Report from IETF 89 in London - DNS, DHCP and IPv6
4 likes2,520 views
The document discusses the activities and updates from the IETF 89 meeting held in London, covering topics such as DNS, DNSSEC, DANE, and DHCP. It highlights recent RFCs published, ongoing discussions about DNS privacy, proposed solutions to reliance on certain protocols, and the launch of new tools like the Getdnsapi resolver library. Additionally, the document mentions DANE's role in providing encryption and its integration into software like Postfix for SMTP security.
![©!Men!&!Mice!!http://menandmice,com!
more!DANE!work
• OpenPGP!keys!in!DNS
• Example!(for!paul@nohats.ca)
shell> dig -t TYPE65280 ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca +m
; <<>> DiG 9.9.4-P2 <<>> -t TYPE65280 ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca +m
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24851
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca. IN TYPE65280
;; ANSWER SECTION:
ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca. 2822 IN TYPE65280 # 2527 (
99010D033F7B0C3D00000107FF686BB69E18ACD31C38
0005F186CCF2BC9697CB87FDD4C5CD5DA994CB7E0958
7B57910637B89C9BC9FE697509798FA9BDFB638978F4
92F10999C3A595F6EF1BEE01BACE1C9F636D33B632D2
[...]
4356D7E7E6DF1AAF09075505380D20C3164276 )
;; Query time: 6 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Mar 11 17:22:21 CET 2014
;; MSG SIZE rcvd: 2646
OpenPGP!
Key
(Base64)
DNSSEC!
secured!
private!record!type!
for!experimental!
new!protocols
33Monday 17 March 14](https://image.slidesharecdn.com/webinar-ietf-89-slides-140314054253-phpapp02/85/Report-from-IETF-89-in-London-DNS-DHCP-and-IPv6-34-320.jpg)
![©!Men!&!Mice!!http://menandmice,com!
IPSEC!in!DNS
• opportunistic!(automatic!and!authenticated)!IPSec!VPN!tunnel!between!client!
and!server
• client!looks!up!the!server!public!key!in!DNS
shell> dig ipseckey nohats.ca +m
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31467
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; QUESTION SECTION:
;nohats.ca. IN IPSECKEY
;; ANSWER SECTION:
nohats.ca. 3591 IN IPSECKEY ( 10 0 2 .
AQPl2UGDJvDff4BiJWFZoSuYrerisFXZdD6M+QPDtpuH
i4rNmW+jqNGzF7k4orsggHyaglXSN2llTb0dTCwBamX8
[...]
dVbEHKz2sWdESIA2YNVqtPirkdYA0MeyO8SwYgMvlmg3
E8JcNBbcndEZidrlfINzFs2GmugvNHHHX6a7CPACNU0o
E2mzXeDY3FUW2F2XvERTnQPpU9zl )
;; AUTHORITY SECTION:
[....]
;; ADDITIONAL SECTION:
[....]
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Mar 11 17:41:17 CET 2014
;; MSG SIZE rcvd: 590
35Monday 17 March 14](https://image.slidesharecdn.com/webinar-ietf-89-slides-140314054253-phpapp02/85/Report-from-IETF-89-in-London-DNS-DHCP-and-IPv6-36-320.jpg)
Report from IETF 89 in London - DNS, DHCP and IPv6
- 3. ©!Men!&!Mice!!http://menandmice,com! Agenda • IETF!89!in!London! • DNS • DNSSEC!/!DANE • DHCP • IPv6 • the!following!information!is!an!excerpt!of!the!IETF!working!group! activities • for!a!full!overview!of!all!activities!at!IETF!89,!see! https://datatracker.ietf.org/meeting/89/materials.html 3Monday 17 March 14
- 5. ©!Men!&!Mice!!http://menandmice,com! published!new!RFCs!since!last!IETF RFC Title Category 6950 Architectural Considerations on Application Features in the DNS Informational 7043 Resource Records for EUI-48 and EUI-64 Addresses in the DNS Informational 7050 Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis Standards Track 7129 Authenticated Denial of Existence in the DNS Informational 5Monday 17 March 14
