[dnsext] Some feedback on draft-andrews-dnsext-udp-fragmentation-00.txt

[Fernando Gont <[e-mail]>]

Mark,

Here's some feedback about the aforementioned I-D.

** Technical **

Section 3:
>    It should be noted that even with IPV6_USE_MIN_MTU set to one that a
>    PTB message may still be received [RFC 2460] which requires a IPv6 to
>    add a Fragmentation header to subsequent packets.  There is currently
>    no way to avoid this, without using raw sockets, as there is no way
>    for a application to request that a Fragmentation header be added to
>    a packet.

I understand that this could (at leasst in theory) happen but, out of
curiosity: are there any devices that leverage the aforementioned
featuer specified in RFC 2460? NAT 64? Othes?


Section 5 (Security Considerations):
All these IPv4 issues are discussed in detail in RFC 6274.

Also, as noted in my feedback about your other I-D:
Relying on fragmentation doesn't come for free, either. In aprticular,
if implementation use predictable Fragment IDs (see
draft-gont-6man-predictable-fragment-id) fragmentation-related attacks
become pretty much feasible.


** Editorial **

Abstract: Expand the Abstract briefly outlining the problem.


Section 3:
> These include, but are
>    not limited to, setting the interface the packets are being sent over
>    should be set to the network MTU (1280 bytes), or restricing DNS/UDP
>    packets to no more than 1280 bytes including IPv6 headers.

This does not parse. You should probably rephrase to "setting the MTU of
the interface the packets are being sent over to the minimum IPv6 MTU
(1280 bytes)"

(Note that I've also s/network MTU/minimum IPv6 MTU/)

Section 3:
>    It should be noted that even with IPV6_USE_MIN_MTU set to one that a
>    PTB message may still be received [RFC 2460] which requires a IPv6 to
>    add a Fragmentation header to subsequent packets.  There is currently
>    no way to avoid this, without using raw sockets, as there is no way
>    for a application to request that a Fragmentation header be added to
>    a packet.

Add a pointer to your other I-D specifying a mechanism to achieve this.



** Nits **

Section 1:
>    network and no PMTUD was performed.  With IPv6 fragmentation occurs
>    in the sending node and PMTUD is alway performed unless the IPv6
>    packet is fragmented by the sending node using the network MTU.

s/alway/always/


Section 1:
> PMTUD discover

Replace with "Path-MTU Discovery".


Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1



_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext