Re: [DNSOP] Incompatibility with indicating client support for EDE (draft-ietf-dnsop-structured-dns-error)

Ralf Weber <dns@fl1ger.de> Tue, 23 May 2023 05:04 UTC

Return-Path: <dns@fl1ger.de>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71352C14CE55 for <dnsop@ietfa.amsl.com>; Mon, 22 May 2023 22:04:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id je2Olv0fHXtV for <dnsop@ietfa.amsl.com>; Mon, 22 May 2023 22:04:01 -0700 (PDT)
Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 8CF31C15106B for <dnsop@ietf.org>; Mon, 22 May 2023 22:03:59 -0700 (PDT)
Received: from [100.64.0.1] (p4fc217f3.dip0.t-ipconnect.de [79.194.23.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 48B345F40465; Tue, 23 May 2023 05:03:56 +0000 (UTC)
From: Ralf Weber <dns@fl1ger.de>
To: Tommy Pauly <tpauly=40apple.com@dmarc.ietf.org>
Cc: Mark Andrews <marka@isc.org>, dnsop <dnsop@ietf.org>
Date: Tue, 23 May 2023 07:03:52 +0200
X-Mailer: MailMate (1.14r5964)
Message-ID: <70B7A79D-9419-45C9-A4F7-CA3BCB8CB4D9@fl1ger.de>
In-Reply-To: <A474412D-191B-48BD-8FC4-E07578E9C487@apple.com>
References: <1BE5004E-B64D-407D-80F5-EB25D7BB671C@apple.com> <4A22932F-1980-438E-9B6A-176B82CECE50@isc.org> <A474412D-191B-48BD-8FC4-E07578E9C487@apple.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/EAwLSgcBs6C2mWKSblpi4NRCcos>
Subject: Re: [DNSOP] Incompatibility with indicating client support for EDE (draft-ietf-dnsop-structured-dns-error)
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 May 2023 05:04:03 -0000

Moin!

On 23 May 2023, at 4:44, Tommy Pauly wrote:

> Thanks, Mark.
>
> For what it's worth, I just ran two other tests, and for both of these cases, all of the resolvers I tried did accept the request:
> - Choose a new EDNS option code point (I just tested 50, randomly)
> - Use EDE but set the length to 2 and the error to 0 (other error), rather than a length of 0

I don’t think we need a new code point. Just having a valid opt record without a further option will work as RFC8914 states:

The Extended DNS Error (EDE) option can be included in any response (SERVFAIL, NXDOMAIN, REFUSED, even NOERROR, etc.) to a query that includes an OPT pseudo-RR [RFC6891]. This document includes a set of initial codepoints but is extensible via the IANA registry defined and created in Section 5.2.

and as the mechanism in draft-ietf-dnsop-structured-dns-error just defines a special format for the EDE EXTRA-TEXT field the most backward compatible solution IMHO is just to rely on the mechanism defined in RFC8914, and not to define any special handling.

So I would propose 5.1 to be:

When generating a DNS query, the client includes the OPT pseudo-RR [RFC6891] to elicit the Extended DNS Error option in the DNS response.


So long
-Ralf
——-
Ralf Weber