Subject: [dnsext] blast from the past

From: Paul Vixie <[email-masked]>
Date: Fri, 03 Apr 2009 18:32:51 +0000

today i looked at http://www.nanog.org/meetings/nanog2/ and saw the following.
"DNS Version 2"?  Dropping packets with bad source addresses?  DNS flooding?

===

NANOG Meeting Notes, 24-25 October, 1994 V2.0
Ann Arbor, Michigan

...

After the break, Paul Vixie discussed the current status of the DNS and
BIND. Specifically, he discusses DNS security. There are two reasons why
DNS are not secure. There are two papers on this topic and they are both in
the current BIND kit. So the information is freely available.

Consider the case of telnetting across the Internet and getting what
appears to be your machine's login banner. Doing a double check
(host->address, then address->host) will help eliminate this problem.
hosts.equiv and .rhosts are also sources of problems. Polluting the cache
is a real problem. Doing UDP flooding is another problem. CERT says that
doing rlogin is bad, but that does not solve the cache pollution problem.

How to defend?

1. Validate the packets returned in a response to the query. Routers
should drop UDP packets on which the source address don't match what it
should be. (e.g. a udp packet comes in on a WAN link that should have come
in via an ethernet interface).TCP is harder to spoof because of the
three-way handshake, however running all DNS queries over TCP will add too
much overhead to this process.

2. There are a number of static validations of packet format that can be
done. Adding some kind of cryptographic information to the DNS would
help. Unfortunately, this moves very slowly because there are a number of
strong conflicting opinions.

What is being done?

The current BETA of BIND has almost everything fixed that can be fixed
without a new protocol. Versions prior 4.9 are no longer supported.

Paul may rewrite this server in the future, but it will still be called
named because vendors have a hard time putting it into their releases if
it is called something else.

Paul is funded half-time by the Internet Software Consortium. Rick Adams
funds it via UUNET's non-profit side. Rick did not want to put it under
GNU.

DNS version 2 is being discussed. This is due to the limit in the size of
the udp packet. Paul M. and Paul V. are working to say something about
this at the next IETF.

HP, Sun, DEC and SGI are working with Paul to adopt the 4.9.3 BIND once it
is productional.

After this comes out, Paul will start working on other problems. One
problem is the size of BIND in core. This change will include using the
Berkeley db routing to feed this from a disk-based database.

There will also be some effort for helping doing load-balancing better and
perhaps implementing policy features.

What about service issues? Providing name service is a start.

DEC and SGI will be shipping BIND 4.9.3 will be shipping it with the next
release.

Paul has talked to Novell, but noone else....Novell has not been a helpful
from the non-Unix side.

===

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>