Re: I-D ACTION:draft-ietf-dnsext-forgery-resilience-01.txt

[[e-mail] (Andreas Gustafsson]

bert hubert wrote:
> >    Implementations MUST use an as large as possible pool of UDP source
> >    ports for sending queries
> > 
> > Perhaps SHOULD? Because this basically means that implementations have to use
> > 1024 to 65535 doesn't it?
> 
> This is basically a knob you can turn.  If you turn it to '1 source port',
> you get the current situation as with BIND and Nominum CNS, Windows DNS etc.

That's not what the draft actually says.  If you "MUST use an as large
as possible pool of source ports", turning the knob to anything other
than the maximum would violate the MUST.

Let me once again voice my strong objection to this requirement.  For
one thing, it means that on any host running a DNS resolver, it would
be impossible to later add any other UDP-based services, because all
the UDP ports would already be taken.  The ability to provide multiple
services on a single host is one of the fundamental properties of the
IP protocol suite that make it useful.  Even saying that a single
protocol MAY or SHOULD monopolize all UDP ports would be antisocial
towards other protocols; saying that it MUST do so is just ridiculous.
-- 
Andreas Gustafsson, [e-mail]

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>