Subject: [DNSOP] draft-ietf-dnsop-edns-tcp-keepalive-05

From: joel jaeggli <[email-masked]>
Date: Thu, 7 Jan 2016 07:30:01 -0800

From Stephens discuss, this is a question we should probably answer for
ourselves. (it's no longer a consideration as a discuss.

  The question: how does this option play with DNS over
  DTLS? [1]

  The reason I ask is that there may be a need in that case
  for some similar option (or a TLS extension maybe) though
  for the DTLS session lifetime and not a TCP session
  lifetime. At present you are saying that this option is
  not it. And that's a fine answer but you could also have
  said that this could also be used for DTLS session
  lifetime handling. And that last might make sense for
  operational reasons (not sure really, but could be).

   [1] https://tools.ietf.org/html/draft-ietf-dprive-dnsodtls-03

My take personally is tcp keepalive option is not the mechanism for
dtls, but then we get multiple options specifying essentially the same
sort of value at some point in the future.

I just want to make sure we have a good reading on this.

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 21 Jan 2016 10:39:30 -0500

DNSOP,

Joel our AD sent this note out two weeks ago to get some working group 
consensus on this discussion which came up during the IESG telechat on 
tcp-keepalive

I am in agreement with Joel on this (tcp-keepalive is not the mechanism 
for DTLS), but it should be thought of.

any opinions? I'd like to get some resolution so we can move this along

thanks
tim

---

From: 🔓Dan Wing <[email-masked]>
Date: Mon, 25 Jan 2016 14:38:40 -0800

On 21-Jan-2016 07:39 am, Tim Wicinski <[email-masked]> wrote:
> 
> DNSOP,
> 
> Joel our AD sent this note out two weeks ago to get some working group consensus on this discussion which came up during the IESG telechat on tcp-keepalive
> 
> I am in agreement with Joel on this (tcp-keepalive is not the mechanism for DTLS), but it should be thought of.
> 

The TCP mechanism (edns-tcp-keepalive) negotiates the ability of the client and the server to send multiple DNS queries on the same TCP connection.  As such, it seems ill-named (that is, a title adjustment seems important).  This does not actually "keep the connection alive", which is the traditional meaning of "keepalive" in IETF protocols.  This EDNS0 option is useful for both DNS-over-TCP, as well as DNS-over-TLS-over-TCP.

For DNS-over-DTLS-over-UDP, we should not need to negotiate the client or server capability to send multiple DNS queries over the same DTLS connection; the mere act of negotiating DTLS indicates the ability to handle subsequent DNS queries using that same DTLS connection.  The same might also be true of DNS-over-TLS-over-TCP, in fact?  I mean, is there a client or a server that wants to use DNS-over-TLS-over-TCP and _not_ also have the ability to keep their TCP connection alive for later DNS queries over that same TLS connection?  Perhaps for both DNS-over-TLS, and DNS-over-DTLS, the semantics of edns-tcp-keepalive are implied?

-d

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: joel jaeggli <[email-masked]>
Date: Mon, 25 Jan 2016 23:53:42 -0800

On 1/25/16 2:38 PM, 🔓Dan Wing wrote:
>> Joel our AD sent this note out two weeks ago to get some working
>> group consensus on this discussion which came up during the IESG
>> telechat on tcp-keepalive
>> 
>> I am in agreement with Joel on this (tcp-keepalive is not the
>> mechanism for DTLS), but it should be thought of.
>> 
> The TCP mechanism (edns-tcp-keepalive) negotiates the ability of the
> client and the server to send multiple DNS queries on the same TCP
> connection.  As such, it seems ill-named (that is, a title adjustment
> seems important).  This does not actually "keep the connection
> alive", which is the traditional meaning of "keepalive" in IETF
> protocols.  This EDNS0 option is useful for both DNS-over-TCP, as
> well as DNS-over-TLS-over-TCP.
> 
> For DNS-over-DTLS-over-UDP, we should not need to negotiate the
> client or server capability to send multiple DNS queries over the
> same DTLS connection; the mere act of negotiating DTLS indicates the
> ability to handle subsequent DNS queries using that same DTLS
> connection.  The same might also be true of DNS-over-TLS-over-TCP, in
> fact?  I mean, is there a client or a server that wants to use
> DNS-over-TLS-over-TCP and _not_ also have the ability to keep their
> TCP connection alive for later DNS queries over that same TLS
> connection?  Perhaps for both DNS-over-TLS, and DNS-over-DTLS, the
> semantics of edns-tcp-keepalive are implied?

that is an interesting reading. though I'd want to hear an implementor
or two say they interpreted it that way.

>> thanks tim
>>> From Stephens discuss, this is a question we should probably
>>> answer for ourselves. (it's no longer a consideration as a
>>> discuss.
>>> 
>>> The question: how does this option play with DNS over DTLS? [1]
>>> 
>>> The reason I ask is that there may be a need in that case for
>>> some similar option (or a TLS extension maybe) though for the
>>> DTLS session lifetime and not a TCP session lifetime. At present
>>> you are saying that this option is not it. And that's a fine
>>> answer but you could also have said that this could also be used
>>> for DTLS session lifetime handling. And that last might make
>>> sense for operational reasons (not sure really, but could be).
>>> 
>>> My take personally is tcp keepalive option is not the mechanism
>>> for dtls, but then we get multiple options specifying essentially
>>> the same sort of value at some point in the future.
>>> 
>> _______________________________________________ DNSOP mailing list 
>> [email-masked] https://www.ietf.org/mailman/listinfo/dnsop
> 
> 
> _______________________________________________ DNSOP mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Sara Dickinson <[email-masked]>
Date: Tue, 26 Jan 2016 14:10:00 +0000

> On 26 Jan 2016, at 07:53, joel jaeggli <[email-masked]> wrote:
> 
>> 

The DNS-over-TLS draft (https://tools.ietf.org/html/draft-ietf-dprive-dns-over-tls-05) discusses this explicitly in section 3.4:

“Whereas client and server implementations from the [RFC1035 <https://tools.ietf.org/html/rfc1035>] era are
   known to have poor TCP connection management, this document
   stipulates that successful negotiation of TLS indicates the
   willingness of both parties to keep idle DNS connections open,
   independent of timeouts or other recommendations for DNS-over-TCP
   without TLS.  In other words, software implementing this protocol is
   assumed to support idle, persistent connections and be prepared to
   manage multiple, potentially long-lived TCP connections."

And then informationally references edns-tcp-keepalive and a mechanism that may be useful in signalling idle timeouts for long-lived TCP connections.

Sara.