Subject: [dnsext] draft-ietf-dnsext-rfc2671bis-edns0

From: "George Barwood" <[email-masked]>
Date: Thu, 1 Oct 2009 07:27:45 +0100

I have a comment regarding section 8, Security Considerations.

http://tools.ietf.org/html/draft-ietf-dnsext-rfc2671bis-edns0-02#section-8

There is no mention of amplification attacks on third parties.
There is also no mention of attacks on fragmented IP packets.

I suggest that implementors / operators should be warned about
these attacks, and guidelines for mitigating these attacks
be included, my initial suggestion being :

<<

Servers must set a limit on the maximum UDP payload size.
Values higher than this limit MUST be treated as equal to
the limit.

The limit must not be higher than 4096 bytes.

The default limit should be no higher than the de-facto
internet MTU ( 1500 bytes ) less IP+UDP Overhead ( normally
 28 bytes ), and preferably less.

Operators may set a higher limit, no higher than 4096 bytes,
and preferably less.

Operators may also set a lower limit. However too low a limit
may result in an unacceptable increase in TCP traffic.

This should not be taken as an endorsement of the EDNS UDP
Payload size mechanism, since I am opposed to it and advocate
a different approach, but if we are going to have it, proper
limits should be set.

George