Report from IETF 89 in London - DNS, DHCP and IPv6
•
4 j'aime•2,511 vues
The IETF, Internet Engineering Task Force, those that are working on new Internet Standards, met in London in March 2014. In this webinar, Carsten Strotmann from the Men & Mice Services team reports fresh from the IETF meeting. This session distills interesting developments from the DNS, DHCP and IPv6 working groups. What can be expected: DNS -DNS transport encryption -Special Names in DNS -Simplifying DNSSEC key trust anchor exchange between child and parent - EDNS option updates -Passive DNS -DNSSEC Validator Requirements -DNS cookies DNSSEC/DANE -Using DANE to Associate OpenPGP public keys with email addresses - IPSec and DNSSEC/DANE - DANE Security for MX and SRV records - DANE and smtp IPv6 -Reducing Multicast in IPv6 Neighbor Discovery -IPv6 Operational Guidelines for Data centers -Recommendations of Using Unique Local Addresses -DHCPv6/SLAAC Interaction Operational Guidance -Sunsetting IPv4 DHCP -DHCPv6 Load Balancing and Failover -DHCP stateless reconfiguration -Dynamic Allocation of Shared IPv4 Addresses -Customizing DHCP Configuration on the Basis of Network Topology
Recommandé
Contenu connexe
Similaire à Report from IETF 89 in London - DNS, DHCP and IPv6
Similaire à Report from IETF 89 in London - DNS, DHCP and IPv6 (20)
Plus de Men and Mice
Plus de Men and Mice (20)
Dernier
Dernier (20)
Report from IETF 89 in London - DNS, DHCP and IPv6
- 3. ©!Men!&!Mice!!http://menandmice,com! Agenda • IETF!89!in!London! • DNS • DNSSEC!/!DANE • DHCP • IPv6 • the!following!information!is!an!excerpt!of!the!IETF!working!group! activities • for!a!full!overview!of!all!activities!at!IETF!89,!see! https://datatracker.ietf.org/meeting/89/materials.html 3Monday 17 March 14
- 5. ©!Men!&!Mice!!http://menandmice,com! published!new!RFCs!since!last!IETF RFC Title Category 6950 Architectural Considerations on Application Features in the DNS Informational 7043 Resource Records for EUI-48 and EUI-64 Addresses in the DNS Informational 7050 Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis Standards Track 7129 Authenticated Denial of Existence in the DNS Informational 5Monday 17 March 14
- 7. ©!Men!&!Mice!!http://menandmice,com! DNSE!BoF • the!problem!statement!has!been!presented!and!discussed • some!proposed!solutions!have!been!presented • DTLS!(TLS!for!UDP,!RFC!6347) • DNScrypt/DNScurve • CGA-TSIG • Confidential!DNS • t-DNS!(StartTLS!for!TCP!DNS) • discussion!continues!on!the!mailing!lists!(DNSOP)!about!possible!solutions!and! their!operational!impact 7Monday 17 March 14
- 9. ©!Men!&!Mice!!http://menandmice,com! DNSOP •Revived!documents: • DNSSEC!Key!Timing!Considerations! (draft-ietf-dnsop-dnssec-key-timing) • Explains!the!relationships!between!the!parameters!used!in!a! DNSSEC!key!rollover • important!for!implementers!of!DNSSEC!key-rollover!automation! software • and!DNS!administrators!that!plan!manual!DNSSEC!key!rollover 9Monday 17 March 14
- 11. ©!Men!&!Mice!!http://menandmice,com! Special!Names •“Special-Use!Domain!Names!of!Peer-to-Peer!Systems”! (draft-grothoff-iesg-special-use-p2p-names) • proposes!to!add!new!names!to!the!special-names!registry:!".gnu",! ".zkey",!".onion",!".exit",!".i2p",!and!!!".bit" • TOR • GNUnet • i2p • Namecoin 11Monday 17 March 14
- 14. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN A? Authoritative DNS Caching/Resolving DNS Attacker 14Monday 17 March 14
- 15. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN A? www.example.com IN A? + Resolver cookie in OPT Auth DNS server stores resolver cookie 15Monday 17 March 14
- 16. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN A? www.example.com IN A? + Resolver cookie in OPT Auth DNS server stores resolver cookie www.example.com IN A 192.0.2.1 + server cookie in OPT Cache DNS server stores auth-server cookie 16Monday 17 March 14
- 17. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN A? www.example.com IN A? + Resolver cookie in OPT Auth DNS server stores resolver cookie www.example.com IN A 192.0.2.1 + server cookie in OPT Cache DNS server stores server cookie www.example.com IN A 192.0.2.1 17Monday 17 March 14
