Re: [DNSOP] default value of draft-ietf-dnsop-avoid-fragmentation

[Viktor Dukhovni <[e-mail]>]

On Mon, Mar 15, 2021 at 05:38:40PM +0000, Jim Reid wrote:

> > However, operators of DNS servers SHOULD measure their path MTU to
> > well-known locations on the Internet, such as [a-m].root-servers.net
> > or [a-m].gtld-servers.net at setting up the servers.
> 
> I think it would be better to replace this with “Operators of DNS
> servers MAY measure their path MTU.”.

Sadly, we don't have a keyword that's midway between MAY and SHOULD, I
used to think that RECOMMENDED was it, but I was disabused of that
mistake some time back.  I think that the suggestion to measure the
path MTU is good advice.

The key thing to note is that in the resolver case this is only
applicable to full-service resolvers that directly query public
authoritative servers, and in the authoritative server case this
applies to servers serving public-Internet facing zones.

> Measuring the MTU to well-known locations on the Internet won’t be
> appropriate for some use cases. For instance inside private nets that
> aren’t connected to the Internet or for forwarding-only servers that
> never query an authoritatve server.

Right, the forwarding-mostly (or only) servers should just measure the
PMTU to the relevant upstream(s).

> IMO it’s a bad idea to recommend specific servers that could be the
> target for those PMTU probes. [Suppose those names change one day -
> unlikely for the above but you never know.] That could become a vector
> of (D)DoS attacks - probably not on the above name servers themselves
> but on the access routers in front of them that might well be
> rate-limiting ICMP packets.

I don't see the DDoS, such measurements should be rather infrequent, in
particular, I don't see why these would be much more frequent than root
zone priming queries, which full service resolvers do routinely at
startup.

> This could get nasty with icky CPE
> firmware: imagine every home router in (say) Comcast’s net doing PMTU
> to the same root server.

These would generally not all boot up at the same time, and would be
expected to be configured in forward-only mode to the relevant Comcast
iterators.

> Besides, is the PMTU to a root or .com server, going to be the same as
> that for the example.whatever name servers?

But the proposal remains sound, because that server also measures its
PMTU to the root, and assuming PMTU reduction happens mostly at the
respective edges of the network, and not in the core, the lower of
the two PMTUs to some suitable core nodes would typically also be
the PMTU end-to-end between them.

Thus if a full-service iterator bases its EDNS UDP size on its PMTU
to the core, and the authoritative server replies with a size that
is at most its respective PMTU, you'll most often end up with a
workable lower-bound.

> If PMTU is to be used, maybe it needs to be applied to all
> authoritative name servers a resolver queries?

Not needed, on the assumption that the path from each to the
core is as "wide" as the path from either a common core node.

-- 
    Viktor.