- 7. ©!Men!&!Mice!!http://menandmice,com! DNSE!BoF • the!problem!statement!has!been!presented!and!discussed • some!proposed!solutions!have!been!presented • DTLS!(TLS!for!UDP,!RFC!6347) • DNScrypt/DNScurve • CGA-TSIG • Confidential!DNS • t-DNS!(StartTLS!for!TCP!DNS) • discussion!continues!on!the!mailing!lists!(DNSOP)!about!possible!solutions!and! their!operational!impact 7Monday 17 March 14
- 9. ©!Men!&!Mice!!http://menandmice,com! DNSOP •Revived!documents: • DNSSEC!Key!Timing!Considerations! (draft-ietf-dnsop-dnssec-key-timing) • Explains!the!relationships!between!the!parameters!used!in!a! DNSSEC!key!rollover • important!for!implementers!of!DNSSEC!key-rollover!automation! software • and!DNS!administrators!that!plan!manual!DNSSEC!key!rollover 9Monday 17 March 14
- 11. ©!Men!&!Mice!!http://menandmice,com! Special!Names •“Special-Use!Domain!Names!of!Peer-to-Peer!Systems”! (draft-grothoff-iesg-special-use-p2p-names) • proposes!to!add!new!names!to!the!special-names!registry:!".gnu",! ".zkey",!".onion",!".exit",!".i2p",!and!!!".bit" • TOR • GNUnet • i2p • Namecoin 11Monday 17 March 14
- 14. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN A? Authoritative DNS Caching/Resolving DNS Attacker 14Monday 17 March 14
- 15. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN A? www.example.com IN A? + Resolver cookie in OPT Auth DNS server stores resolver cookie 15Monday 17 March 14
- 16. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN A? www.example.com IN A? + Resolver cookie in OPT Auth DNS server stores resolver cookie www.example.com IN A 192.0.2.1 + server cookie in OPT Cache DNS server stores auth-server cookie 16Monday 17 March 14
- 17. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN A? www.example.com IN A? + Resolver cookie in OPT Auth DNS server stores resolver cookie www.example.com IN A 192.0.2.1 + server cookie in OPT Cache DNS server stores server cookie www.example.com IN A 192.0.2.1 17Monday 17 March 14
- 18. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN AAAA? + Resolver cookie in OPT Auth DNS server has resolver cookie www.example.com IN AAAA 2001:db8::1 Cache DNS server has server cookie Attacker sends forged DNS data 18Monday 17 March 14
- 19. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN AAAA? + Resolver cookie in OPT Auth DNS server has resolver cookie www.example.com IN AAAA 2001:db8::1 Cache DNS server has server cookie Attacker sends forged DNS data 18Monday 17 March 14
- 22. ©!Men!&!Mice!!http://menandmice,com! getdnsapi • Platforms!as!of!IETF!89!! • RHEL/CentOS • MacOS • Soon!to!by!available: • FreeBSD! • iOS!(now!rough!but!usable)!! • In!view: • Windows,!Android 21Monday 17 March 14
- 27. ©!Men!&!Mice!!http://menandmice,com! DANE!in!Web-Browser • RFC!6698!-!The!DNS-Based! Authentication!of!Named!Entities! (DANE)!Transport!Layer!Security! (TLS)!Protocol:!TLSA • Plugin!for!Firefox,!Opera,!Chrome! and!Internet!Exporer!available! https://www.dnssec-validator.cz/ • Internet!sites!start!using!TLSA,!for! example https://packages.debian.org 26Monday 17 March 14
- 29. ©!Men!&!Mice!!http://menandmice,com! SMTP!TLSA •DANE!specifies!the!use!of!the!TLSA!resource!record!for! SMTP •can!make!TLS!connections!mandatory!between!servers!that! support!TLS •TLSA!resource!record!holds!a!hash!of!the!server!certificate shell> dig mx tidelock.de +short 10 ns3.tidelock.de. shell> dig _25._tcp.ns3.tidelock.de. tlsa +short 3 0 1 76AD75E4F300C2BACBDC9363A337A533F3B3C15CAAFED4E0010D5DD3 52B83935 28Monday 17 March 14
