Subject: Re: draft-ietf-dnsext-dnssec-intro-09: EDNS0 issue

From: Paul Vixie <[email-masked]>
Date: Mon, 08 Mar 2004 05:02:50 +0000

> > no, that really would force tcp, which really would be worse than ip-frag.
> 
> If message size is 1400B or so, it is definitely so.
> 
> If message size is 4200B or so, it can still be a valid argument.
> 
> However, if message size is 64000B, TCP is far better than IP-frag.

yes, that's true.  the crossover is probably closer to 4*PMTU.

> I understand the problem is not of DNSSEC but of EDNS0.
> 
> But with the current EDNS0 specification lacking rational upper
> limit on message size, it will be safe if DNSSEC says:
> 
> 	messages over UDP MUST NOT be larger than 4000

it can't be a MUST NOT or it modifies the EDNS0 spec, which is out of scope.
perhaps we should reissue EDNS0 with a recommendation like 4*EPMTU (where E
is for Estimated) but this isn't the time or place to make that change.

so perhaps an advisory statement like "Note: advertising a buffer size larger
than EPMTU could lead to unfortunate overaggressive IP fragmentation" would
be enough to tell the dnssec implementor crowd -- who is likely to be the
first real stress-testers of EDNS0's buffer size extension -- what they need
to know, without actually amending the EDNS0 specification by side effect.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 08 Mar 2004 06:29:28 +0000

> I meant
> 	DNSSEC entities MUST NOT send messages larger than 4000
> 	over UDP
> 
> Can it be within the scope of DNSSEC?

then it would be within scope for this docset, but extremely controversial
since it places a requirement more stringent than EDNS0.  far better to make
it advisory and avoid the fight.

> > perhaps we should reissue EDNS0 with a recommendation like 4*EPMTU
> > (where E is for Estimated) but this isn't the time or place to make
> > that change.
> 
> If EDNS0 is to be changed (in the future, of course), reference to
> PMTUD should be clarified (removed entirely), because EDNS0 seemingly
> assumes fragmentation is always enabled, which means there is no room
> for PMTUD, which means, with IPv6, packets must be fragmented at the
> source.
> 
> Or, if you think some form of PMTUD should be performed, it should be
> documented (though I think PMTUD practically impossible).

i think that you're right and that all hope of PMTUD should be abandoned
in the next update of EDNS, which at this point would be EDNS1 rather than
a reissue of EDNS0.

---

From: Paul Vixie <[email-masked]>
Date: Sat, 13 Mar 2004 00:58:15 +0000

> Given 1280B of IPv6 minimum MTU, shouldn't message size limitation
> be somewhere around 3600 or 4800, but not 4000?

i think it's all very approximate and 4000 is a very fine and round number.

---

From: Paul Vixie <[email-masked]>
Date: Mon, 08 Mar 2004 05:02:50 +0000

---

From: Paul Vixie <[email-masked]>
Date: Mon, 08 Mar 2004 06:29:28 +0000

---

From: Paul Vixie <[email-masked]>
Date: Sat, 13 Mar 2004 00:58:15 +0000