Re: [secdir] secdir review of draft-ietf-dnsop-as112-dname-04

"Klaas Wierenga (kwiereng)" <kwiereng@cisco.com> Mon, 11 August 2014 06:52 UTC

From: "Klaas Wierenga (kwiereng)" <kwiereng@cisco.com>
To: Paul Wouters <paul@nohats.ca>
Thread-Topic: [secdir] secdir review of draft-ietf-dnsop-as112-dname-04
Thread-Index: AQHPsiQ3f8OY5L4Ee0OTmhRUsiOAuZvFiEiAgAXJFYA=
Date: Mon, 11 Aug 2014 06:52:45 +0000
Message-ID: <A3743AA4-08E3-4177-BB5D-E8B4A87E863F@cisco.com>
References: <04F423A7-DEEC-47B0-8FB7-61D14F2D89EB@cisco.com> <alpine.LFD.2.10.1408071024250.21674@bofh.nohats.ca>
In-Reply-To: <alpine.LFD.2.10.1408071024250.21674@bofh.nohats.ca>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <B23545880975F14BAFCA27EF792E313B@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/Kd9jh1E_RsL6xWThuFj4TcuTzGY
Cc: "draft-ietf-dnsop-as112-dnam.all@tools.ietf.org" <draft-ietf-dnsop-as112-dnam.all@tools.ietf.org>, "iesg@ietf.org" <iesg@ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] secdir review of draft-ietf-dnsop-as112-dname-04
Precedence: list

On 07 Aug 2014, at 16:32, Paul Wouters <paul@nohats.ca> wrote:

Hi Paul,

> On Thu, 7 Aug 2014, Klaas Wierenga (kwiereng) wrote:
> 
>> For security considerations relating to AS112 service in general, see RFC6304bis]."
>> 
>> And in the introduction
>> 
>> "The AS112 project does not accommodate the addition and removal of
>>  DNS zones elegantly.  Since additional zones of definitively local
>>  significance are known to exist”
>> 
>> It appears to me that moving from a static list of well known ranges as defined in 6304bis to a dynamic adding and dropping of IP-address ranges that are "of definitively local
>>  significance” is prone to error, potentially leading to blackholing valid address space, either on purpose or by accident. I may show my ignorance here, but I feel that a discussions as to why that risk doesn’t exist is warranted.
> 
> Actually, the static list is much more problematic. Mostly because some
> AS112 instances would not yet have the new addition, while other AS112
> instances would, and the replies would be inconsistent. By using the
> DNAME protocol, it makes anything thrown at an AS112 work. Anyone else
> throwing something in would still cause less packets on the internet
> than those DNS packets leaking out the regular DNS infrastructure. For
> instance, ISPs could run an AS112 instance to take all RFC1918 queries.
> When new ranges are added (like 100.64.0.0/16) the ISP does not even
> need to update their AS112 instance (they have to do so now). The
> document's main purpose is to get rid of that bad static list. Because
> it is static, an ISP cannot even really add anything to it, without
> causing inconsistency.

OK, that sounds reasonable. So I gather that this list of “definitive local significance” ranges is relatively dynamic? I.e. there is a need for updating this list often? 


> 
> The only people that can make a mistake to "null route" their domain into
> AS112 are the owners of the domain. Don't configure NS records that
> point to AS112 and you are fine.


OK, makes sense (as I pointed out, blame my ignorance ;-)

Klaas

[secdir] secdir review of draft-ietf-dnsop-as112-… Klaas Wierenga (kwiereng)
[secdir] secdir review of draft-ietf-dnsop-as112-… Klaas Wierenga (kwiereng)
Re: [secdir] secdir review of draft-ietf-dnsop-as… Klaas Wierenga (kwiereng)
Re: [secdir] secdir review of draft-ietf-dnsop-as… Paul Wouters
Re: [secdir] secdir review of draft-ietf-dnsop-as… Klaas Wierenga (kwiereng)
Re: [secdir] secdir review of draft-ietf-dnsop-as… Paul Wouters