- 30. ©!Men!&!Mice!!http://menandmice,com! TLSA!in!Postfix •the!Postfix!Mail-Server!2.11!implements!DANE!TLSA!for!SMTP • Viktor!Dukhovni!from!the!Postfix!team!presented!on!the! challenges!of!implementing!TLSA!checking!in!applications • DANE!implementation!in!software!can!be!very!complicated!(easy!to!get! wrong) • should!be!handled!by!a!toolkit!(OpenSSL,!GnuTLS,!NSS!...) •Postfix!author!Wietse!Venema!presented!the!Postfix!TLSA! implementation!during!FOSDEM!2014!(1!February!2014) 29Monday 17 March 14
- 33. ©!Men!&!Mice!!http://menandmice,com! more!DANE!work •OpenPGP!keys!in!DNS • the!owner-name!of!the!OPENPGPKEY!Record!is!the!SHA224!hash! of!the!user!portion!of!an!E-Mail!address • the!user!part!of!an!E-Mail!address!can!contain!characters!illegal! in!DNS!names! • Example!(for!paul@nohats.ca) shell> echo -n "paul" | openssl dgst -sha224 ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66 SHA224! hash!of!the! username 32Monday 17 March 14
- 34. ©!Men!&!Mice!!http://menandmice,com! more!DANE!work • OpenPGP!keys!in!DNS • Example!(for!paul@nohats.ca) shell> dig -t TYPE65280 ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca +m ; <<>> DiG 9.9.4-P2 <<>> -t TYPE65280 ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca +m ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24851 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca. IN TYPE65280 ;; ANSWER SECTION: ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca. 2822 IN TYPE65280 # 2527 ( 99010D033F7B0C3D00000107FF686BB69E18ACD31C38 0005F186CCF2BC9697CB87FDD4C5CD5DA994CB7E0958 7B57910637B89C9BC9FE697509798FA9BDFB638978F4 92F10999C3A595F6EF1BEE01BACE1C9F636D33B632D2 [...] 4356D7E7E6DF1AAF09075505380D20C3164276 ) ;; Query time: 6 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Mar 11 17:22:21 CET 2014 ;; MSG SIZE rcvd: 2646 OpenPGP! Key (Base64) DNSSEC! secured! private!record!type! for!experimental! new!protocols 33Monday 17 March 14
- 35. ©!Men!&!Mice!!http://menandmice,com! more!DANE!work •OpenPGP!keys!in!DNS • “milter”!plugin!for!postfix!and!sendmail: https://github.com/letoams/openpgpkey-milter/ • “hash-slinger”!tool!to!create!and!verify!“openpgpkey”!records: https://github.com/letoams/hash-slinger • also!available!in!Fedora!Linux shell> yum install hash-slinger 34Monday 17 March 14
- 36. ©!Men!&!Mice!!http://menandmice,com! IPSEC!in!DNS • opportunistic!(automatic!and!authenticated)!IPSec!VPN!tunnel!between!client! and!server • client!looks!up!the!server!public!key!in!DNS shell> dig ipseckey nohats.ca +m ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31467 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4 ;; QUESTION SECTION: ;nohats.ca. IN IPSECKEY ;; ANSWER SECTION: nohats.ca. 3591 IN IPSECKEY ( 10 0 2 . AQPl2UGDJvDff4BiJWFZoSuYrerisFXZdD6M+QPDtpuH i4rNmW+jqNGzF7k4orsggHyaglXSN2llTb0dTCwBamX8 [...] dVbEHKz2sWdESIA2YNVqtPirkdYA0MeyO8SwYgMvlmg3 E8JcNBbcndEZidrlfINzFs2GmugvNHHHX6a7CPACNU0o E2mzXeDY3FUW2F2XvERTnQPpU9zl ) ;; AUTHORITY SECTION: [....] ;; ADDITIONAL SECTION: [....] ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Mar 11 17:41:17 CET 2014 ;; MSG SIZE rcvd: 590 35Monday 17 March 14
- 39. ©!Men!&!Mice!!http://menandmice,com! dbounds!BoF • Example!from!the!public!suffix!list *.uk *.sch.uk !bl.uk !british-library.uk !mod.uk !national-library-scotland.uk !nic.uk !parliament.uk ... • Discussion!in!the!BoF:!is!DNS!better!suited!to!hold!this!information!than!a!plain! list? • the!plain!list!needs!to!“guess”!administrative!boundaries,!whereas!domain!owner!can! specify!these!boundaries!in!their!DNS!zone • no!decisions!so!far,!discussion!will!continue!on!the!mailing-list(s) 38Monday 17 March 14
