Re: [DNSOP] partial glue is not enough, I-D Action: draft-ietf-dnsop-glue-is-not-optional-00.txt

John R Levine <johnl@taugh.com> Thu, 02 July 2020 14:50 UTC

Return-Path: <johnl@taugh.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 21DB03A086C for <dnsop@ietfa.amsl.com>; Thu, 2 Jul 2020 07:50:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.1
X-Spam-Level:
X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=iLjSq7Kx; dkim=pass (1536-bit key) header.d=taugh.com header.b=vxBKRiYY
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YPfUQMHcK92t for <dnsop@ietfa.amsl.com>; Thu, 2 Jul 2020 07:50:25 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A08D23A084D for <dnsop@ietf.org>; Thu, 2 Jul 2020 07:50:25 -0700 (PDT)
Received: (qmail 9172 invoked from network); 2 Jul 2020 14:50:23 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:references:mime-version:content-type:user-agent; s=23d2.5efdf42f.k2007; i=johnl-iecc.com@submit.iecc.com; bh=99Y2Aexi1K5fPg9xxtTjh6oF3QmaWk4nMOIvbQYopcI=; b=iLjSq7KxoqSGmNNY9gbUKOwINstk4rKYLv4mnSaXeuwHADP02bG20RyAMwdpJh+sV2Xg2nVR8VJV1IqQjYRUSgILJ18O6q4OYxN1FVrvgoTX//8tHu7YvMUKcwSHoBsWrQrZGP2oUJ592bEt0HIShM5ocZVwVQiwKDHWtCpabMTIvwdkTuONKNCXmdwYxCO0Hm5O/4u9CrFsuB2pIKpopqXcZduwR6QkIGmH19dF4z9KdUWSCHKiFLYJK3F3Exb+
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:references:mime-version:content-type:user-agent; s=23d2.5efdf42f.k2007; olt=johnl-iecc.com@submit.iecc.com; bh=99Y2Aexi1K5fPg9xxtTjh6oF3QmaWk4nMOIvbQYopcI=; b=vxBKRiYYD/gN0moNGl0UzwXejxQQuUV38Rx5jenJjh96bLMYAQ5jSxkbN1SGbL7dUG7fZbEGZG8WCHZhMIKoJyQHhsjy9obwD1ZWzcz92I2pZHdNUyaEAWC+zjJxm48qy9Nh8bWtnLDosMM8K0ODu+XFpSzzlLpqSVMdpWMoDMgaE2OVI+4AZ1pFsMgFI65ikbxza2BQalXZV539cxpSBeBHVJJVo2XSSg/j/XV/MxOvFm83VIRTafM913jKunO8
Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPSA (TLS1.3 ECDHE-RSA AES-256-GCM AEAD, johnl@iecc.com) via TCP6; 02 Jul 2020 14:50:23 -0000
Date: 2 Jul 2020 10:50:24 -0400
Message-ID: <alpine.OSX.2.22.407.2007020949360.96330@ary.qy>
From: "John R Levine" <johnl@taugh.com>
To: "Paul Vixie" <paul@redbarn.org>, dnsop@ietf.org
In-Reply-To: <2843010.V8yvLItfke@linux-9daj>
References: <20200702011816.D4B0D1C3CD10@ary.qy> <2843010.V8yvLItfke@linux-9daj>
User-Agent: Alpine 2.22 (OSX 407 2020-02-09)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/Oa7aLS-xNBZ0pAQaHIfhFNzqj64>
Subject: Re: [DNSOP] partial glue is not enough, I-D Action: draft-ietf-dnsop-glue-is-not-optional-00.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Jul 2020 14:50:28 -0000

On Thu, 2 Jul 2020, Paul Vixie wrote:

> until someone invents faster than light travel, round trips and remote state
> will be the second and third most expensive things on the internet. (the most
> expensive thing is complexity.) i think we can usefully discuss whether to set
> TC=1 if the only thing that won't fit is glue, but some glue did fit. but our
> goal should be to allow smart initiators to avoid retrying with TCP out of
> reflex. my recommendation of TC=0 is to suppress reflexive TCP retries.

I wouldn't disagree but it seems to me once again it's a tradeoff between 
performance and correctness.  I'd prefer correctness, particularly since 
it seems that the option to use what's in a truncated referral gets you 
both.

> 3. even without TC=1 you will know there's under-zonecut glue you didn't
> receive, because you saw the NS RR, and the only path to the address RR is
> through that NS RRset.

Well, maybe.  Even if you got one A record there might be others.  Or if 
you got an AAAA record but no A record and you're on an IPv4 network, you 
can't tell whether there's a lurking A record or not, or vice-versa. 
(See the glue for j.zdnscloud.com in the root.)

If we do it your way, if any NS is in-zone and the lookups fail, you 
*always* need to do a TCP query just to see if if the UDP response left 
something out.

R's,
John

PS: I'm less worried about round-robin DNS, since then it's clearly a
deliberate decision by the parent to leave some of the answers out.