> A rogue DHCPv6 server can add entries to that file, but can't delete
> them. Thus, it's possible for a bad DHCPv6 server to make life
> annoying for a client, but (at least for DNS) it can't prevent the client from
> eventually working.
The rogue DHCPv6 server can insert its DNS server as the preferred one. This
server can then silently drop all DNS queries except the selected ones. In such
case the resolver would silently fallback to use legitimate secondary DNS
servers in all other cases except then in the one attacker is targeting at.
Hence similar attack could be launched as with DNS server selection option.
> The option (as described in this draft) effectively "deletes" addresses
> from the list, by associating each address with a list of domains.
> Having that list present for a given server but with no domain match
> means no query will be sent to that server (or only "inappropriate"
> queries sent) -- as though it were removed.
I will address this risk.
> The shotgun approach you suggested in another reply may well fix that
> problem, but isn't in the current draft.
Luckily there are plenty of digits left for updates:)
Thank you for discussion!
Teemu
_______________________________________________
DNSOP mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsop
