From owner-freebsd-net Sun Sep 22 20:50:10 2002 Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9682737B401 for ; Sun, 22 Sep 2002 20:50:09 -0700 (PDT) Received: from coconut.itojun.org (coconut.itojun.org [219.101.47.130]) by mx1.FreeBSD.org (Postfix) with ESMTP id F322A43E3B for ; Sun, 22 Sep 2002 20:50:08 -0700 (PDT) (envelope-from itojun@itojun.org) Received: from itojun.org (localhost [127.0.0.1]) by coconut.itojun.org (Postfix) with ESMTP id F1D0A4B24; Mon, 23 Sep 2002 12:50:03 +0900 (JST) To: Mark_Andrews@isc.org Cc: JINMEI Tatuya / =?ISO-2022-JP?B?GyRCP0BMQEMjOkgbKEI=?= , Juan Francisco Rodriguez Hervella , Lista , "(Lista) bind9-users@isc.org" In-reply-to: Mark_Andrews's message of Fri, 20 Sep 2002 15:48:53 +1000. <200209200548.g8K5mrB5067818@drugs.dv.isc.org> X-Template-Reply-To: itojun@itojun.org X-Template-Return-Receipt-To: itojun@itojun.org X-PGP-Fingerprint: F8 24 B4 2C 8C 98 57 FD 90 5F B4 60 79 54 16 E2 Subject: Re: RES_INSECURE and CHECK_SRVR_ADDR in resolver functions (IPv6 anycast response problem) From: itojun@iijlab.net Date: Mon, 23 Sep 2002 12:50:03 +0900 Message-Id: <20020923035004.F1D0A4B24@coconut.itojun.org> Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org > Yes, and I know why the restriction is in RFC 1884 and it > is a reasonable restriction. I don't think so, IP source address is easy to forge and it does not add any meaning protection. DNSSEC is the only way if you want trusted responsees. therefore, i agree with enabling RES_INSECURE1 by default. itojun To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message