Re: [BEHAVE] [Technical Errata Reported] RFC7050 (5152)

Dan Wing <danwing@gmail.com> Fri, 13 October 2017 23:16 UTC

Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
From: Dan Wing <danwing@gmail.com>
In-Reply-To: <20171011044548.99E7CB80C92@rfc-editor.org>
Date: Fri, 13 Oct 2017 16:16:15 -0700
Cc: teemu.savolainen@nokia.com, jouni.nospam@gmail.com, Spencer Dawkins <spencerdawkins.ietf@gmail.com>, ietf@kuehlewind.net, Dave Thaler <dthaler@microsoft.com>, marka@isc.org, behave@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <8591B9A5-BAA5-45B4-8CBC-EB88449BF971@gmail.com>
References: <20171011044548.99E7CB80C92@rfc-editor.org>
To: RFC Errata System <rfc-editor@rfc-editor.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/behave/Yasg0Uk1D-ShrHfueB6aatmQfhA>
Subject: Re: [BEHAVE] [Technical Errata Reported] RFC7050 (5152)
Precedence: list

Verified.

The proposed text is one approach.  Another approach is that used by DNS RPZ (https://tools.ietf.org/html/draft-ietf-dnsop-dns-rpz) so that ipv4only.arpa can be signed and the client queries with DO=0 to get synthesized response, and can query with DO=1 to get the DNSSEC-signed response, but that can incur problems with caches.  I think Mark's suggestion is best, but it's worth discussing with a wider audience.

-d


> On Oct 10, 2017, at 9:45 PM, RFC Errata System <rfc-editor@rfc-editor.org> wrote:
> 
> The following errata report has been submitted for RFC7050,
> "Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis".
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5152
> 
> --------------------------------------
> Type: Technical
> Reported by: Mark Andrews <marka@isc.org>
> 
> Section: IANA Conside
> 
> Original Text
> -------------
> N/A 
> 
> Corrected Text
> --------------
> 8.x DNSSEC
> 
>    ipv4only.arpa MUST be insecurely delegated.  This allows ISP's to
>    modify / generate AAAA responses for ipv4only.arpa AAAA queries that
>    will pass through unmodified caching servers as required by 8.1 (4).
> 
> 
> Notes
> -----
> The protocol as described does not work when there is a validating caching server in the resolution path.  
> 
> IANA should have been instructed to insecurely delegate ipv4only.arpa.  This allows ISP's to modify the
> AAAA response without running foul of DNSSEC  validation.
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC7050 (draft-ietf-behave-nat64-discovery-heuristic-17)
> --------------------------------------
> Title               : Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis
> Publication Date    : November 2013
> Author(s)           : T. Savolainen, J. Korhonen, D. Wing
> Category            : PROPOSED STANDARD
> Source              : Behavior Engineering for Hindrance Avoidance
> Area                : Transport
> Stream              : IETF
> Verifying Party     : IESG
> 
>

[BEHAVE] [Technical Errata Reported] RFC7050 (515… RFC Errata System
Re: [BEHAVE] [Technical Errata Reported] RFC7050 … Dan Wing