Subject: Re: [dnsext] Support for EDSN0 PING

From: Paul Vixie <[email-masked]>
Date: Mon, 01 Jun 2009 00:24:23 +0000

> From: Mark Andrews <[email-masked]>
> Date: Mon, 01 Jun 2009 10:04:24 +1000
> 
> > >   * extended RCODEs (but I'm not sure about that)
> 
> 	extended RCODEs were badly done.  We should have had a basic
> 	rcode which indicated that there was a extended rcode in the
> 	OPT record.  Concatentating the bits was a bad idea.

agreed, but i don't think we'll see a change to this in EDNS1 (or ever.)

> > > What does not work:
> > > 
> > >   * the official fallback algorithm (section 5.3)
> 
> 	It actually works quite well 99.999% of the time.  It doesn't
> 	work when you talk to non RFC 1034 compliant servers or you
> 	have firewalls that interfere with DNS UDP messages.
> 
> 	To work around non-compliant servers and firewalls a second
> 	fallback algorithm is needed to take into account timeouts.

maybe a BCP on this would be of general interest to the community?

> > >   * large responses (interoperability problems, DoS amplification)
> 
> 	Moving to SCTP won't get rid of the DoS amplification problem
> 	as we can never stop servicing UDP/53 queries.  BCP 38
> 	deployment is the best way to stop DoS amplifications.

BCP38 is even less likely than universal switchover from UDP/53 to SCTP,
so let's take a fresh look.  SCTP isn't spoofable in the way UDP/53 is,
so the thing you can get DoS-amp'd with is SCTP setup packets, which are
small and which could potentially be handled by a hardware front end far
upstream of protection-worthy servers.

in other words SCTP is my hope for making secure robust reliable DNS
connectivity possible for cooperating on-the-ball up-to-date operators,
because otherwise we've just got UDP/53 (with or without EDNS) and
TCP/53, neither of which can be made robust or reliable (ever, period).

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>