Re: TCP connections to DJBDNS

On Fri, 23 Jan 2009, Jakob Hirsch wrote:

> > This is right, BUT---I think the consensus on DNSEXT was that
> > implementations must support TCP or ENDSO, and DNSSEC requires TCP or
> > ENDSO.  
> 
> Well, I don't know about that. Is that documented anywhere or is 
> somebody preparing a RFC or something to share the enlightenment with 
> the rest of the internet?

Hmm. RFC4033 mentions fallback to TCP; as does RFC2181. But neither
explicitly state TCP is required.  All that is required by RFC4033 is
EDNSO for the DO and message size options. However the maximum EDNSO
message size can be at most 8192 and the maximum supported by a server
can be less than that. The implication is that a fallback to TCP is
inherently unavoidable.  I don't know of anything written that makes TCP
_required_, but I think most people would agree that it is a necessity.  
I am not aware of any other DNS server implementations that don't
support TCP.

> Anyway, as long as you make sure that your dns replies are not getting
> bigger than 512 octets, your dns server will not truncate udp replies
> and therefore resolvers are obliged to not use tcp (according to RFC
> 1123, section 6.1.3.2, again).

Anyone supporting DNSSEC cannot assume that replies will be less than
512 bytes. Most replies will be much larger than this. (I hate to seem
to be advocating DNSSEC---I don't---I just recognize it as a fact. A
consequence of burying our heads in the sand and allowing BIND Cartel to
take over.)

> > TCP is just about necessary to have reasonably secure DNS lookups in
> > some cases, and I think EDNSO and TCP should be (ought to be)
> > supported in both dnscache and tinydns.
> 
> Should be relatively easy, at least in tinydns. dnscache would have to
> implement fallback mechanisms as mentioned in the EDNS0 RFC, but that
> shouldn't be to hard either.

Dnscache already does the fallback.  It can pass through ENDSO queries
up to (I think DJBDNS participants agreed 4k, when we last discussed
this??) by merely changing the buffer size and not rejecting queries
smaller than the buffer size.

> > I am also thinking about changes to dnscache to enable one to
> > configure it to accept UDP queries, but prefer TCP for recursion.  
> > Thoughts?
> 
> This would be a violation of RFC 1123 (as mentioned above). And it
> would put additional load on DNS servers.

It doesn't violate RFC1123: Section 6.1.3.2:

 	"but it SHOULD NOT
         refuse to service a TCP query just because it would have
         succeeded with UDP."

It goes on to say:

        "By private agreement, name servers and resolvers MAY arrange
         to use TCP for all traffic between themselves."

Prefering TCP would indeed put some more load on servers, but there is a
definite and significant benefit to that load especially for a caching
server that gets a signifcant benefit by caching the response.  It makes
it impossible to poison the cache except by a MITM. That's a significant
benefit.

		--Dean



-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000