IETF Logo Mail Archive

Re: [DNSOP] John Scudder's No Objection on draft-ietf-dnsop-dns-tcp-requirements-13: (with COMMENT)

"Wessels, Duane" <dwessels@verisign.com> Thu, 28 October 2021 17:54 UTC

Return-Path: <dwessels@verisign.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F4363A096C; Thu, 28 Oct 2021 10:54:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NAz9my1N7iVD; Thu, 28 Oct 2021 10:53:59 -0700 (PDT)
Received: from mail6.verisign.com (mail6.verisign.com [69.58.187.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C0ED3A094F; Thu, 28 Oct 2021 10:53:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=1552; q=dns/txt; s=VRSN; t=1635443640; h=from:to:cc:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version:subject; bh=sdwNa/B6KCewOnxqdt5hh8oFgO9Uvh+aWeLHtwRigK4=; b=Ma2OaPiPVgfmsMq9zl5cmqcPb5h+FxQPYYnohdNk7/vNQ7R+RljFzVCr R99/1rMlxFTu8IHRMZ7Q9tB35daTvYCYWGJJ0vIG5AN3UfL4xT7vgIchR OZC3GCCa4klRzaW7Se8JjPba86Oay7JmM8vjZpr6tTHxpIaZo9/KKjKbH 3+4XiHw7QVsKxMxhnVYHG/KD7zLo37esdQF7hDPGrXuyKpVSKtbFKynH7 tV5LGy/G2bOCKIHb3QsUA7KjYQBhp82VhGh3CHIqzq3jJAknJ/ToNLiAC E9KpGf8ZTEbLNKalpMRpfl93VnrOIrA7m1sfft5GSlCLALxO0OCwiCEyB Q==;
IronPort-SDR: Wfl0WgNuM7RdyxEADo66aoNaxEUkizXisdDT8ttPWvOMwQeaIyKKki4IUypCCz6DO3978f0qsy vb+YGt8v1LXWzGbiJ7AEIejt3Tu471RTM4Qm65r76IEQH9uhseek4AMLz6bnDFArNRZXjOe3eg 230oMy9OnKciY+sDGMgEs/WJg80yPF9aHMbW9Clgiqd9Hxz0nWGyufjjhIRzBn1SYiOdROBFwJ fg21zJ54zCtZMhBPZ1CzK/Q8V10enB7AmPxWzdk5+qppU6VjrNx6rNrb2P2e2R1ZeXDG2epgEI 2AA=
IronPort-Data: A9a23:CRlHuKJLpfchRATcFE+R/5QlxSXFcZb7ZxGr2PjKsXjdYENSgTEFn DNNDT2EO/eJZGP8fI8lboizpxgEscCHyYNiHARorCE8RH908seUXt7xwmUcn8+xwmwvaGo9s q3yv/GZdJhcokcxJX5BC5C5xZVG/fjgqoHUVaiUZUideSc+EH140Eo5y7Zj6mJVqYPR7z2l6 IuaT/L3ZQfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHpxdGlOjKmVi8k5Wc M6YpF2x1juxEx4FVIv5wu6jGqEAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhuMgt0 pYWspuKbh4mH6LWwfZGcABjKnQrVUFG0OevzXmXm/a1lnLgXku0mrNwB0YsJcsR9qBpG3pIs /cfLVjhbDja36Tvn+n9E7Q3wJhzRCXoFNp3VnVIwS7UFu0rRYvrXajQ5MRZ0zF2jcdLdRrbT 5NBN2E/MUqQC/FJEg4WA5B9oPmkuljEXCRSmHWTo+ku73eGmWSd15CoarI5YOeiX8lZtk2Vv H6A+H72ajkYO8e3yyeD82qhnKnJkD+TcIMfD7KQ9/N2jhuU3GN7IBEMXFWn5Pi0lkD7V9REL FRR9iw16LQ57AmxQ8DgXge1pXOCogU0WtdMHas98g7l4qbS+AGBLmkJUjAHb8Yp3Oc6Qyctz hqCn9roHydHsbCJRzSa7Lj8hSivKzcSN2sOei4IQCMK5tDipMc4iRenczp4OKSviITqHzzgm 2nPtzYkwbASlosB0OOx51aexSy2vZ6PRQkwjunKYl+YAspCTNbNT+SVBZLztJ6s8K7xooG9g UU5
IronPort-HdrOrdr: A9a23:h5B+GKjQmGP9Yv4qF67U3449R3BQXgoji2hC6mlwRA09TyXBrb HLoBwavSWZtN6IMEtQ5OxoS5PwJk80kqQFnbX5XI3SJjUO11HJEGgP1+HfKnjbakjDH41mpN hdmspFeb7N5DFB5K6Q3OD7KadD/DDtys+VbJLlrkuFOjsFV0gP1WpE402gYytLrUF9dOME/A r13Ls+m9OPQwVtUviG
X-IronPort-AV: E=Sophos;i="5.87,190,1631592000"; d="scan'208";a="10638568"
Received: from BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) by BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Thu, 28 Oct 2021 13:53:57 -0400
