EDNS Compliance Mark Andrews marka@isc.org Motivation Deployed - - PowerPoint PPT Presentation

▶

Mar 09, 2024 228 likes •485 views

EDNS Compliance Mark Andrews marka@isc.org Motivation Deployed Experimental Version of DNS COOKIES (SIT) in BIND 9.10.0 Lookups for various zones failed due to mis-implemention of EDNS Trial and Error Takes time especially when requests

SLIDE 1

EDNS Compliance

Mark Andrews marka@isc.org

SLIDE 2

Motivation

Deployed Experimental Version

f DNS COOKIES (SIT)

in BIND 9.10.0 Lookups for various zones failed due to mis-implemention of EDNS

SLIDE 3

Trial and Error Takes time especially when requests are dropped New EDNS option are not the only EDNS extensions people are wishing to use. Decided to see what mis-behaviour is out there.

SLIDE 4

DataSets

Root and TLD servers
Alexa Top 1000
Alexa Bottom 1000 of Top 1Million
GOV servers from Alexa Top 1Million
AU servers from Alexa Top 1Million

SLIDE 5

Methodology

dig +norec +noedns soa zone @server dig +norec +edns=0 soa zone @server dig +norec +edns=1 +noednsneg soa zone @server dig +norec +ednsopt=100 soa zone @server dig +norec +ednsflags=0x80 soa zone @server dig +norec +dnssec soa zone @server dig +norec +dnssec +bufsize=512 +ignore dnskey zone @server dig +norec +edns=1 +noednsneg +ednsopt=100 soa zone @server

SLIDE 6

Faults Detected 1/2

OPT only returned when DO=1 is present in the request
BADVER not returned to EDNS (1)
NOTIMP returned when a EDNS option is present
FORMERR returned when a EDNS option is present
BADVERS returned when a EDNS option is present
NOTIMP returned when a EDNS Z flag is present
FORMERR returned when a EDNS Z flag is present
BADVERS returned when a EDNS Z flag is present
EDNS option echoed back

SLIDE 7

Faults Detected 2/2

OPT not returned in truncated response
EDNS (1) queries being dropped
EDNS queries with a Z bit being dropped
EDNS Z bits in queries echoed back
TCP response size limited to EDNS UPD response size
Truncated UDP response when send when response will not fit
Fragmented responses being blocked
DO=1 not returned by DNSSEC aware servers

SLIDE 8

EDNS Aware Servers - 18 Mar 2015 EDNS Aware TLD Top Bottom GOV AU 25 50 75 100 99.63 95.8 88.64 98.01 95.73 Data Subset %

SLIDE 9

EDNS Compliance Report: 2015-03-19T05:19:26Z

A EDNS aware server is one which returns a EDNS response to at least one of the test queries. A active server is one which returns a response to one of the test queries. Inactive servers are discarded when calculating the EDNS aware percentages. 2014-09-11: Cloudflare replaced server software which only returned a EDNS response when DO was set to one in the request to a server which ignores EDNS in the request. 2014-10-10: Stopped setting AD=1 in test queries. 2014-10-29: Cloudflare restored EDNS support.

Percentage of responding servers that are EDNS aware Root and TLD Servers Alexa Top 1000 Servers Alexa Bottom 1000 Servers Alexa .GOV Servers Alexa .AU Servers Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 80 85 90 95 100

SLIDE 10

EDNS Compliance by Function - 18 Mar 2015 EDNS 0 Truncated Response DNSSEC Unknown Option Unknown Flag EDNS 1 Fully Compliant TLD Top Bottom GOV AU 25 50 75 100 Data Subset %

SLIDE 11

EDNS Compliance Report: 2015-03-19T07:46:51Z

Percentage of EDNS aware servers that passed all EDNS compliance tests Root and TLD Servers Alexa Top 1000 Servers Alexa Bottom 1000 Servers Alexa .GOV Servers Alexa .AU Servers Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 50 60 70 80 90 100

SLIDE 12

EDNS Compliance Report: 2015-03-19T05:19:26Z

(dig +ednsopt=100 +norec soa $zone @$server) expect: status: NOERROR expect: SOA record to be present expect: OPT record to be present expect: OPT=100 to not be present See RFC6891, 6.1.2 Wire Format

Percentage of EDNS aware servers that handled unknown EDNS(0) options correctly Root and TLD Servers Alexa Top 1000 Servers Alexa Bottom 1000 Servers Alexa .GOV Servers Alexa .AU Servers Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 80 85 90 95 100

