Subject: [dnsext] http://tools.ietf.org/id/draft-ietf-dnsext-dnsproxy-01.txt

From: Edward Lewis <[email-masked]>
Date: Wed, 14 Jan 2009 11:00:19 -0500

From reading this draft I get the impression that proxies should "do 
nothing" to the DNS messages they see.  But apparently the proxies 
are there for a reason.  So, my question is, what are proxies 
"allowed" to do.

If the proxy's job is to lift the DNS message from one subnet to 
another (up and over a router), then the proxy ought to not touch 
anything in the DNS message (endangering the TSIG for example).  The 
proxy can change what's in the UDP header (assuming just UDP for 
now), like the source address but the port number, if randomized, has 
to be somewhat free to change.  Perhaps the proxy does it's own 
randomization.

If the proxy's job is to pass only clean DNS messages, then there's a 
lot of education to do, helping define what "clean" is.  The odd 
thing to me is that the definition of a "clean" message is already 
scattered in public document, without some specific idea of what is 
usually mucked up a recommendation or reinforcement is hard to do.

If the proxy's job is to protect the network from incoming bad DNS 
packets, including stateful proxies which are essentially recursive 
caches outright, these have to be a lot smarter and know the tricks 
of the protocol.  These would be the most invasive (least 
transparent).

I'm saying this because the introduction is a bit too short or loose 
to set the problem domain in my mind.  Perhaps examples of "bugs" 
(without naming vendors or course) would help.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Never confuse activity with progress.  Activity pays more.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Wed, 14 Jan 2009 17:24:46 +0000

Ed,

Firstly - thanks for reviewing the draft!

> are there for a reason.  So, my question is, what are proxies 

To quote the draft:

"The role of the proxy should therefore be no more and no less than to 
receive DNS requests from clients on the LAN side, forward those verbatim 
to one of the known upstream recursive resolvers on the WAN side, and 
ensure that the whole response is returned verbatim to the original 
client."

> to be somewhat free to change.  Perhaps the proxy does it's own 

Yes, the proxy's job is to "lift the DNS message", as you put it.

The vast majority of consumers rely on their broadband gateways to provide 
*all* network settings in a "plug and play" manner via DHCP.  However at 
boot-up most routers don't know what the upstream resolver addresses are 
going to be.  The "safe" option therefore for the vendors is for them to 
put the router's own LAN address in the DHCP offer, and then proxy the 
packets once they've learned the upstream settings via DHCP / PPP-IPCP, 
etc.

That's where it all starts to go wrong, since their code for proxying the 
packets (especially the responses) leaves much to be desired.

> usually mucked up a recommendation or reinforcement is hard to do.

Yes, that's partly what I'm trying to do with this draft - provide a 
consolidated list of what implementers need to know to be clean w.r.t. 
current standards.

> of the protocol.

Yes.  But protocols evolve, and vendors are prone to obsoleting products 
and ceasing firmware updates :(

> These would be the most invasive (least transparent).

Indeed. 
 
> (without naming vendors or course) would help.

Look for the word "observed" in the draft.  Most instances describe bugs 
found whilst doing the testing for SAC035.

There is more detail in SAC035 itself, but it's not (currently) my intent 
to provide more detail within the draft itself.

cheers,

Ray

-- 
Ray Bellis, MA(Oxon)
Senior Researcher in Advanced Projects, Nominet
e: [email-masked], t: +44 1865 332211

---

From: Mark Andrews <[email-masked]>
Date: Thu, 15 Jan 2009 23:33:29 +1100

> to be somewhat free to change.  Perhaps the proxy does it's own 

	A proxy can change the id of a message.  This is actually
	necessary to enable proper identificatin of replies.  This
	will not impact of TSIG as the id is explicitly excluded
	from the computation.
 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]