Received: from BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d]) by BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d%4]) with mapi id 15.01.2308.015; Thu, 28 Oct 2021 13:53:57 -0400
From: "Wessels, Duane" <dwessels@verisign.com>
To: Roman Danyliw <rdd@cert.org>
CC: John Scudder <jgs@juniper.net>, The IESG <iesg@ietf.org>, "draft-ietf-dnsop-dns-tcp-requirements@ietf.org" <draft-ietf-dnsop-dns-tcp-requirements@ietf.org>, "dnsop@ietf.org" <dnsop@ietf.org>, "dnsop-chairs@ietf.org" <dnsop-chairs@ietf.org>, "suzworldwide@gmail.com" <suzworldwide@gmail.com>
Thread-Topic: [EXTERNAL] John Scudder's No Objection on draft-ietf-dnsop-dns-tcp-requirements-13: (with COMMENT)
Thread-Index: AQHXzAZ+TyyEZZmWlEeWwCsaRBXAI6vo9I8A
Date: Thu, 28 Oct 2021 17:53:57 +0000
Message-ID: <40BCF2F3-97E5-4993-96AA-9C36E7FDA43A@verisign.com>
References: <163542852997.21101.3827007220330841514@ietfa.amsl.com> <BN1P110MB0939A01B8AAA4A88C3598A1BDC869@BN1P110MB0939.NAMP110.PROD.OUTLOOK.COM>
In-Reply-To: <BN1P110MB0939A01B8AAA4A88C3598A1BDC869@BN1P110MB0939.NAMP110.PROD.OUTLOOK.COM>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-mailer: Apple Mail (2.3608.120.23.2.7)
x-originating-ip: [10.170.148.18]
Content-Type: text/plain; charset="utf-8"
Content-ID: <561CF26865EF374185C0B76AD9605A9F@verisign.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/3vDWbeeIh2UXBlhl-5jWcCuDNUg>
Subject: Re: [DNSOP] John Scudder's No Objection on draft-ietf-dnsop-dns-tcp-requirements-13: (with COMMENT)
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Oct 2021 17:54:05 -0000


> On Oct 28, 2021, at 7:16 AM, Roman Danyliw <rdd@cert.org> wrote:
> 
> 
> [snip]
> 
>> 3. Section 6 says applications should perform “full TCP segment reassembly”.
>> What does that mean? A quick google search doesn’t suggest it’s a well-known
>> term of art. I'm guessing that what you mean is that the applications should
>> capture (and log, etc) the bytestream that was segmented and transmitted by
>> TCP?
> 
> I'll let the authors speak to this, but I think this means full TCP stream reassembly -- that is analyze, the reassembled stream, not the individual packets.  There is a long history of evasion attacks in network security analysis tools when individual fragments/packets are analyzed instead of the reassembled streams.
> 
> Roman


Thanks Roman, yes that is the intention.  “Segment reassembly” is poor phrasing.

I’ve seen (and probably even written) packet capture applications that only look at the first packet of a DNS over TCP conversation, or assumed that each TCP packet contains a separate DNS message.  This statement is directed at those types of shortcuts.

DW

v2.23.0 | Report a Bug | By Email