- 41. ©!Men!&!Mice!!http://menandmice,com! published!new!RFCs!since!last!IETF RFC Title Category 7031 DHCPv6 Failover Requirements Informal 7037 RADIUS Option for the DHCPv6 Relay Agent Standards Track 7078 Distributing Address Selection Policy Using DHCPv6 Standards Track 7083 Modification to Default Values of SOL_MAX_RT and INF_MAX_RT Standards Track 40Monday 17 March 14
- 52. ©!Men!&!Mice!!http://menandmice,com! published!new!RFCs!since!last!IETF RFC Title Category 7045 Transmission and Processing of IPv6 Extension Headers Standards Track 7048 Neighbor Unreachability Detection Is Too Impatient Standards Track 7050 Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis Standards Track 7059 A Comparison of IPv6-over-IPv4 Tunnel Mechanisms Informational 7094 Architectural Considerations of IP Anycast Informational 7136 Significance of IPv6 Interface Identifiers Standards Track 7112 Implications of Oversized IPv6 Header Chains Standards Track 7123 Security Implications of IPv6 on IPv4 Networks Informational 51Monday 17 March 14
- 54. ©!Men!&!Mice!!http://menandmice,com! Stable!IPv6!Interface!Identifiers • the!draft!“Privacy!Considerations!for!IPv6!Address!Generation! Mechanisms” (draft-ietf-6man-ipv6-address-generation-privacy)!discusses!privacy! and!security!considerations!for!several!IPv6!address!generation! mechanisms • correlation!of!activities!over!time • location!tracking • address!scanning • device-specific!vulnerability!exploitation 53Monday 17 March 14
- 56. ©!Men!&!Mice!!http://menandmice,com! Why!“/64”? • IPv6!subnets!are,!with!the!exception!of!loopback!and!point-to-point! connections,!of!size!/64 • RFC!7136!states!that!"For!all!unicast!addresses,!except!those!that!start!with!the! binary!value!000,!Interface!IDs!are!required!to!be!64!bits!long." • “Analysis!of!the!64-bit!Boundary!in!IPv6!Addressing” (draft-carpenter-6man-why64)!discusses • why!the!“/64”!size!was!chosen • why!network!administrators!ask!for!other!subnet!sizes!(prefixes!longer!than!/64) • what!will!break!if!IPv6!is!configured!with!subnet!sizes!other!than!“/64” 55Monday 17 March 14
- 58. ©!Men!&!Mice!!http://menandmice,com! Unknown!IPv6!Extension!header IPv6 header next=43 (routing) Routing header next=123 (??) TCP payload Destination Option header next=6 (tcp) Unknown header next=60 (dest option) unknown size Middle-box! cannot!find!TCP! port! information 57Monday 17 March 14
- 60. ©!Men!&!Mice!!http://menandmice,com! SLAAC!and!DHCPv6 • DHCPv6/SLAAC!Address!Configuration!Interaction!Problem!Statement!( draft-ietf-v6ops-dhcpv6-slaac-problem) • DHCPv6/SLAAC!Interaction!Operational!Guidance!Considerations! (draft-liu-v6ops-dhcpv6-slaac-guidance) • Guidance!for!DHCPv6-only!Deployment • Guidance!for!SLAAC-only!Deployment • Guidance!for!DHCPv6/SLAAC!Co-exist!Deployment • DHCPv6/SLAAC!Interaction!Implementation!Guidance!(draft-liu-6man- dhcpv6-slaac-implementation-guide) 59Monday 17 March 14
- 63. ©!Men!&!Mice!!http://menandmice,com! Reducing!multicast!in!IPv6 •Multicast!can!be!expensive!in!terms!of!energy!consumption! on!certain!link-layer!technologies! (e.g.!W-LAN) • IPv6!neighborhood!discovery!relies!heavily!on!link-local!multicast • other!protocols!like!multicast-dns!can!create!equally!or!more!multicast! traffic • the!IETF!6ops!and!6man!working-groups!discuss!options!to! replace!the!use!of!multicast!in!these!networks!with!alternatives! (unicast) 62Monday 17 March 14