Subject: [secdir] secdir review of draft-ietf-dnsop-as112-dname-04

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Thu, 7 Aug 2014 09:44:44 +0000

Hi,

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

I believe this document is "ready with issues."

The document describes adding and dropping of zones for AS112, the zone that is meant rot act as a sinkhole for reverse lookups for addresses that are for private-use only.

I think the document is clearly written and with my limited understanding of DNS it all seems to make sense from a technical point of view. 

What I am not so sure of however is the statement in the security considerations: 

"This document presents no known additional security concerns to the Internet.
For security considerations relating to AS112 service in general, see RFC6304bis]."

And in the introduction

"The AS112 project does not accommodate the addition and removal of
   DNS zones elegantly.  Since additional zones of definitively local
   significance are known to exist”

It appears to me that moving from a static list of well known ranges as defined in 6304bis to a dynamic adding and dropping of IP-address ranges that are "of definitively local
   significance” is prone to error, potentially leading to blackholing valid address space, either on purpose or by accident. I may show my ignorance here, but I feel that a discussions as to why that risk doesn’t exist is warranted. 

Hope this helps,

Klaas

---

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Thu, 7 Aug 2014 10:30:33 +0000

Sorry, dropped a letter in copy/paste of draft name 

Sent from my iPad

> On 07 Aug 2014, at 11:45, "Klaas Wierenga (kwiereng)" <[email-masked]> wrote:
> 
> Hi,
> 
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview

---

From: Paul Wouters <[email-masked]>
Date: Thu, 7 Aug 2014 10:32:11 -0400 (EDT)

>   significance” is prone to error, potentially leading to blackholing valid address space, either on purpose or by accident. I may show my ignorance here, but I feel that a discussions as to why th…

Actually, the static list is much more problematic. Mostly because some
AS112 instances would not yet have the new addition, while other AS112
instances would, and the replies would be inconsistent. By using the
DNAME protocol, it makes anything thrown at an AS112 work. Anyone else
throwing something in would still cause less packets on the internet
than those DNS packets leaking out the regular DNS infrastructure. For
instance, ISPs could run an AS112 instance to take all RFC1918 queries.
When new ranges are added (like 100.64.0.0/16) the ISP does not even
need to update their AS112 instance (they have to do so now). The
document's main purpose is to get rid of that bad static list. Because
it is static, an ISP cannot even really add anything to it, without
causing inconsistency.

The only people that can make a mistake to "null route" their domain into
AS112 are the owners of the domain. Don't configure NS records that
point to AS112 and you are fine.

Paul

---

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Mon, 11 Aug 2014 06:52:45 +0000

On 07 Aug 2014, at 16:32, Paul Wouters <[email-masked]> wrote:

Hi Paul,

> it is static, an ISP cannot even really add anything to it, without

OK, that sounds reasonable. So I gather that this list of “definitive local significance” ranges is relatively dynamic? I.e. there is a need for updating this list often? 

> point to AS112 and you are fine.

OK, makes sense (as I pointed out, blame my ignorance ;-)

Klaas

---

From: Paul Wouters <[email-masked]>
Date: Mon, 11 Aug 2014 10:08:51 -0400 (EDT)

> OK, that sounds reasonable. So I gather that this list of “definitive local significance” ranges is relatively dynamic? I.e. there is a need for updating this list often?

It requires no reconfiguration of an AS112 node. That is the goal of the
draft. AS112 becomes "zero maintanance". Of course, there will still be
discussion about what the IETF as a community should point to the AS112
blackhole.

Paul