Re: [DNSOP] 答复: Call for Adoption: draft-song-atr-large-resp

["Ralf Weber" <[e-mail]>]

Moin!

On 22 Jan 2019, at 9:50, Davey Song wrote:
> It is not rare. It is just under the water. You cannot run a ship 
> unaware of it, especially towards IPv6-only future. Here are some 
> pointer and number are given:
>
> [1] presents a 28.26% ~ 55.23% packets drop rate for IPv6 fragements. 
> [2] reports 10% of the paths between the vantage points and the 
> experimental setup filter IP fragments. [3] reports 37.45% of 
> endpoints used IPv6-capable DNS resolvers that were incapable of 
> receiving a fragmented IPv6 response. [4] Yeti testbed also observed 
> over 7% failure rate for queries against IPv6-only server during KSK 
> rollover using 100 probes. [5] is a IETF workgroup document of this 
> problem. It is **not** a rare operational problem.
You see on that listing that the more you go to an actual real world 
scenario the lower the impact gets. As soon as you add an IPv4 server 
the problem is gone. Now IMHO we should work on getting these rates 
where fragments are dropped down and not implement yet another 
workaround.

>> Ralf Weber: Having one v6 name server that will respond correct with 
>> fragments also solves the problem. I think the problem space is to 
>> narrow to burden this problem on all resolvers.
>
> Now 389 of v6 tld server including .org reply with large packets, 
> please check [Appendix]. I'm not sure how they can respond correct 
> currently when they need to add more content in answer section. I'm 
> told that a few large DNS operator using certain DNSSEC tool 
> generating a large DNSKEY RRset and RRSIG RRset.
Replying with large packets itself is not the problem. The problem is 
something in between mostly probably to either edge is dropping re 
assembling of fragmented packets. For some of the resolvers I run and my 
client network I just did a spot check and all v6 fragments get re 
assembled and I could used UDP with a large bufsize to get the DNSKEY 
for org. I event tried some of the more crazy ones with ~3k key set 
size. Again no problem. So it is possible to run IPv6 DNS server with 
large packet sizes over UDP.

So long
-Ralf
—--
Ralf Weber

Sample digs

; <<>> DiG 9.12.3-P1 <<>> DNSKEY +dnssec +bufsize=4096 org. +notcp 
@2001:500:48::1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36371
;; flags: qr aa rd; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;org.				IN	DNSKEY

;; ANSWER SECTION:
org.			900	IN	DNSKEY	256 3 7 
AwEAAcyu1vNojLO1vy6FYAqt3Jne4EGKO5io4MKuTuVYC6POTafpympF 
aRtFfaG3WNmU89psInAyLLy9cpZrf6Zv7H1jxkFHib899GEEIbd8XgW8 
oyHNgH5FrtB2LEGCaVXrPW8p2dASIgQ4EpDTZ8AxX0KWQYCyUtYYoMXD MOTKKKwZ
org.			900	IN	DNSKEY	256 3 7 
AwEAAc5srBkat5T3kAMjJUFqZsmkySlr1UF1sdxTTQ2F6R5zhmbJqYg7 
Y+SekXVi3Y7KgYD8sa14PGHMS0kHGcPTLlYwA7AzMY9U4BuabDYb90ys 
d+8n1PpDtf+BcYe4DuL1pCcOZPSeqko3yWUeu2fNzccBUtE0YazAypCf Sbztq+zT
org.			900	IN	DNSKEY	257 3 7 
AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1b 
dq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5 
T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsU 
ACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jI 
R2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tp 
dbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r 8ti6MNoJEHU=
org.			900	IN	DNSKEY	257 3 7 
AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw 
9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9p 
dPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgr 
sGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431 
msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8G 
ZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSn wXCNDXk0kk0=
org.			900	IN	RRSIG	DNSKEY 7 1 900 20190207152537 20190117142537 45404 
org. mme7P7ZpocftnBBra2q00nXAwKMQLg0UwY0eD9a9GMMbP0gw5K3D9/S4 
xluORkBZqSDBmd6FjuRKERT/TmLdET3A3R1hOTEtWLkuTlM92d3Ts4ds 
a31XVsyDGw1qiH1YMTaK2AbA0pOWHUj0GTzCnCdY3viDhquEsB2msDSA Ss8=
org.			900	IN	RRSIG	DNSKEY 7 1 900 20190207152537 20190117142537 9795 
org. NOfHL8wXeetoNN91jjOiET8lu4X/mxrRR4MeDA03oaQIRgNXGgB9Riz/ 
gcHm8hGivuxpaSGxbx4FTm5LO7hYFUuViC6oo06mdjhikmFeUfCqpdhs 
6TZfntaX0GpYGN4JpJBDIeMFlF0LFdDYqtt6r26Cc6zhebFVMUChgG2o 
6Ofvs/UeUppExO1UEeNULRAFqU7AEvxfsHyEhBbo5fKqBDBwz10UZ5bJ 
KSfXOgxI8wQyIR255AbQEwHxWGjTWnKico/Mrs0KnCp6EOCt5UahNKh9 
MxIWiAjjP6IljqHUOHN+XGWsf3Lq1AcGGAH+4GNK+3P6+wJwtVsHt69l rEOeNA==
org.			900	IN	RRSIG	DNSKEY 7 1 900 20190207152537 20190117142537 17883 
org. lYnkcCCWL7cJmtpifhwF7uhL3Aocj/L8Xp8jpqRcv4OBw1V5JcL0v9Lv 
wnWTc53fJzl+/yBTueC2/LMcQ4IbAXlK6+Aq9cePWopeawiTUjYK8LCE 
VK9xsfeYOUomKhTx27/ddIWhazmbfirWwGoC/uC44oirUrX59XCcyjB5 
lcqsilwmSLBjmgVaXY2Y7oWRC/UcDLXwd/uS5Nrnpux45ogtyz+vcBZy 
1UlmiwkDcrXyBxtrskmQwa7hj8nN+oq05qS8tffA+TZR4uss/biii6nS 
GcdILJkg/enXpEQpUKysyC89MekpisUtdwD3jVAhcdp4DHnR0/PxmxoZ CuDRKw==

