Subject: [dnsext] draft-vandergaast-edns-client-ip-00 and combining queries

From: Michael Graff <[email-masked]>
Date: Wed, 31 Mar 2010 19:04:52 -0500

BIND 9 will combine queries currently.  That is, if a query for foo.com
is already in progress another query from a client will cause it to
merge into that same work item.  I think this was likely a premature
optimization, but my gut also tells me that this is going to be very
useful for DNSSEC validation, which can take a while and requires a bit
of work.  There is no need to ask org 100 times for isc.org after all
just because 100 clients asked for it in rapid succession.

Now, with this client-ip idea, it seems this may no longer work as
expected.  Many more queries may be issued to servers which otherwise
would be pooled together.

I know this is a single implementation's issue perhaps, but it is
something that may be an observable change in the wild.

- --Michael

---

From: Paul Vixie <[email-masked]>
Date: Thu, 01 Apr 2010 02:23:40 +0000

> Date: Wed, 31 Mar 2010 19:04:52 -0500
> From: Michael Graff <[email-masked]>
> 
> is already in progress another query from a client will cause it to merge
> into that same work item.  I think this was likely a premature
> optimization, ...

it's necessary and correct in the face of dns birthday attacks.

	https://www.kb.cert.org/vuls/id/457875

> ... but my gut also tells me that this is going to be very useful for
> DNSSEC validation, which can take a while and requires a bit of work.
> There is no need to ask org 100 times for isc.org after all just because
> 100 clients asked for it in rapid succession.

agreed.

> would be pooled together.

client-ip is a bad idea for other better reasons than this.

> something that may be an observable change in the wild.

and it's not a single implementation's issue.