SLIDE 13

EDNS Compliance Report: 2015-03-19T07:46:51Z

(dig +ednsopt=100 +edns=1 +norec soa $zone @$server) expect: status: BADVERS expect: SOA record to NOT be present expect: OPT record to be present expect: OPT=100 to not be present expect: EDNS Version 0 in response See RFC6891

Percentage of EDNS aware servers that handled unknown EDNS(1) options correctly Root and TLD Servers Alexa Top 1000 Servers Alexa Bottom 1000 Servers Alexa .GOV Servers Alexa .AU Servers Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 60 70 80 90 100

SLIDE 14

EDNS Response Rate by Function - 18 Mar 2015 EDNS 0 Truncated Response DNSSEC Unknown Option Unknown Flag EDNS 1 TLD Top Bottom GOV AU 25 50 75 100 Data Subset %

SLIDE 15

EDNS Compliance Report: 2015-03-19T05:19:26Z

Percentage of responding servers that responded to a EDNS(0) request with a unknown option Root and TLD Servers Alexa Top 1000 Servers Alexa Bottom 1000 Servers Alexa .GOV Servers Alexa .AU Servers Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 92 94 96 98 100

SLIDE 16

EDNS Compliance Report: 2015-03-19T05:19:26Z

2014-10-12 - 2014-10-15: Domaincontrol removed the firewall blocking EDNS version 1 and EDNS flags.

Percentage of responding servers that responded to a plain EDNS(1) request Root and TLD Servers Alexa Top 1000 Servers Alexa Bottom 1000 Servers Alexa .GOV Servers Alexa .AU Servers Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 76 82 88 94 100

SLIDE 17

EDNS Compliance Report: 2015-03-19T05:19:26Z

2014-10-12 - 2014-10-15: Domaincontrol removed the firewall blocking EDNS version 1 and EDNS flags.

Percentage of responding servers that responded to a EDNS(0) request with a unknown flags Root and TLD Servers Alexa Top 1000 Servers Alexa Bottom 1000 Servers Alexa .GOV Servers Alexa .AU Servers Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 90.0 92.5 95.0 97.5 100.0

SLIDE 18

EDNS Compliance Report: 2015-03-19T05:19:26Z

Root and TLD EDNS(1) Failure Reasons refused,version timeout soa status status,version, soa version status,version status,soa Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 0.0 2.5 5.0 7.5 10.0

SLIDE 19

EDNS Compliance Report: 2015-03-19T05:19:26Z

2014-09-14: operators returning unknown flags informed.

Root and TLD EDNS(0) Unknown Flags Failure Reasons version mbz timeout nosoa servfail,nosoa status,version, nosoa refused,nosoa Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 0.0 2.5 5.0 7.5 10.0

SLIDE 20

EDNS Compliance Report: 2015-03-19T05:19:26Z

Root and TLD EDNS(0) Unknown Option Failure Reasons badvers,nosoa timeout status,echoed badvers formerr,echoed, nosoa servfail status,version version status formerr,echoed nosoa status,version,… servfail,nosoa Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 0.0 0.3 0.6 0.9 1.2

SLIDE 21

EDNS Compliance Report: 2015-03-19T05:19:26Z

EDNS(0) all EDNS queries have timeout and there was a response to the plain DNS query EDNS(1) only the two EDNS version 1 queries timeout EDNS(1) + FLAGS the two EDNS version 1 queries timeout as well as the unknown EDNS flags query

Root and TLD Firewalls by Type EDNS(1) EDNS(0) EDNS opt EDNS opt + EDNS(1) Combined EDNS opt + FLAGS EDNS(1) + FLAGS EDNS opt + EDNS(1) + FLAGS Sep 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 0.0 2.5 5.0 7.5 10.0

SLIDE 22

Where Next

Extend draft-andrews-no-response-issue

(Working group adoption?)

Contact Firewall Vendors
Contact Nameserver Vendors
Contact Zone Owners / DNS hosters
Convince TLD/SLD operators to run regular

checks

Add to online DNS checkers.

SLIDE 23

SWITCH – CH and LI .IE

TLDs already involved

SLIDE 24

More Information

http://users.isc.org/~marka/ts.html
http://users.isc.org/~marka/tld-report.html
http://users.isc.org/~marka/gov-report.html
http://users.isc.org/~marka/au-report.html
http://users.isc.org/~marka/alexa-report.html
http://users.isc.org/~marka/bottom-report.html
https://source.isc.org