Re: [DNSOP] [Ext] Implementor's status on draft-ietf-dnsop-avoid-fragmentation: BIND 9

2023-01-20 Thread Ondřej Surý
I am indifferent about what label we stick on this, but perhaps the document should have a section on implementations? However, I do feel that the Security Considerations is missing on the risks of dropping packets, ICMP filtering and dangers of PMTUD. Also it feels weird to me that the IP_PMTU

Re: [DNSOP] Implementor's status on draft-ietf-dnsop-avoid-fragmentation: BIND 9

2023-01-20 Thread Klaus Frank
On 20.01.2023 12:49, Ondřej Surý wrote: • UDP responders SHOULD limit response size when UDP responders are located on small MTU (<1500) networks. I don't know what this means. And how is this related to the previous recommendation to limit the response size under "1400". Hi, I think t

Re: [DNSOP] [Ext] Implementor's status on draft-ietf-dnsop-avoid-fragmentation: BIND 9

2023-01-20 Thread Paul Vixie
On Fri Jan 20, 2023 at 6:53 PM UTC, Paul Wouters wrote: > It seems there should be more discussion which hopefully would lead to > a converging BCP before moving forward. Hearing from other main > implementations would be extremely helpful here. i have always been a fan of ISC's work, but i agree

Re: [DNSOP] [Ext] Implementor's status on draft-ietf-dnsop-avoid-fragmentation: BIND 9

2023-01-20 Thread Paul Wouters
On Fri, 20 Jan 2023, Paul Hoffman wrote: Given the long list of things in this document that ISC has thought about and actively decided not to do, is it a good idea that we call it a "best current practice"? It seems there should be more discussion which hopefully would lead to a converging B

Re: [DNSOP] Status of draft-ietf-dnsop-rfc8499bis

2023-01-20 Thread Benno Overeinder
Thank you Paul and Kazunori. The chairs agree that both drafts (glue-is-not-optional and rfc8499bis) should go to WG Last Call together. We will coordinate this further with the authors of both documents to move forward with the WGLC. Best, -- Suzanne, Tim and Benno On 20/01/2023 16:34, Pa

Re: [DNSOP] [Ext] Implementor's status on draft-ietf-dnsop-avoid-fragmentation: BIND 9

2023-01-20 Thread Jim Reid
> On 20 Jan 2023, at 15:20, Paul Hoffman wrote: > > Given the long list of things in this document that ISC has thought about and > actively decided not to do, is it a good idea that we call it a "best current > practice"? Maybe. Though a BCP should go beyond documenting what BIND9 does. In

[DNSOP] Status of draft-ietf-dnsop-rfc8499bis

2023-01-20 Thread Paul Hoffman
Greetings again. Kazunori and I have just submitted -05 of this draft to incorporate the consensus from the WG on how to talk about the types of glue. Please see the diff for the specific wording that was used to reflect the WG consensus. Note that we now normatively reference draft-ietf-dnsop-

[DNSOP] I-D Action: draft-ietf-dnsop-rfc8499bis-05.txt

2023-01-20 Thread internet-drafts
A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Domain Name System Operations WG of the IETF. Title : DNS Terminology Authors : Paul Hoffman Kazunori Fujiwara Filename

Re: [DNSOP] [Ext] Implementor's status on draft-ietf-dnsop-avoid-fragmentation: BIND 9

2023-01-20 Thread Paul Hoffman
Given the long list of things in this document that ISC has thought about and actively decided not to do, is it a good idea that we call it a "best current practice"? --Paul Hoffman ___ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/li

[DNSOP] Implementor's status on draft-ietf-dnsop-avoid-fragmentation: BIND 9

2023-01-20 Thread Ondřej Surý
Dear WG and authors, here's an status of UDP fragmentation mitigations in BIND 9 as of now. > 3.1. Recommendations for UDP responders > • UDP responders SHOULD send DNS responses without "Fragment header" > [RFC8200] on IPv6. > • UDP responders are RECOMMENDED to set IP "Don't Fragment f