Subject: Re: draft-ietf-dnsext-dnssec-intro-09: EDNS0 issue

From: Masataka Ohta <[email-masked]>
Date: Mon, 08 Mar 2004 13:47:21 +0900

Paul;

> no, that really would force tcp, which really would be worse than ip-frag.

If message size is 1400B or so, it is definitely so.

If message size is 4200B or so, it can still be a valid argument.

However, if message size is 64000B, TCP is far better than IP-frag.

I understand the problem is not of DNSSEC but of EDNS0.

But with the current EDNS0 specification lacking rational upper
limit on message size, it will be safe if DNSSEC says:

	messages over UDP MUST NOT be larger than 4000

							Masataka Ohta

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Pekka Savola <[email-masked]>
Date: Mon, 8 Mar 2004 07:37:47 +0200 (EET)

[ Moderators note: Post by non-subscriber.  With the massive amount of
   spam, it is easy to miss and therefore delete relevant posts 
   by non-subsrcibers. Please fix your subscription addresses. ]

On Mon, 8 Mar 2004, Paul Vixie wrote:
> > With DNSSEC, I'm not sure that this holds anymore.  It seems to me
> > that the best behaviour would be to avoid IP fragmentation by having
> > correct implementations of EDNS0, and if some data must be left out,
> > that it would be fetched separately, over second, third, ..., nth
> > query over UDP.  Shouldn't that be possible and reasonable?
> 

Seems like a flaw in DNS spec -- too coarse granularity:
 1) "everything fits in one UDP datagram", or
 2) "just use TCP".

Would it make sense to add 1.5) there, "if it doesn't fit to a UDP 
datagram of specific size, query again, but only the missing data this 
time".

Not sure if that would make sense but instead of forcing everything in 
one, probably fragmented message, it would seem to encourage "proper" 
operation with big DNS replies.

Btw: note that IPv6 implementations aren't even required to defragment 
a datagram which is larger than 1500 bytes once assembled.. so we're 
in a bit murky waters here.  I'd certainly want to try to avoid packet 
sizes >= ~1500.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 08 Mar 2004 13:47:21 +0900

Paul;

							Masataka Ohta

---

From: Pekka Savola <[email-masked]>
Date: Mon, 8 Mar 2004 07:37:47 +0200 (EET)