;; Query time: 19 msec
;; SERVER: 2001:500:48::1#53(2001:500:48::1)
;; WHEN: Tue Jan 22 11:17:33 CET 2019
;; MSG SIZE  rcvd: 1625

; <<>> DiG 9.12.3-P1 <<>> bg. DNSKEY +dnssec +notcp 
@2a02:6a80::192:92:129:99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33260
;; flags: qr aa rd; QUERY: 1, ANSWER: 10, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;bg.				IN	DNSKEY

;; ANSWER SECTION:
bg.			3600	IN	DNSKEY	256 3 8 
AwEAAbXpGD+h+TW6apP80SyHGOBV31FC/Lp42tdfC/iHJwOa+ZP7tmPz 
e2kyG1GMIum6jLPlbc0b1GCKE8sToxVKnRbCAQhWMPCCKrkdLTBy2bRa 
kH83v1ppYYceJ3krKgo0fTQyf2kQM5nl/K50wVD11oRzVnnCEBDLKFkk khxucPPj
bg.			3600	IN	DNSKEY	256 3 8 
AwEAAc6p7Y3Ifw/8yPRGKYczPSyE4cqY+UNdHmt4Cn8YwOiCCGg/0Y9v 
KsyTJAMes8O2tB+7vSpV/5taL5EuifQr10lS5B8S5BlDUthUTq+9CECl 
LwFsBYOoZo49VsoiREbIgaesq21yG02JTt4s/QpClOlHWxu3Y3RhNPWP qH2lB8Wv
bg.			3600	IN	DNSKEY	257 3 8 
AwEAAbxtdZBrxUDnwczEYSDmiI7lMDDxsNB+OWGxldJYiVB5D/zQRqPb 
Og2qKGTYMqJ6jI1Dx2q1EWGSG3axrY/Sne9ja24p1FoKh6BTGz/QvbTn 
Q+DGnhamgBb26QN5zs89siGS9uft/8E/+2uK/5NcMBJFCtY1YbdoWBPg 
2TM2OLVDuY4kjIJHj/EUi9NsAYHaYQO1SKHcRVT4hsJ+sDypA3KnLRIp 
yHooo6rygpb1RmegRAM5cF1l4RwUwK1MTP4VemK5btsUZrRa2pOuhO24 
xHKvly7j08vx7MuW0kBEQwJDHZzwa+Z8+GN6DwxWdeAzdP3WdbCBMf6k 
Jsur+9+U+9PcbmTELOsRszDzEQhsTClnTRpoafdNDrTCBjEwhdcEKwM1 
fRXR1ig8GdCSCPevz0i9WYklN/bLte7uifPI+5yV7O+1B7Af7EUnDj7F 
ammyzA6joD6iy0FbKIkILae6FeqglS0SqYl6AX0tomUXQS8zwMFqd3b6 
OOLpbD1rfvGhBNNO/sRs0l+mgCx9xAvdHgRaUq/eijGiT0kJ4oaX6jgP 
ChoVrLMMhk2kyQ21pdYI9JXjjldjVqXxQWp2BpNyntWCKo8p6Qhb4kPq 
hndO3nBVj2bAtPFEx5vCXMYowUiPJ4G/0OUl7S3DTGBOXEoCRK8g8nSE 
a0pTIz17DUn376Kj
bg.			3600	IN	DNSKEY	257 3 5 
AwEAAblV90SQjp4rI9ZLQs3pwcvkmlEt0OogfuI5cm4l+b3fHGA3YtVU 