- 18. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN AAAA? + Resolver cookie in OPT Auth DNS server has resolver cookie www.example.com IN AAAA 2001:db8::1 Cache DNS server has server cookie Attacker sends forged DNS data 18Monday 17 March 14
- 19. ©!Men!&!Mice!!http://menandmice,com! DNS!cookies www.example.com IN AAAA? + Resolver cookie in OPT Auth DNS server has resolver cookie www.example.com IN AAAA 2001:db8::1 Cache DNS server has server cookie Attacker sends forged DNS data 18Monday 17 March 14
- 22. ©!Men!&!Mice!!http://menandmice,com! getdnsapi • Platforms!as!of!IETF!89!! • RHEL/CentOS • MacOS • Soon!to!by!available: • FreeBSD! • iOS!(now!rough!but!usable)!! • In!view: • Windows,!Android 21Monday 17 March 14
- 27. ©!Men!&!Mice!!http://menandmice,com! DANE!in!Web-Browser • RFC!6698!-!The!DNS-Based! Authentication!of!Named!Entities! (DANE)!Transport!Layer!Security! (TLS)!Protocol:!TLSA • Plugin!for!Firefox,!Opera,!Chrome! and!Internet!Exporer!available! https://www.dnssec-validator.cz/ • Internet!sites!start!using!TLSA,!for! example https://packages.debian.org 26Monday 17 March 14
- 29. ©!Men!&!Mice!!http://menandmice,com! SMTP!TLSA •DANE!specifies!the!use!of!the!TLSA!resource!record!for! SMTP •can!make!TLS!connections!mandatory!between!servers!that! support!TLS •TLSA!resource!record!holds!a!hash!of!the!server!certificate shell> dig mx tidelock.de +short 10 ns3.tidelock.de. shell> dig _25._tcp.ns3.tidelock.de. tlsa +short 3 0 1 76AD75E4F300C2BACBDC9363A337A533F3B3C15CAAFED4E0010D5DD3 52B83935 28Monday 17 March 14
- 30. ©!Men!&!Mice!!http://menandmice,com! TLSA!in!Postfix •the!Postfix!Mail-Server!2.11!implements!DANE!TLSA!for!SMTP • Viktor!Dukhovni!from!the!Postfix!team!presented!on!the! challenges!of!implementing!TLSA!checking!in!applications • DANE!implementation!in!software!can!be!very!complicated!(easy!to!get! wrong) • should!be!handled!by!a!toolkit!(OpenSSL,!GnuTLS,!NSS!...) •Postfix!author!Wietse!Venema!presented!the!Postfix!TLSA! implementation!during!FOSDEM!2014!(1!February!2014) 29Monday 17 March 14
- 33. ©!Men!&!Mice!!http://menandmice,com! more!DANE!work •OpenPGP!keys!in!DNS • the!owner-name!of!the!OPENPGPKEY!Record!is!the!SHA224!hash! of!the!user!portion!of!an!E-Mail!address • the!user!part!of!an!E-Mail!address!can!contain!characters!illegal! in!DNS!names! • Example!(for!paul@nohats.ca) shell> echo -n "paul" | openssl dgst -sha224 ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66 SHA224! hash!of!the! username 32Monday 17 March 14
- 34. ©!Men!&!Mice!!http://menandmice,com! more!DANE!work • OpenPGP!keys!in!DNS • Example!(for!paul@nohats.ca) shell> dig -t TYPE65280 ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca +m ; <<>> DiG 9.9.4-P2 <<>> -t TYPE65280 ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca +m ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24851 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca. IN TYPE65280 ;; ANSWER SECTION: ab16de0656382d91838914109ab89a0a4e04321550a1a20ace7a8b66._openpgpkey.nohats.ca. 2822 IN TYPE65280 # 2527 ( 99010D033F7B0C3D00000107FF686BB69E18ACD31C38 0005F186CCF2BC9697CB87FDD4C5CD5DA994CB7E0958 7B57910637B89C9BC9FE697509798FA9BDFB638978F4 92F10999C3A595F6EF1BEE01BACE1C9F636D33B632D2 [...] 4356D7E7E6DF1AAF09075505380D20C3164276 ) ;; Query time: 6 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Mar 11 17:22:21 CET 2014 ;; MSG SIZE rcvd: 2646 OpenPGP! Key (Base64) DNSSEC! secured! private!record!type! for!experimental! new!protocols 33Monday 17 March 14
- 35. ©!Men!&!Mice!!http://menandmice,com! more!DANE!work •OpenPGP!keys!in!DNS • “milter”!plugin!for!postfix!and!sendmail: https://github.com/letoams/openpgpkey-milter/ • “hash-slinger”!tool!to!create!and!verify!“openpgpkey”!records: https://github.com/letoams/hash-slinger • also!available!in!Fedora!Linux shell> yum install hash-slinger 34Monday 17 March 14
- 36. ©!Men!&!Mice!!http://menandmice,com! IPSEC!in!DNS • opportunistic!(automatic!and!authenticated)!IPSec!VPN!tunnel!between!client! and!server • client!looks!up!the!server!public!key!in!DNS shell> dig ipseckey nohats.ca +m ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31467 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4 ;; QUESTION SECTION: ;nohats.ca. IN IPSECKEY ;; ANSWER SECTION: nohats.ca. 3591 IN IPSECKEY ( 10 0 2 . AQPl2UGDJvDff4BiJWFZoSuYrerisFXZdD6M+QPDtpuH i4rNmW+jqNGzF7k4orsggHyaglXSN2llTb0dTCwBamX8 [...] dVbEHKz2sWdESIA2YNVqtPirkdYA0MeyO8SwYgMvlmg3 E8JcNBbcndEZidrlfINzFs2GmugvNHHHX6a7CPACNU0o E2mzXeDY3FUW2F2XvERTnQPpU9zl ) ;; AUTHORITY SECTION: [....] ;; ADDITIONAL SECTION: [....] ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Mar 11 17:41:17 CET 2014 ;; MSG SIZE rcvd: 590 35Monday 17 March 14
