RIPE 68 Webinar

©!Men!&!Mice!!http://menandmice,com!

RIPE!68!Report

28.!May!2014

http://www.menandmice.com



RIPE!Meeting

•A!RIPE!Meeting!is!a!five-day!event!where!Internet!Service!Providers!(ISPs),!network!operators!and!other!interested!parties!from!all!over!the!world!gather.

•Meeting!website:!https://ripe68.ripe.net/



https://ripe68.ripe.net

https://ripe68.ripe.net


Agenda

•RIPE!68!(and!DNS-OARC)!in!Warsaw!

•DNS!/!DNSSEC!/!DANE

•DHCP

•IPv6

All!mentioned!slides!and!videos!will!be!linked!on!the!webpage!to!this!webinar




DNS-OARC

Domain!Name!System!Operations!Analysis!and!Research!Center




IETF!work!on!DNS!privacy

• RFC!7258!-!'Pervasive!Monitoring!is!an!Attack'

• IETF!reviews!existing!protocols!for!privacy!issues

• current!DNS!has!privacy!issues!(passive!monitoring!at!resolvers!and!(root-)servers)

• Possible!solutions!discussed!in!an!IETF!mailing!list

• QNAME!minimization

• DNS!encryption:!DNScurve,!DNScrypt,!"confidential!DNS",!"DNS!over!TLS!over!TCP",!"DNS!over!DTLS"

Stéphane!Bortzmeyer



https://indico.dns-oarc.net//contributionDisplay.py?contribId=0&confId=19

https://indico.dns-oarc.net//contributionDisplay.py?contribId=0&confId=19


T-DNS!(DNS!over!TLS!over!TCP)

• why!DNS!over!TCP:privacy,!DDoS,!UDP!limits

• backward!compatibleSTARTTLS-like!approach

• memory!cost!of!encrypted!connections:!

• 20!GB!on!a!busy!cache,!

• 80!GB!at!a!root-server

• 19-33%!slower!than!UDP!(without!encryption)

• TCP!connection!speedup!possible!with!to!connection!reuse,!pipelining!out-of-order!processing

John!Heidemann




Zeroing!in!on!Zero!Days

• information!(statistics)!on!recent!DDoS!attacks!(January!-!April!2014)

• attacks!with!random!looking!names!on!(mostly)Chinese!domains

• attackers!use!open!CPE!resolvers!to!launch!attacks,!creating!peaks!of!traffic!for!ISP!resolvers

Bruce!van!Nice




Anycast!on!a!shoe!string

• how!to!run!a!low-cost!DNS!anycast!network!(less!than!<!US$!1000!yr)

• using!VPS!(virtual!private!server)

• or!small!boxes!like!RaspberryPi

• possible,!but!you!need!to!know!BGP

Nat!Morris




dnstap

• metadata!logging!framework!for!DNS!query/response!data

• better!data!than!"querylog"

• less!performance!impact!on!DNS!server!operation

• patch!sets!for!Unbound!and!KNOT

• http://dnstap.info/!

Robert!Edmons



http://dnstap.info

http://dnstap.info


Performance!impact!of!contained!and!virtualized!environments!in!Authoritative!DNS!Servers

• measurements!of!DNS!deployments!in!virtual!machines

• bridged!NICs!vs.!sr-iov/virtio

• HyperThread!(HT)!vs!real!cores

• container!VMs!(LXC)!create!less!overhead!than!!“full”!VMs!

• tested!recent!versions!of!Knot,!NSD,!BIND!9

• BIND!9!performs!better!on!Haswell,!Knot/NSD!better!on!!Ivy!BridgeCPU

Joao!Damas




Zonemaster

•new!DNS!data!check!engine,!based!on!“DNS-Check”!(.se)!and!“Zonecheck”!(.fr)

•!(will!be)!written!in!Perl,!BSD-style!License

•!Specification!and!requirement!documents!done

•!https://github.com/dotse/zonemaster!

Patrik!Wallstrom



https://github.com/dotse/zonemaster

https://github.com/dotse/zonemaster


Open!Source!Working!Group

RIPE!68!Warsaw




Knot!DNS!update• Knot!=!authoritative!DNS!server!from!cz.nic!(Open!

