IETF Logo Mail Archive

Re: [DNSOP] How Slack didn't turn on DNSSEC

Mark Andrews <marka@isc.org> Wed, 01 December 2021 14:49 UTC

Return-Path: <marka@isc.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A66983A012B for <dnsop@ietfa.amsl.com>; Wed, 1 Dec 2021 06:49:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isc.org header.b=chTXr50/; dkim=pass (1024-bit key) header.d=isc.org header.b=alGdzuEi
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iQ2Oh6fwYP3A for <dnsop@ietfa.amsl.com>; Wed, 1 Dec 2021 06:49:22 -0800 (PST)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [IPv6:2001:4f8:0:2::2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37F8E3A0124 for <dnsop@ietf.org>; Wed, 1 Dec 2021 06:49:21 -0800 (PST)
Received: from zimbrang.isc.org (zimbrang.isc.org [149.20.1.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx.pao1.isc.org (Postfix) with ESMTPS id 015F4433F01; Wed, 1 Dec 2021 14:49:20 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=isc.org; s=ostpay; t=1638370160; bh=MKJMZQeJc75cxtO9fdcNHr1b128tlH6yKqXQ30IqSJg=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=chTXr50/dxuvKV7YVc29hhU24zl/Y+zGtv5sV7BU9cKqETsDuSe3CVH90uYxXKaIm sXD4jjPJqcAJz6kXNBTZip9cgMZbUYFJI1ZilieTCQNYWMW6ItofRQsHFM2J/juDcl AQPPLn4UZ5jBsMfz9s88hRaUclnwNMDu7gVk/zAo=
Received: from zimbrang.isc.org (localhost.localdomain [127.0.0.1]) by zimbrang.isc.org (Postfix) with ESMTPS id E6F2FF25A4B; Wed, 1 Dec 2021 14:49:19 +0000 (UTC)
Received: from localhost (localhost.localdomain [127.0.0.1]) by zimbrang.isc.org (Postfix) with ESMTP id BE1C6F25A4D; Wed, 1 Dec 2021 14:49:19 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.10.3 zimbrang.isc.org BE1C6F25A4D
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isc.org; s=05DFB016-56A2-11EB-AEC0-15368D323330; t=1638370159; bh=20kazK191BTMTCWCW6MlugLaKZ0zF+WHoap296WUfcQ=; h=Mime-Version:From:Date:Message-Id:To; b=alGdzuEirqRypdzvZhPuwQ8UAf5ZU9YGtHLdFCsQlduzWu0ZzVwmBTL07lDBNBGII QAMHu8D0lN7Ub/GE605RG7WOgwYoVTwkid9DtVhmDBNPArjBBggEaQibBYUl0lq1Tt V13axbet0Y3rDc7kE2G+LKDGC/3NMVyfy5UV4Jdg=
Received: from zimbrang.isc.org ([127.0.0.1]) by localhost (zimbrang.isc.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 0RPjo0BLB6rb; Wed, 1 Dec 2021 14:49:19 +0000 (UTC)
Received: from smtpclient.apple (n114-74-30-70.bla4.nsw.optusnet.com.au [114.74.30.70]) by zimbrang.isc.org (Postfix) with ESMTPSA id 206A1F25A4B; Wed, 1 Dec 2021 14:49:18 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\))
From: Mark Andrews <marka@isc.org>
In-Reply-To: <7b446404-65ec-99b8-7485-3b4b7204ebb7@nic.cz>
Date: Thu, 02 Dec 2021 01:49:16 +1100
Cc: dnsop@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <A38653D4-AEF0-4381-A924-80DF9E28D9E6@isc.org>
References: <m1msK9b-0000HrC@stereo.hq.phicoh.net> <C3D5AC3A-CA5A-4F33-8BDA-DDFADD23649C@isc.org> <5f987ab1-c28a-b169-becf-1c44bdac60f4@nic.cz> <B12FC011-582F-46BC-BDEC-23AB45D33932@isc.org> <7b446404-65ec-99b8-7485-3b4b7204ebb7@nic.cz>
To: Vladimír Čunát <vladimir.cunat+ietf@nic.cz>
X-Mailer: Apple Mail (2.3654.120.0.1.13)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/wSpuMnKCJRNJt6dGIv96oIRAzjA>
Subject: Re: [DNSOP] How Slack didn't turn on DNSSEC
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Dec 2021 14:49:28 -0000


> On 1 Dec 2021, at 23:57, Vladimír Čunát <vladimir.cunat+ietf@nic.cz> wrote:
> 
> On 01/12/2021 13.43, Mark Andrews wrote:
>> Accepting 'QNAME NSEC \000.QNAME NSEC RRSIG’ (and other type maps) protects you from random QTYPE attacks.  It also makes 'black lies' work as intended.
> 
> Black lies got bad caching if Knot Resolver accepted this aggressively.  Asking two different QTYPEs repeatedly got uncacheable, as those answers need different NSEC* record contents (for the same NSEC* owner).  Of course, with different caching design this might be different, but it just didn't seem worthwhile to me.  If someone cares for good caching, they shouldn't use minimal ranges.

Black lies is “QNAME NSEC \000.QNAME NSEC RRSIG”.  There is no churn for "black lies”.  Black lies turns NXDOMAIN into NODATA.

"DNS Shotgun" can produce churn of NSEC if you ask for a type that is listed as existing but it doesn’t actually exist.  The NSEC returned is still valid for DNSSEC synthesis.

> --Vladimir
> 

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka@isc.org

v2.23.0 | Report a Bug | By Email