Re: [OPSAWG] I-D Action: draft-gont-opsawg-firewalls-analysis-01.txt

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Melinda Shore writes:
Input error
> On 10/19/15 3:16 PM, Mark Andrews wrote:
> > When one actually wants to use the capabilities we built into the
> > protocol one then has to fight the firewalls even to get the packet
> > delivered.  Cleaning out old/broken firewalls takes decades.
>
> Right, but vendors do love their firewalls.  It can take an
> inordinately long time to get IETF documents out (longer than
> it takes to design and implement a product feature) and vendors
> are likely to release products that break DNS before a firewalls
> draft is done.

We will be, DNS COOKIES support will be released early next year
and yes we will hit firewalls that block EDNS queries with unknown
options along with all the other breakage out there.  Somewhere
around 90% of servers will return good answers to those queries.
A couple of percent will be blocked by firewalls.  If the servers
behind those firewalls are serving signed zones then DNS lookups
for those zones *will* fail if the recursive server is validating.
Similarly if they return FORMERR.  Some of the errors are benign
to DNS COOKIES.

Despite the fact that we will be doing this I still think that a
document on firewalls should go ahead.

I also have draft-andrews-dns-no-response-issue which looks at DNS
server misbehaviour and it covers all of these areas.  I've had
feedback that the IETF shouldn't be asking TLD operators to be good
network citizens by running checks on the delegated servers and
informing their operators that they are broken.  I've also had
feedback saying "when are you publishing, this is good stuff".

Mark

> I've been watching this discussion and getting a strong sense

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]