Contrail vDNS: DNS DDOS exposure

[tom murray]

This is with contrail 2.10/26

My customer reported today that the Contrail vDNS was exploited to be used as part of a DDOS attack on a external 3rd party. I do not have full details yet, but i suppose that this would follow something like the recursion exploit described here: http://www.watchguard.com/infocenter/editorial/41649.asp

We need to follow best practices for DNS configuration, for example following the recommendations described at https://www.us-cert.gov/sites/default/files/publications/DNS-recursion033006.pdf

[tom murray (tmurray-a)]

Specifically, the /etc/contrail/dns/named.conf on the vDNS nodes has recursion set to "any"...this must be restricted!!!

options {
    directory "/etc/contrail/dns/";
    managed-keys-directory "/etc/contrail/dns/";
    empty-zones-enable no;
    pid-file "/etc/contrail/dns/named.pid";
    listen-on port 53 { any; };
    allow-query { any; };
    allow-recursion { any; };
    allow-query-cache { any; };
};

[tom murray (tmurray-a)]

suggest to see http://www.zytrax.com/books/dns/ch9/close.html

[Nipa (nipak)]

To avoid DDOS attacks, recursion can be disabled at global level in /etc/contrail/dns/contrail-named.conf and restarts the service.

1)/etc/contrail/dns/contrail-named.conf
  options {
     .....
     recursion { none } ;

   }

2) service contrail-named restart

As the contrail implementation allows only authoratative views, it has all the records in the cache for the domain/sub domain it is responsible for. This will result in VMs not being able to reach the external world, but local learnt DNS records will be resolved.

[Nipa (nipak)]

Any rogue queries even from an allowed-client i.e compute, can result in other queries being timeout, similar to a DDOS attack but from an allowed client.

Need to explore if "Response Rate Limiting" may be the way to rate limit queries and avoid DDOS attack both internally and externally.

https://ftp.isc.org/isc/bind/cur/9.9/doc/arm/Bv9ARM.ch06.html

[Nipa (nipak)]

RRL will avoid DDOS attacks, this config is not present in current named version, we need to upgrade named version.

[Nipa (nipak)]

DNS bind is updated to version: BIND 9.10.4-P2 <id:7658a94>, this by default has recursion depth is set to 7.

commit f0be25508bb078e55c1e771d75282172ef365ae4
Author: Hari <email address hidden>
Date: Tue Aug 30 12:24:12 2016 +0530

    Use new bind version.

    Change-Id: Id16ff19bcf345f0024aeff9a393bb5bab1c62948
    partial-bug: #1617945

[Nipa (nipak)]

Also in addition if one wants recursion disabled, contrail-named-base.conf can be updated and named restarted.

commit 0ceda0a025d694f69c95f02363311a30dc10c1da
Author: Nipa Kumar <email address hidden>
Date: Tue Aug 16 17:16:38 2016 -0700

    Support dynamic configuration update of named

    An additional file contrail-named-base.conf will contain the base named configurtion
    such as options stanza, key stanza, controls stanza and logging stanza.

    All configs generated due to vdns configuration resulting in view stanza will be written
    to contrail-named.conf

    Before sending "reconfig" command to named, both the files will be merged
    into contrail-named.conf

    The above gives flexibility to user to update and apply changes without restarting
    the dns daemon which generated the contrail-named.conf

    An additional helper script(applynamedconfig.py) will merge the files and apply the
    config(contrail-named-base.conf) to named daemon.

    Change-Id: If6089189a1104f648d8d7d3f638c58f9883deb50
    Closes-Bug:1605341