Tz8j6SzpMQR/psx5KzFzqIJc8YRdLJSFhiBaLxDYPltcjFSie71Ln2U0 
+PPn5NHqUzCYTysLtRG0sl8FHmFGEY4OmkevpDZCX9sscDdt0MfiVwoN 
23Ni3nHuSrGewgr0RI4nBrcrBWII7oAfhyZ9XKWmlZpRM8aNHA6hijix 
ZsSzTNYAfr9r+s/lpiDG2ybiju1H6sKhL/jY02UdMTFiLFdRZ6yuOzxw 
FXWQE/d7cSe5dSCYMU5EmD2Qy0nbGG0YSD9e0iehw01Fr70HfIV9uNXM 
zqHrrTyajMtlft/z9aUug5qIVxFSczNSRCyJedcJU+9OZUMj90yXQLeG 
2soa6QOfAUyYZLs9OgOIKoE0c7hQRIicPM5bK0ycUM3NTcIYUzDV8zZZ 
Fo0xaM1QEIMdXz4kCfFS6V4lUleufTCDTI0CkTq9g14ia464HFXb4WKD 
6eHl0hvnXAviPAqrma0K1iX9efjxiDumyAIJlm/plBL39CMuX/ENyER8 
XXqv9aXAAcdlN2EYsbejGJ262SjvGIMzEVoUKd9UqrnSe44w/2+lzL6a 
WYqFz6njejH6rbzcof2MoEt1QC47G80gZzFk/tn1mMIKKMbQyvMy7+6K 
HaTKSHnJCXr27klR
bg.			3600	IN	DNSKEY	256 3 5 
AwEAAatvnBmra+7zeBm9l13suknlkqymM+dxrFdopER/atXEXpeKon1l 
B9rWXtPTizfXo3UIXugeIF7sL0oLNeaNHmBe4pgvEIZCpokDOQ45Eqk+ 
VgAdskXSlF0X8QhxE1c24wX4lhyIm3hvd5KgOGtKT8OcX3kzol+iBjC4 JGFXWDqD
bg.			3600	IN	DNSKEY	256 3 5 
AwEAAepb8tfII3+xijlGEESRLxW9hDpBHjtqaO0dKLowX6Iz17s1Yrby 
d0EZc8NjuF251KDvixkm54F7mKI8rA5PBo9JCsvXQh9rbekEV3EDhOU8 
Eg/hIrVVCtHR5qWLVe1JEfBvicyUUQSZapQWVPP7MYXb2aZzB+jRIVsr ngGHmzD9
bg.			3600	IN	RRSIG	DNSKEY 5 1 3600 20190221090009 20190122090009 40422 
bg. hwC0VCeV6KQGyefOO1RBeurhXZX182lhA+bVfK62RCMiIXkABSJbMM5v 
qfX3RpaCb/WYW9d4g6eVVaH+oZ2swDpXSY1DVc7fH7vQ7zNsW8yDh2Bt 
dN+5F6H+pFFYhxwsa1NjnlwhKVfK/ips0ogoh5OA0zjzbjztQYzagS4R 3ik=
bg.			3600	IN	RRSIG	DNSKEY 5 1 3600 20190221090009 20190122090009 46846 
bg. UfaFw11jtqaajb9VkVpS1VyAXxKCGec74D2qI0ulCa8EdeT5I0+A7JoI 
FhbigNmUGNER9iC91Var+CygqmYRfjIsi82jRTVYzuVVd1hWPM4VJiQX 
BWjZ5tneeNo9qOQlow1MSqgB7USYMta3XVe6Qyxp6XEna1cGxZjB8h/V 
NQWsiTnnLYdVfCTJEd8nStLqeo4fibsHB9NgOkK+bpD8LApLVUFun1sE 
