Subject: Re: [saag] [Ext] SECDIR review of draft-hoffman-dns-in-json

From: Paul Hoffman <[email-masked]>
Date: Tue, 3 Apr 2018 01:29:02 +0000

On Mar 29, 2018, at 1:27 PM, Watson Ladd <[email-masked]> wrote:

> The summary of the review is ready with issues.
> 
> I have some very strong reservations about defining a data format
> without some strong round-tripping guarantees and with as much
> flexibility as this one. The JSON format for DNS packets is intended
> to permit representation of malformed packets, and has a high degree
> of flexibility, with an intent that applications define profiles of it
> for themselves.
> 
> There are considerable security implications to doing this not
> addressed in the Security Implications section,

Good catch. I'll fix this in a new draft with an addition talking about the lack of specific profiles possibly leading to a receiver being deceived.

> in addition to obvious
> interoperability issues.

Yes, of course. However, I think I said that in enough places at the front of the document.

> For example, if we have a filter for JSON
> representations of DNS packets, this filter must share the same
> semantics for the output JSON as the consumer, even in the face of
> such bizzarities as HEX and regular fields with different contents,
> malformed length fields, etc. etc. I expect that this can and will
> cause serious issues.

And I'll add some of those examples as well, as a warning to those who might create profiles.

> I would suggest we not represent invalid packets and ensure all valid
> packets have a unique representation. Failing that the security
> consideration should at minimum be amended to include a discussion of
> these issues. A schema that can be used to validate DNS packets
> represented in JSON could also help address these problems.

There has been an active discussion in DNSOP about the DNS-in-CBOR representation being able to represent invalid packets. There is a strong desire to do so, to the point where the document authors had to put it in late in the process.

--Paul Hoffman