Be alert but not alarmed, DNSSEC rollout completes 6am tomorrow!

[mike-s]

original article here

For those who can't be arsed reading the article (tl-dr if you will), the way DNS works on the internet is a-changing and your old router or firewall may not be able to take the change in behaviour.

This change isn't likely to affect residential users as it's likely to be filtered/made transparent by your isp. But for those of us in corporate-world DNS is changing. DNSSEC rollout is nearing completion and as of tomorrow all root dns servers will give out digital signatures with every DNS request. For some old devices (or the networks behind them) the immediate effect is that DNS might magically stop as the reply size will increase from a maximum of 512 bytes to a total of 2k. The reason behind this is that originally it was assumed that the reply would never need to go above 512 bytes, so a lot of equipment automatically drops dns response packets that exceed that size.

Tomorrow may not affect you whatsoever, or it may be the day you realise you and your network are both up shit creek, you have been warned.

[cs-cam]

Originally Posted by mike-s

The reason behind this is that originally it was assumed that the reply would never need to go above 512 bytes, so a lot of equipment automatically drops dns response packets that exceed that size.

The reason is DNS currently used UDP for transport however with responses larger than 512 bytes (as of tomorrow, all of them) it falls back to TCP. If your firewall is only configured to allow UDP requests on port 53 then you're going to have problems. Anything else and you're fine.

[evilasdeath]

Changes will happen between 17:00 > 19:00 UTC

17:00:00 Wednesday May 5, 2010 in UTC converts to
03:00:00 Thursday May 6, 2010 in GMT+10

19:00:00 Wednesday May 5, 2010 in UTC converts to
05:00:00 Thursday May 6, 2010 in GMT+10

Thursdays the day in Australia

I think it could be an awesome start to Thursday more so than Wednesday if shit hits the fan.

[caironet16]

http://www.southparkstudios.com/clips/166182



But srsly, if this happens for real I will be super bored.

[Doc-of-FC]

DNSSEC was developed in an attempt to thwart 'man in the middle' attacks,

muahahaha, i dare you to connect to my open wifi network called internet... no im not running dnsspoof, no im not running sslstrip and no im not logging my network to pcap files

[mike-s]

Originally Posted by cs-cam

The reason is DNS currently used UDP for transport however with responses larger than 512 bytes (as of tomorrow, all of them) it falls back to TCP. If your firewall is only configured to allow UDP requests on port 53 then you're going to have problems. Anything else and you're fine.

I didn't realise there would be a whole fallback to tcp, you learn something new every day. Some people are going to be a whole new level of screwed,

Originally Posted by evilasdeath

Thursdays the day in Australia

I think it could be an awesome start to Thursday more so than Wednesday if shit hits the fan.

I'll blame my boss, he initially mentioned this as a problem that is going to happen today and i took his word on that *facepalm*

Originally Posted by Doc-of-FC;

muahahaha, i dare you to connect to my open wifi network called internet... no im not running dnsspoof, no im not running sslstrip and no im not logging my network to pcap files

Cruel yet malicious, i kinda like it!

[Falkor]

So how do we properly prepare for this then?

Is there any info anywhere?

I've been looking around, but am probably looking in the wrong places

[caironet16]

Originally Posted by Falkor

So how do we properly prepare for this then?

Is there any info anywhere?

I've been looking around, but am probably looking in the wrong places

All you can do is hope for the best. Hopefully everything just works but judging by the sheer vastness of the internet there is bound to be problems imo.

For instance if someone was waiting to launch a DDoS attack on the root DNS servers, they would probably wait until some of them go down for the upgrade and then target the remaining ones.

Apart from that the odd DNS server will probably fall over.

Maybe have a list of backup IP's ready just incase.

[Falkor]

Ok Well. For anyone interested. We run Cisco ASA's and have an MS network so we have MS DNS Servers.

By default on the ASA's its set to a max DNS Packet size of 512 bytes. (Well mine were)
I changed there here:

policy-map type inspect dns
parameters
message-length maximum 2048

And our MS DNS Servers weren't enabled for EDNS, which is required for >512 Bytes. So I followed the instructions here to do that:
http://technet.microsoft.com/en-us/l...30(WS.10).aspx

I found the test tool in the ITNews article helpful

[Doc-of-FC]

Originally Posted by caironet16

For instance if someone was waiting to launch a DDoS attack on the root DNS servers, they would probably wait until some of them go down for the upgrade and then target the remaining ones.

I'd wait till all servers were updated forcing all servers to generate 4x the previous amount of traffic and force the servers to use TCP in turn also increasing the network and processing overhead by the 3 step handshake + query.

if each zombie was designed to tarpit attack the server by waiting as long as possible before issuing a request this would again eat valuable resources across the root servers.

both attack methods can also be mitigated.

[evilasdeath]

Well i finally found some reading

http://www.root-dnssec.org/2010/05/03/status-update/

the 5th of may is just when J root starts handing out DURZ, every other name server has already been doing this for ages with no ill affects.

[mike-s]

The main reason this whole stink was being kicked up is that the last server that you could "fall back" to if the others didn't provide a satisfactory response for your system is now being upgraded to DNSSEC. Which means if you have network gear that is not compatible with the new format and some upstream equipment isn't providing a reverse translation for you, you're in the shit.

[Iceman]

I'd really like a test to confirm my server 2003 dns and firewall can handle this.. none of the ones I've found are particularly conclusive.

[Falkor]

Well the world didn't end, so I think we are ok!

[gords]

It might take some time to see the results of the changes due to cached DNS results though.