Subject: [dns-dir] Help reviewing draft-ietf-opsec-ipv6-implications-on-ipv4-nets for bad DNS advice?

From: Ted Lemon <[email-masked]>
Date: Fri, 5 Jul 2013 18:00:49 +0000

This is a document about how to disable IPv6 on corporate networks, for those who swing that way.   The bit of text I am concerned with is this:

   For this reason, networks attempting to prevent IPv6 traffic from
   traversing their devices should consider configuring their local
   recursive DNS servers to respond to queries for AAAA DNS records with
   a DNS RCODE of 0 (NOERROR) [RFC1035] or to silently ignore such
   queries, and should even consider filtering AAAA records at the
   network ingress point to prevent the internal hosts from attempting
   their own DNS resolution.  This will ensure that hosts which are on
   an IPv4-only network will only receive DNS A records, and they will
   be unlikely to attempt to use (likely broken) IPv6 connectivity to
   reach their desired destinations.

This looks like bad advice to me.   I'm not convinced that there is a safe way to do what is proposed here.   What do you all think?

The complete document is here:

	http://tools.ietf.org/html/draft-ietf-opsec-ipv6-implications-on-ipv4-nets-05

Thanks!

---

From: Mark Townsley <[email-masked]>
Date: Tue, 9 Jul 2013 15:50:36 +0200

> This looks like bad advice to me.   I'm not convinced that there is a safe way to do what is proposed here.   What do you all think?

Safe in what sense? Are there security dangers in it?

I can state a lot of reasons why I don't *like* it:

- Please just deploy IPv6 instead
- Users that want to get around this, can (8.8.8.8)
- Inconsistency in DNS is hard to diagnose, troubleshoot, etc....

That said, 6to4 and Teredo are as rampant as they are broken. Perhaps the focus should be on ridding these from codebases entirely rather than pussyfooting around about it as we have in the past. 

- Mark

> _______________________________________________
> dns-dir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-dir

---

From: Ted Lemon <[email-masked]>
Date: Tue, 9 Jul 2013 14:17:39 +0000

> Safe in what sense? Are there security dangers in it?

It certainly breaks DNSSEC.   Silently ignoring queries on a name can lead to long timeouts.   They were going to return NXDOMAIN, which would have been really exciting, but they at least agreed to take that out.

> - Inconsistency in DNS is hard to diagnose, troubleshoot, etc....

Actually I think they want to also intercept DNS queries at the firewall, so querying against google's name service wouldn't work.

> That said, 6to4 and Teredo are as rampant as they are broken. Perhaps the focus should be on ridding these from codebases entirely rather than pussyfooting around about it as we have in the past. 

Breaking 6to4 and Teredo at the enterprise firewall is pretty easy.   This is a document about how to run enterprise networks where you aren't doing IPv6.   Personally I think it's bad because it encourages enterprises to postpone upgrading to IPv6, when in fact enterprises are one of the easiest places in the world to do IPv6, and there are substantial benefits to switching.   But my main concern about this document is that it will be read as the IETF generally supporting the techniques it describes, even though the introduction says it's specifically for corporate environments.

So if there is something about the paragraph I quoted that would cause genuine breakage, but that I have missed, that's what I'm hoping someone will tell me.   The paragraph gives me an uneasy feeling, but having gotten rid of the NXDOMAIN bug, there is nothing specific that I can point to, with my limited operational experience, as being clearly broken.

---

From: Mark Townsley <[email-masked]>
Date: Tue, 9 Jul 2013 16:49:37 +0200

On Jul 9, 2013, at 4:17 PM, Ted Lemon wrote:

> It certainly breaks DNSSEC.  

Well, if the request isn't being responded to at all, I suppose that goes without saying.

>  Silently ignoring queries on a name can lead to long timeouts.

Even if only for AAAA requests with a host that (presumably) doesn't even have an IPv6 address configured (because by definition in the paper it is supposed to be connected to an IPv4 only network)? 

>   They were going to return NXDOMAIN, which would have been really exciting, but they at least agreed to take that out.
> 

lovely.

> Breaking 6to4 and Teredo at the enterprise firewall is pretty easy.  

Yes, but that also leads to timeouts. 

>  This is a document about how to run enterprise networks where you aren't doing IPv6.   Personally I think it's bad because it encourages enterprises to postpone upgrading to IPv6, when in fact enterprises are one of the easiest places in the world to do IPv6, and there are substantial benefits to switching.   But my main concern about this document is that it will be read as the IETF generally supporting the techniques it describes, even though the introduction says it's specifically for corporate environments.

I completely agree that we shouldn't be giving advice on how to run IPv4-only and IPv6-hostile networks - on philosophical grounds. 

But, you asked if this was "safe", and its in an "opsec" WG. I'm trying to understand what's unsafe here, what the target is for the doc, etc.

> So if there is something about the paragraph I quoted that would cause genuine breakage, but that I have missed, that's what I'm hoping someone will tell me.   The paragraph gives me an uneasy feel…

Yeah, I'm not seeing what this breaks, aside of IPv6. But, that seems to be the intent....

- Mark

---

From: Ted Lemon <[email-masked]>
Date: Tue, 9 Jul 2013 14:53:53 +0000

> Yeah, I'm not seeing what this breaks, aside of IPv6. But, that seems to be the intent....

Yup.   They even want to filter it at layer 2.  :}

Anyway, thanks for the second pair of eyes.