.com is documented to map an "IP address or prefix" to
an ASN. While an "IP address" could be either IPv4 or IPv6, the fact
that the examples show only IPv4 and that there is also an
origin6.asn.cymru.com for IPv6 addresses is a strong hint that only IPv4
addresses are meant here.

Looks like user error in both cases to me. I would agree that both
queries should return NXDOMAIN instead of a useless result, though. 

	hp

-- 
   _  | Peter J. Holzer    | Web 2.0 könnte man also auch übersetzen als
|_|_) | Sysadmin WSR       | "Netz der kleinen Geister".
| |   | [email-masked]         | 
__/   | http://www.hjp.at/ |  -- Oliver Cromm in desd

---

From: [email-masked]
Date: Sat, 28 May 2011 11:07:57 -0400

> queries should return NXDOMAIN instead of a useless result, though. 

This problem would not exist if we added something to the middle of the
name of the DNS records we queried for v6.  Or, less appealing to me but
still a solution, specified that different zones should be used for v4
and v6.

-- 
"I don't want people who want to dance, I want people who have to dance."
--George Balanchine
http://www.ChaosReigns.com

---

From: "John Levine" <[email-masked]>
Date: 28 May 2011 22:34:39 -0000

>still a solution, specified that different zones should be used for v4

Could you say what, exactly, is keeping you from doing that?

R's,
John

---

From: [email-masked]
Date: Sat, 28 May 2011 18:37:58 -0400

> Could you say what, exactly, is keeping you from doing that?

My interest is primarily related to implementation between spamassassin and
existing DNS lists, so some kind of standardization matters.

-- 
"Where are you going and what do you wish?"
- The Old Moon, to Winkin' Blinkin' and Nod
http://www.ChaosReigns.com

---

From: "John Levine" <[email-masked]>
Date: 28 May 2011 23:07:45 -0000

>existing DNS lists, so some kind of standardization matters.

Both of the lists referred to in the original bug report have separate
IPv6 zones.  Once again, what exactly it the problem you're asking us
to solve?  I'm really at a loss to see what's wrong.

R's,
John