[tsvwg] Re: [v6ops] Carrying large DNS packets over UDP in IPv6 networks

["C. M. Heard" <[e-mail]>]

Greetings,

I recently circulated an individual draft
https://datatracker.ietf.org/doc/html/draft-heard-dnsop-udp-opt-large-dns-responses
on
the DNSOP list that discusses how UDP options could be used to send large
DNS responses without UDP fragmentation. The one comment that came back was
not favorable, arguing that it would increase the surface for reflection
attacks, which TCP (and QUIC) would not. See
https://mailarchive.ietf.org/arch/msg/dnsop/EhUq8tZF8Qm-iZk4eUAnjsCGXUg/ and
subsequent messages in the thread.

As for https://datatracker.ietf.org/doc/html/draft-hinden-v6ops-dns, it
seems to cover much of the same territory as
https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-avoid-fragmentation,
which has been submitted for publication. My sense is that getting the
latter document published would be a better path forward for the IETF
community than a new draft.

Respectfully,

Mike Heard

On Fri, Jun 14, 2024 at 7:12 AM <[e-mail]> wrote:

> Hi Suresh, all,
>
> (ccing tsvwg)
>
> FWIW, large DNS packets was the main driver for the FRAG UDP option:
> https://datatracker.ietf.org/doc/html/draft-ietf-tsvwg-udp-options-32#section-11.4.
>
>
> On the reco in the draft, I'm not sure how this can be put into effect
> given that the client does not know whether the reply will be large or not
> when it reaches out a resolver.
>
> Also, when you mention "DNS over QUIC" are you referring to DoQ per RFC
> 9250? If so, I'm afraid that there are many implications (e.g.,
> authentication, compatibility with the presence of local forwarders). Also,
> if DoQ is recommended, why not DNS over TLS or DNS over HTTPS? You may
> refer to DNR/DDR (RFC9463/9462) for the discovery matters of whether local
> resolvers support DoQ, DoH, DoT, etc. + which authentication domain name to
> be used to authenticate a server.
>
> Cheers,
> Med
>
> > -----Message d'origine-----
> > De : Suresh Krishnan <[e-mail]>
> > Envoyé : vendredi 14 juin 2024 13:56
> > À : [e-mail]
> > Objet : [v6ops] Carrying large DNS packets over UDP in IPv6
> > networks
> >
> >
> > Hi all,
> >   At the last 6man meeting in Brisbane, Jared Mauch brought up an
> > issue with large DNS packets carried over UDP in IPv6 networks.
> > Bob and I have written a draft recommending the use of TCP or
> > QUIC for such large packets instead of UDP.
> >
> > https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2
> > Fdatatracker.ietf.org%2Fdoc%2Fdraft-hinden-v6ops-
> > dns%2F&data=05%7C02%7Cmohamed.boucadair%40orange.com%7Cbdb1f68f5a
> > a84a89263a08dc8c690ce2%7C90c7a20af34b40bfbc48b9253b6f5d20%7C0%7C0
> > %7C638539630010730229%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDA
> > iLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdat
> > a=ts2PogUeq3dRA0NulYmQaJaCydLLhhJeM463qV%2BHgVU%3D&reserved=0
> >
> > We would greatly appreciate your comments on this draft.
> >
> > Thanks
> > Suresh
> > _______________________________________________
> > v6ops mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> ____________________________________________________________________________________________________________
> Ce message et ses pieces jointes peuvent contenir des informations
> confidentielles ou privilegiees et ne doivent donc
> pas etre diffuses, exploites ou copies sans autorisation. Si vous avez
> recu ce message par erreur, veuillez le signaler
> a l'expediteur et le detruire ainsi que les pieces jointes. Les messages
> electroniques etant susceptibles d'alteration,
> Orange decline toute responsabilite si ce message a ete altere, deforme ou
> falsifie. Merci.
>
> This message and its attachments may contain confidential or privileged
> information that may be protected by law;
> they should not be distributed, used or copied without authorisation.
> If you have received this email in error, please notify the sender and
> delete this message and its attachments.
> As emails may be altered, Orange is not liable for messages that have been
> modified, changed or falsified.
> Thank you.
>
>