Source)

• DNSSEC!automatic!signing

• modules!that!hook!into!the!query/answer!chain!(GeoIP,!"views",!High!Availability!for!backend!servers!...)

• Synthesized!Resource!Records,!fall!back!if!records!are!not!found!in!the!zone!file

• DNSSEC!Key!&!Signing!Policy

• Online!Signing

• PKCS#11!support!(HSM)

• switch!from!OpenSSL!to!GnuTLS!(software!diversity)

Ondřej!Surý




The!Decline!and!Fall!of!BIND!10

• the!story!of!the!BIND!10!work!at!ISC

• post-mortem!analysis!of!“what!went!wrong”!on!a!failed!project

• lessons!for!open!source!and!closed!source!projects

• BIND!10!has!two!children:

• KEA!DHCP!(ISC)

• Bundy-DNS

Shane!Kerr



https://ripe68.ripe.net/presentations/208-The_Decline_and_Fall_of_BIND_10.pdf

https://ripe68.ripe.net/presentations/208-The_Decline_and_Fall_of_BIND_10.pdf


Kea!-!a!modern!DHCP!engine• current!ISC!DHCP!code!is!getting!

old

• Kea!is!the!new!ISC!DHCP!server,!originally!part!of!the!BIND!10!project

• now!stand-alone

• SQL-Database!backend

• BIND!10!framework!is!being!removed!(Python!dependencies)

Tomek!Mrugalski


DANE!+!SMTP

•watch!out!for!the!June!2014!Men!&!Mice!webinar!




getdnsapi

• getdnsapi!-!DNS!resolver!library!for!applications

• DNSSEC!and!related!technologies!(DANE,!SRV-Records!...

Willem!Toorop

• new!Applications!using!getdnsapi:

• Gajim!XMPP!client

• DNSSEC!“name-and-shame”!website

• DANE!doctor!website

• verify’EM!Thunderbird!plugin!(DKIM!check)




IPv6!Working!Group!(and!Plenary!sessions!on!IPv6)

RIPE!68!Warsaw




Painting!by!numbers

•graphical!IPv6!address!planning

•every!square!represents!bits!in!an!IPv6!address

• easy!to!see!aggregate-able!subnet!allocations

Helge!Holz




Painting!by!numbers!(demo)

pre-release code!




IPv6!Troubleshooting!for!Helpdesks

Jan!Zorz

• website!to!test!IPv6!connectivity

• document!to!support!remote!troubleshooting!of!connection!issues

• intended!for!the!ISP!support!helpdesk!(but!could!be!useful!for!others)

http://isp.test-ipv6.com






Security!in!an!IPv6!World:!Myth!&!Reality

Chris!Grundemann

• overview!of!IPv6!security!misconceptions

• mainly!by!people!not!running!IPv6



https://ripe68.ripe.net/presentations/190-IPv6SecurityMyths_RIPE68_May2014.pdf





What!went!wrong!with!IPv6?

Dave!Wilson

• connecting!IPv6!deployment!speed!with!the!“Innovators!Dilemma”

• and!the!1980ies!harddrive!market

•mobile!apps!(APIs)!will!drive!IPv6!adoption

•no!user!visible!IPv6






what!else?

RIPE!68!Warsaw




bettercrypto.org

•collaborative!work!on!crypto!best!practices

• ciphers,!keystrength,!key-rollovers

•for!various!products

• Apache,!nginx,!postfix,!exim,!dovecot,!OpenSSH,!IPSec,!PGP,!Jabber/XMPP,!Oracle,!MySQL!...!

L.!Aaron!Kaplan




cryptech.is

• current!hardware!security!module!(HSM)!vendors!might!not!be!trustworthy

• free,!documented!and!verifiable!HSM!design!(not!the!hardware)

• FPGA!based

• work!on!free,!assured!toolchain

• diverse!design!team

• open!and!transparent!process

Randy!Bush




Q/A

?Slides,!Links,!Recording!and!Errata!will!be!posted!@

https://www.menandmice.com/resources/educational-resources/webinars/



Technology

RIPE 68 Webinar