IETF Logo Mail Archive

Re: [DNSOP] I-D Action: draft-ietf-dnsop-server-cookies-00.txt

Philip Homburg <pch-dnsop-3@u-1.phicoh.com> Mon, 09 September 2019 14:56 UTC

Return-Path: <pch-b9D3CB0F5@u-1.phicoh.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88B9B12022D for <dnsop@ietfa.amsl.com>; Mon, 9 Sep 2019 07:56:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.499
X-Spam-Level:
X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.399, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YVs_f7XorRnj for <dnsop@ietfa.amsl.com>; Mon, 9 Sep 2019 07:56:24 -0700 (PDT)
Received: from stereo.hq.phicoh.net (stereo6-tun.hq.phicoh.net [IPv6:2001:888:1044:10:2a0:c9ff:fe9f:17a9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE24712008B for <dnsop@ietf.org>; Mon, 9 Sep 2019 07:56:23 -0700 (PDT)
Received: from stereo.hq.phicoh.net (localhost [::ffff:127.0.0.1]) by stereo.hq.phicoh.net with esmtp (TLS version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384) (Smail #157) id m1i7L5a-0000JaC; Mon, 9 Sep 2019 16:56:22 +0200
Message-Id: <m1i7L5a-0000JaC@stereo.hq.phicoh.net>
To: dnsop@ietf.org
Cc: Willem Toorop <willem@nlnetlabs.nl>
From: Philip Homburg <pch-dnsop-3@u-1.phicoh.com>
Sender: pch-b9D3CB0F5@u-1.phicoh.com
References: <156802477017.28268.17780089460480647573@ietfa.amsl.com> <86ff56cd-c936-0a81-b276-f4fd61635c7f@nlnetlabs.nl> <m1i7Jym-0000HKC@stereo.hq.phicoh.net> <8ba1ccc7-ea65-e734-0d78-19486173edc5@nlnetlabs.nl>
In-reply-to: Your message of "Mon, 9 Sep 2019 16:08:24 +0200 ." <8ba1ccc7-ea65-e734-0d78-19486173edc5@nlnetlabs.nl>
Date: Mon, 09 Sep 2019 16:56:21 +0200
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/_5aNRN4WQic13Ttk21G5SfRNQ_4>
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-server-cookies-00.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Sep 2019 14:56:26 -0000

>This is true.  Including the Client IP in constructing the Client Cookie
>was intended to deal with this, but this operation is impractical with
>UDP; expensive at best and not suitable for high volume recursive to
>authoritative traffic.
>
>We could recommend it for stub to recursive traffic, for which the high
>volume performance requirements are less of an issue... what do you think?

Maybe high volume should be the exception.

I think it is better to specify that all code should include the Client IP
unless explicitly configured to leave it out.

A bit of testing suggests that a naive way of getting the Client IP takes 
about 2 microseconds on modern hardware. So a bit of caching on high 
performance resolvers would be enough.

v2.23.0 | Report a Bug | By Email