Re: [DNSOP] [dns-operations] dnsop-any-notimp violates the DNS standards

Paul Wouters <paul@nohats.ca> Mon, 09 March 2015 14:51 UTC

Return-Path: <paul@nohats.ca>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AB361A8A71 for <dnsop@ietfa.amsl.com>; Mon, 9 Mar 2015 07:51:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.01
X-Spam-Level:
X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id viYRThJMFeH5 for <dnsop@ietfa.amsl.com>; Mon, 9 Mar 2015 07:51:07 -0700 (PDT)
Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D997B1A8ABF for <dnsop@ietf.org>; Mon, 9 Mar 2015 07:48:21 -0700 (PDT)
Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3l12VB5CMvz1Hp; Mon, 9 Mar 2015 15:48:18 +0100 (CET)
Authentication-Results: mx.nohats.ca; dkim=pass reason="1024-bit key; unprotected key" header.d=nohats.ca header.i=@nohats.ca header.b=VKJ8aOYc; dkim-adsp=pass
X-Virus-Scanned: amavisd-new at mx.nohats.ca
Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id ofayBqduxbHO; Mon, 9 Mar 2015 15:48:17 +0100 (CET)
Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 9 Mar 2015 15:48:17 +0100 (CET)
Received: from bofh.nohats.ca (bofh.nohats.ca [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id CC6F8813B1; Mon, 9 Mar 2015 10:48:16 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1425912496; bh=f1jaE7IFmVt2ggktm1C+pDWLSuTPfyLW0huwWvEJGn4=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=VKJ8aOYcmpckg+XlIDqEkMjGxzdOtqrUkTja+8nzBvP53OklyZvEHoV009k5HUuwy VZSIcBz6qUl4GFXfq+gKdjlVeHQjWNhffgLyGGnthmfa3+uyHldyx3xk/mpBd8sR6P yQaJ5RTCL7OkLENyQ0f+rFfqyxfZF9B8GqZteSJw=
Received: from localhost (paul@localhost) by bofh.nohats.ca (8.14.7/8.14.7/Submit) with ESMTP id t29EmFKT008547; Mon, 9 Mar 2015 10:48:15 -0400
X-Authentication-Warning: bofh.nohats.ca: paul owned process doing -bs
Date: Mon, 9 Mar 2015 10:48:15 -0400 (EDT)
From: Paul Wouters <paul@nohats.ca>
To: "D. J. Bernstein" <djb@cr.yp.to>
In-Reply-To: <20150309110803.4516.qmail@cr.yp.to>
Message-ID: <alpine.LFD.2.10.1503091021510.13703@bofh.nohats.ca>
References: <20150309110803.4516.qmail@cr.yp.to>
User-Agent: Alpine 2.10 (LFD 1266 2009-07-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/AjVUFH4nZ1dGT0PScV6whRLePNw>
Cc: dnsop@ietf.org, dns-operations@dns-oarc.net
Subject: Re: [DNSOP] [dns-operations] dnsop-any-notimp violates the DNS standards
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Mar 2015 14:51:10 -0000

On Mon, 9 Mar 2015, D. J. Bernstein wrote:

> My "qmail" software is very widely deployed (on roughly 1 million SMTP
> server IP addresses) and, by default, relies upon ANY queries in a way
> that is guaranteed to work by the mandatory DNS standards.

And you've been told for two decades that this was wrong?

> Specifically, query type ANY "matches all RR types" for that node on
> that server.

Wrong, query type ANY "matches all RR types CURRENTLY IN THE CACHE". So
the result of qmail's ANY query is completely meaningless and qmail
cannot derive any conclusion from the absence of any record from that
query.

So if the MX or AAAA record has expired from the cache but another RRtype
with larger TTL (say NS) is still in there, your ANY query will fail to
find records. qmail with this feature is broken.

Additionally, Tony Finch did a write up of qmail's ANY problems too:
https://fanf.livejournal.com/122220.html

> In new software today I would sacrifice these efficiency
> benefits for the sake of simplicity, but this doesn't mean that I'm
> going to frivolously inflict retroactive punishment upon administrators
> who have installed standards-compliant software and done nothing wrong.

You have had 10 years to fix it. Luckilly, I believe most distributions
shipping qmail add the patch to fix this already.

> I understand how a sufficiently large site might acquire the impression
> that it can safely take radical action at its own whim, violating the
> existing protocol standards

Uhm, we pointd out qmail's _bug_ for a decade. I'm quite sure even you
do not need to interop with BIND4 anymore.

> Apparently Firefox recently deployed ANY queries. I haven't looked at
> the details but I gather that they're related to the well-known
> annoyances of handling AAAA etc. Firefox was browbeaten into reverting
> this change on the basis of highly questionable claims regarding
> amplification: "It can return enormous result sets, and some
> authoritative servers have taken to refusing ANY queries because of the
> frequency with which such queries show up in amplification attacks" ->
> "I'm concerned about amplification and the perception thereof by
> security monitors."

No, they were also told that ANY queries only return data from the
cache, and using ANY queries means you might miss actual A or AAAA
records. This has nothing to do with ANY queries and amplification.

> The common theme of CNAME/MX/A and A/AAAA is that there's widepread
> interest in being able to easily retrieve multiple record types. What
> I'm saying is not that query type ANY is the ultimate answer (clearly it
> can be improved); what I'm saying is that these are protocol issues, and
> that protocol changes need to be handled by an appropriately chartered
> IETF working group.

I agree there is a use for this. I tried a few years ago to introduce a
new EDNS0 option that would allow you to query for a bitmap number of
RRsets, but people did not like it. Perhaps the WG is ready for
something like this now.

Paul