Re: I-D ACTION:draft-ietf-dnsext-forgery-resilience-01.txt

[bert hubert <[e-mail]>]

On Mon, Aug 13, 2007 at 12:20:32PM +0200, Shane Kerr wrote:

> Regarding the "Countermeasures" section:
> 
>    Implementations SHOULD NOT use UDP source ports <1024 for sending
>    queries
> 
> Why? I mean, firewalls often block these, but any special reason other than that?

No, I think Peter Koch suggested it for this reason. No other special
reason, we just wanted to include the things suggested over at IETF 68.

>    Implementations MUST use an as large as possible pool of UDP source
>    ports for sending queries
> 
> Perhaps SHOULD? Because this basically means that implementations have to use
> 1024 to 65535 doesn't it?

This is basically a knob you can turn. If you turn it to '1 source port',
you get the current situation as with BIND and Nominum CNS, Windows DNS etc.
If you turn it to 64511 you get DJBDNS or PowerDNS, and the highest
possible protection against spoofing.

Paul has an implementation that has the knob set to 16.

Our feelings are that the draft should strongly state that all available
ports should be used, but we also understand not every OS and platform can
meet this requirement.

Hence 'as large as *possible*'. So you can get out of it if your platform
does not support it.

It is expected that this 'MUST' or 'SHOULD' will be something that needs
further discussion here.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>