Subject: Re: stopping amplification

From: Roy Arends <[email-masked]>
Date: Wed, 29 Mar 2006 01:12:04 +0200

Peter Koch wrote on 03/29/2006 01:00:39 AM:

> > Ignoring requests with the RD bit set (as in dropping it on the floor, 
not 
> > sending 'refused' back) in the authoritative server should be a 
> > configurable policy.
> 
> Have a look at the (legitimate) queries arriving at your servers that 
have
> the RD bit set. 

I have. 

> These are non-negligible.

They were. my servers are authoritative only. It turned out that the only 
requests coming in with RD bit set where my own debug attempt using DiG 
which sets RD by default. 

> In fact, I'm not aware of 
> any document
> that actually says an iterating resolver (aka recursive server) 
> SHOULD/MUST only
> send queries with RD==0. 

rfc 1035:

RD              Recursion Desired - this bit may be set in a query and
                is copied into the response.  If RD is set, it directs
                the name server to pursue the query recursively.
                Recursive query support is optional.

This 'optional' is ambiguous enough to interpret as 'ignore'. In fact, 
IIRC, some authoritative implementations do this by default. 

> Might be a nice idea.
> The RD bit is insufficient evidence that something's wrong.

It'll teach'em though, gnarf gnarf. :)
 
> And again: the "open" part in "open recursive name server" is 
evenlyimportant.
> Even with recursion disabled, such systems still can be abused.

Absolutely !

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Peter Koch <[email-masked]>
Date: Wed, 29 Mar 2006 01:28:41 +0200

> which sets RD by default. 

i'll try to back this with some 'fresh' figures the next days.

> This 'optional' is ambiguous enough to interpret as 'ignore'. In fact, 

Come on, apply the robustness principle, not martial law. Support being
optional means that the targeted server may not honor the RD bit (which is
what we are talking about closing recursors) but is no excuse for dropping
the query on the floor (at least not during the 'normal' resolution process).

-Peter