Subject: Re: [DNSOP] Call for Adoption: draft-song-atr-large-resp

From: Mukund Sivaraman <[email-masked]>
Date: Wed, 6 Feb 2019 13:38:32 +0530

On Fri, Jan 18, 2019 at 06:55:16PM +0100, Benno Overeinder wrote:
> Please review this draft to see if you think it is suitable for
> adoption by DNSOP, and comments to the list, clearly stating your
> view.

Considering that the method is implementable without any changes at a
resolver, and that it doesn't require compatible behavior among DNS
implementations ("protocol" or best practice), I suppose it does not
matter if this draft is adopted or not as long as the idea has been
described somewhere.

		Mukund

---

From: "Peter van Dijk" <[email-masked]>
Date: Thu, 07 Feb 2019 15:41:04 +0100

> matter if this draft is adopted or not as long as the idea has been

While it can be implemented on an auth without changes to resolvers, 
doing that would severely impact operation of all resolvers.

I think it’s important to repeat that not only do I oppose adoption - 
any implementation, no matter the status of the document, will be 
*actively harmful to the DNS at large*. Please do not implement this.

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/

---

From: Paul Vixie <[email-masked]>
Date: Thu, 7 Feb 2019 09:29:21 -0800

Peter van Dijk wrote on 2019-02-07 06:41:
> ...

to be fair, the harm in terms of icmp noise would be to the whole 
internet, not just to the dns.

-- 
P Vixie

---

From: Mukund Sivaraman <[email-masked]>
Date: Fri, 8 Feb 2019 00:39:27 +0530

Hi Peter

On Mon, Jan 21, 2019 at 11:22:00AM +0100, Peter van Dijk wrote:
> The draft doubles the number of packets involved in a legitimate
> exchange; it more than doubles the number of packets involved in a
> spoofed exchange. About half of these packets are ICMP
> packets. Without the draft, ICMP packets are useful debugging aids,
> and in big numbers, indications of attacks or operational
> problems. With the draft, ICMP becomes another useless source of
> background noise.

I had implemented the draft about a year ago as a server-side patch for
BIND so that it could be tried/tested. But I was not aware of the ICMP
issue that you mentioned. Today I looked at a packet capture with ATR
response and sure enough, the 2nd truncated response generates an ICMP
message from the recipient. I agree that this would be noisy.

		Mukund

---

From: 神明達哉 <[email-masked]>
Date: Thu, 7 Feb 2019 11:39:30 -0800

At Fri, 8 Feb 2019 00:39:27 +0530,

> message from the recipient. I agree that this would be noisy.

Probably off topic in the context of the adoption call, but I'd note
that it depends on some implementation details of the resolver.  ICMP
port unreachable errors will be likely to be increased if the resolver
closes the UDP socket for a query with an authoritative server
immediately after it receives a return packet.  BIND behaves that way
by default, so did PowerDNS recursor when I checked the implementation
many years ago (it probably still does).  But not all resolver
implementations adopt this practice; if I understand it correctly
Unbound uses a pool of (many) UDP sockets and reuse the same socket
for multiple queries.  I've not tested it myself but I believe you
won't see an increase of ICMP errors with such resolver
implementations.

--
JINMEI, Tatuya

---

From: Benno Overeinder <[email-masked]>
Date: Thu, 14 Feb 2019 16:58:22 +0100

The call for acceptance for draft-song-atr-large-resp is closed, and it
is clear that there is insufficient support to adopt the concept as a
DNSOP WG document.

There was some concern about the increased number of packages involved
in a legitimate exchange (half of them being ICMP messages, introducing
other concerns) and that the problem space is too narrow to burden all
resolvers.

We would like to thank the authors and WG participants who responded to
the call for adoption on the mailing list.

Best regards,

-- Benno
DNSOP co-chair

On 18/01/2019 18:55, Benno Overeinder wrote:
> Dear DNSOP WG,
> 
> We discussed this work (draft -01) in Montreal, and different opinions wrt. adoption were expressed.  In the past months, the authors pushed a draft version -02 that addressed and resolved some of these comments.  
> 
> This starts a Call for Adoption for:
> draft-song-atr-large-resp
> 
> The draft is available here:
> https://datatracker.ietf.org/doc/draft-song-atr-large-resp/
> 
> Please review this draft to see if you think it is suitable for adoption by DNSOP, and comments to the list, clearly stating your view.
> 
> Please also indicate if you are willing to contribute text, review, etc.  The WG accepts the document or not, but the WG chairs also expect a commitment from the WG participants who support the document to contribute to the draft, review, etc.
> 
> The intended status of the draft is Experimental, but we want to ask developers/vendors if they plan to implement it.   
> 
> This call for adoption ends: 1 February 2019
> 
> Thanks,
> 
> Benno Overeinder
> DNSOP co-chair
> 
> 
> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Davey Song(宋林健) <[email-masked]>
Date: Mon, 18 Feb 2019 12:14:20 +0800

Thanks Benno. Thanks all reviewers for your time reviewing ATR draft. I'm
sorry it is not adopted in WG but I still think the draft and the peer
reviews help us to understand the problems better.

Davey
> -----邮件原件-----
> 发件人: DNSOP [mailto:[email-masked]] 代表 Benno Overeinder
> 发送时间: 2019年2月14日 23:58
> 收件人: [email-masked]
> 主题: Re: [DNSOP] Call for Adoption: draft-song-atr-large-resp
> 
> The call for acceptance for draft-song-atr-large-resp is closed, and it is
clear
> that there is insufficient support to adopt the concept as a DNSOP WG
> document.
> 
> There was some concern about the increased number of packages involved in
a
> legitimate exchange (half of them being ICMP messages, introducing other
> concerns) and that the problem space is too narrow to burden all
resolvers.
> We would like to thank the authors and WG participants who responded to
the
> call for adoption on the mailing list.
> 
> Best regards,
> 
> -- Benno
> DNSOP co-chair
> 
> 
> > We discussed this work (draft -01) in Montreal, and different opinions
wrt.
> adoption were expressed.  In the past months, the authors pushed a draft
> version -02 that addressed and resolved some of these comments.
> >
> > Please review this draft to see if you think it is suitable for adoption
by DNSOP,
> and comments to the list, clearly stating your view.
> >
> > Please also indicate if you are willing to contribute text, review, etc.
The
> WG accepts the document or not, but the WG chairs also expect a commitment
> from the WG participants who support the document to contribute to the
draft,
> review, etc.
> >
> > The intended status of the draft is Experimental, but we want to ask
> developers/vendors if they plan to implement it.
> >