- 39. ©!Men!&!Mice!!http://menandmice,com! dbounds!BoF • Example!from!the!public!suffix!list *.uk *.sch.uk !bl.uk !british-library.uk !mod.uk !national-library-scotland.uk !nic.uk !parliament.uk ... • Discussion!in!the!BoF:!is!DNS!better!suited!to!hold!this!information!than!a!plain! list? • the!plain!list!needs!to!“guess”!administrative!boundaries,!whereas!domain!owner!can! specify!these!boundaries!in!their!DNS!zone • no!decisions!so!far,!discussion!will!continue!on!the!mailing-list(s) 38Monday 17 March 14
- 41. ©!Men!&!Mice!!http://menandmice,com! published!new!RFCs!since!last!IETF RFC Title Category 7031 DHCPv6 Failover Requirements Informal 7037 RADIUS Option for the DHCPv6 Relay Agent Standards Track 7078 Distributing Address Selection Policy Using DHCPv6 Standards Track 7083 Modification to Default Values of SOL_MAX_RT and INF_MAX_RT Standards Track 40Monday 17 March 14
- 52. ©!Men!&!Mice!!http://menandmice,com! published!new!RFCs!since!last!IETF RFC Title Category 7045 Transmission and Processing of IPv6 Extension Headers Standards Track 7048 Neighbor Unreachability Detection Is Too Impatient Standards Track 7050 Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis Standards Track 7059 A Comparison of IPv6-over-IPv4 Tunnel Mechanisms Informational 7094 Architectural Considerations of IP Anycast Informational 7136 Significance of IPv6 Interface Identifiers Standards Track 7112 Implications of Oversized IPv6 Header Chains Standards Track 7123 Security Implications of IPv6 on IPv4 Networks Informational 51Monday 17 March 14
- 54. ©!Men!&!Mice!!http://menandmice,com! Stable!IPv6!Interface!Identifiers • the!draft!“Privacy!Considerations!for!IPv6!Address!Generation! Mechanisms” (draft-ietf-6man-ipv6-address-generation-privacy)!discusses!privacy! and!security!considerations!for!several!IPv6!address!generation! mechanisms • correlation!of!activities!over!time • location!tracking • address!scanning • device-specific!vulnerability!exploitation 53Monday 17 March 14
- 56. ©!Men!&!Mice!!http://menandmice,com! Why!“/64”? • IPv6!subnets!are,!with!the!exception!of!loopback!and!point-to-point! connections,!of!size!/64 • RFC!7136!states!that!"For!all!unicast!addresses,!except!those!that!start!with!the! binary!value!000,!Interface!IDs!are!required!to!be!64!bits!long." • “Analysis!of!the!64-bit!Boundary!in!IPv6!Addressing” (draft-carpenter-6man-why64)!discusses • why!the!“/64”!size!was!chosen • why!network!administrators!ask!for!other!subnet!sizes!(prefixes!longer!than!/64) • what!will!break!if!IPv6!is!configured!with!subnet!sizes!other!than!“/64” 55Monday 17 March 14
- 58. ©!Men!&!Mice!!http://menandmice,com! Unknown!IPv6!Extension!header IPv6 header next=43 (routing) Routing header next=123 (??) TCP payload Destination Option header next=6 (tcp) Unknown header next=60 (dest option) unknown size Middle-box! cannot!find!TCP! port! information 57Monday 17 March 14
- 60. ©!Men!&!Mice!!http://menandmice,com! SLAAC!and!DHCPv6 • DHCPv6/SLAAC!Address!Configuration!Interaction!Problem!Statement!( draft-ietf-v6ops-dhcpv6-slaac-problem) • DHCPv6/SLAAC!Interaction!Operational!Guidance!Considerations! (draft-liu-v6ops-dhcpv6-slaac-guidance) • Guidance!for!DHCPv6-only!Deployment • Guidance!for!SLAAC-only!Deployment • Guidance!for!DHCPv6/SLAAC!Co-exist!Deployment • DHCPv6/SLAAC!Interaction!Implementation!Guidance!(draft-liu-6man- dhcpv6-slaac-implementation-guide) 59Monday 17 March 14
- 63. ©!Men!&!Mice!!http://menandmice,com! Reducing!multicast!in!IPv6 •Multicast!can!be!expensive!in!terms!of!energy!consumption! on!certain!link-layer!technologies! (e.g.!W-LAN) • IPv6!neighborhood!discovery!relies!heavily!on!link-local!multicast • other!protocols!like!multicast-dns!can!create!equally!or!more!multicast! traffic • the!IETF!6ops!and!6man!working-groups!discuss!options!to! replace!the!use!of!multicast!in!these!networks!with!alternatives! (unicast) 62Monday 17 March 14