+ykdTJrf/FZjPtEJn4qVo1EVrJa2NjKnFOMza4bYENYYI4w0LK3zCgQY 
TqbXYKJqbL0EIr8r7OkDG8wzI3Mx2iZ3sl1JaYRDpM/LYHqGbKaDnOkv 
scxh1i7GBu2oCUlL0l++klMQJxUG4jMeaQF5w9MYOJB2xDfPxw3Kq5sF 
YQKyMGIE5IaeT1hjTwqQk/DTXoqxC/ZLSLFVw+Bd9CzkcPEfERupzCn9 
mtAZOaAZwj0E7rM1NdcKHXplkvYTijpGmHKpPMdjUBU+d0DCzHvvyKRZ 
Zo+r59+rfQPcki2RRtphPKIxIgShlZeWJA6cfp2bf75rpybRWQKlT72h 
gWDd57s+ba4+Nj9/9vnDkhDuf6tucpaNlkaLAAudQGsf+zsWWufneWGR 
Y6vlEYSH8a3mUZ0ygk6Xp1Jh3JBclL4lyb0E284afAfF+mIQrXggoBIV 1/Kk0gkH88E=
bg.			3600	IN	RRSIG	DNSKEY 8 1 3600 20190221090009 20190122090009 15660 
bg. W8+IsXooVBp4ZL91L70Uz+nhWGl1UfK6cNj7BXWak7Esc+60Vx7xRqg9 
C06O+CKu7CDBdYD39tn/hScsmA850y76aI0CukEAjRqSEO7ptUl3D7Xf 
UvDoygRycFQNqZYrJuC8JwaUP/FX6DPpezSEIyjojHpRw3ld6TeKEZea Ftk=
bg.			3600	IN	RRSIG	DNSKEY 8 1 3600 20190221090009 20190122090009 58606 
bg. KnSPMb/6HNJsJXpfb0gftGV5e4FFSSGHaf2Zeb4b0g7+bFgmDqYNv0Em 
9oI1T38aem49Cg8VU97KdZdcf4hbB3ugprMjaa00A2k128uvMSRud/zI 
MPPL/8FUfMuC8BkaMoJTt2aSaq+D2uuWlhJOOCD2+uDh3czFBq4zCBGV 
R1uAtvVt5iP4xRXNAsyctJmGrK0Xks4LL0CdytUdoKWTtj6y+8j6KNvy 
Yn27+9Q08/lmQmWFgHtfKWCAFdFclXzNn0BjTNekP3WinIF0iHlWUeQl 
OTg0gErsguzzEU48JaWazhz7nrKN8U+OsPwH+KTuqx9VmElazssDfIp/ 
h3QoOHMfKX4/t8Na3UAWmNPbq6V4eQkBbGuYgX5bVaiAV3DvRQfvRGAU 
URBF2xWwrqG8Vfd9oghXyRt7qyRLQXlM4irdNb3kbv1mLuRQZxNd2bJs 
AZV6aNEizUwXftf8aWxYj62tnMMsgPu426kXpXA2YHaIn1NyE9kFOZCr 
VNfUv5MzIGDB4cXkyJld86pqo7HgpovWBGrXqptwbvU5vTqdsb14R4nG 
M6gOf648w4qKOBqeoLsCCTL+EoBa+n0d23cNtSfMk5WuzNdPDslNkPhz 
W9TAGOpvGZ+Vm4CyA2o++/G6VDT3/jBPlXlKu3OnI8mwQ5UFFXRmoQdW 9t5Msp47WYY=

;; Query time: 54 msec
;; SERVER: 2a02:6a80::192:92:129:99#53(2a02:6a80::192:92:129:99)
;; WHEN: Tue Jan 22 11:20:04 CET 2019
;; MSG SIZE  rcvd: 3103