Re: [dnsext] draft-vandergaast-edns-client-ip-00.txt

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Wilmer 
van der Gaast writes:
> On 2 February 2010 18:06, Jim Reid <[e-mail]> wrote:
> >
> > So, your idea of optional behaviour in some circumstances is to increase DNS
> > latency and generate extra queries. I see...
> >
> Are you trying to say that EDNS0 options should only ever be used for
> extensions designed to slow things down?
> 
> Sadly the EDNS0 spec doesn't really describe what an implementation
> should do if it sees an unsupported option. So far most of them seem
> to just ignore data they don't understand, which is the sanest thing
> to do IMHO. A few are different and return something like FORMERR or
> just drop the packet altogether.

Define EDNS1 so that unknown option behaviour is well defined and
forget about EDNS0.  EDNS0 servers are supposed to return BADVER
to EDNS1 queries regardless of their payload.  This is defined in
EDNS0.  EDNS0 servers that fail to return BADVER are broken and
their vendors should be fixing them.  Unknown EDNS options behaviour
is undefined in EDNS0 so FORMERR is a legitimate response.  Also
the point of BADVER was to allow a pair of servers to work out what
each supported without having to do a big trial and error dance.

This working group has be remiss in not using EDNS versioning to
signal capabilities properly.

> I've dealt with firewalls that drop
> any DNS packet with EDNS0 information, getting BIND to work well on
> such a network was pretty hard since BIND couldn't be told to disable
> EDNS0 globally.

Actually you can disable EDNS globally in all current version of
BIND.  That said you should be replacing / upgrading / reconfiguring
the firewall.  Cisco and other firewall vendors ship firewalls that
are EDNS aware.
 
> If we want to block DNS extensions because of existing broken
> implementations, what's the point of developing anything new at all?
> 
> Wilmer.
> 
> -- 
> Wilmer van der Gaast, Dublin Traffic SRE.
> Google Ireland.
> 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]