Subject: Re: [dnsext] Re: Building structured extensibility into EDNS0(bis)

From: Mark Andrews <[email-masked]>
Date: Mon, 16 Nov 2009 12:25:10 +1100

Mark Andrews writes:
> 
> In message <[email-masked]>, Andrew Sullivan writes:
> > On Sat, Nov 14, 2009 at 06:52:38AM +1100, Mark Andrews wrote:
> > 
> > > Bump the EDNS version 
> > 
> > Really?  You're offering to do the work to make EDNS1 happen, and make
> > it work for every mistake in EDNS0 implemations, and so on?
> 
> I know that we check the EDNS version number and return BADVERS.
> That is all that you required of a EDNS0 server and it is part of
> the EDNS0 spec so it should have been implemented.  Modern versions
> of dig can be used to check this.
> 
> e.g.
> % dig +edns=1
> 
> ; <<>> DiG 9.7.0b2 <<>> +edns=1
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: BADVERS, id: 29489
> ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
> ;; WARNING: recursion requested but not available
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;.                              IN      NS
> 
> ;; Query time: 18 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Mon Nov 16 07:57:59 2009
> ;; MSG SIZE  rcvd: 28
> 
> % 
>  
> ATLAS does the right thing.
> 
> % dig +edns=1 @a.gtld-servers.net ftp.uu.net +norec
> 
> ; <<>> DiG 9.7.0b2 <<>> +edns=1 @a.gtld-servers.net ftp.uu.net +norec
> ; (2 servers found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: BADVERS, id: 37488
> ;; flags: qr cd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 512
> ;; QUESTION SECTION:
> ;ftp.uu.net.                    IN      A
> 
> ;; Query time: 358 msec
> ;; SERVER: 2001:503:a83e::2:30#53(2001:503:a83e::2:30)
> ;; WHEN: Mon Nov 16 08:10:29 2009
> ;; MSG SIZE  rcvd: 39
> 
> % 
> 
> Some of ORG's servers don't do the correct thing.  I've Bcc
> [email-masked] so they can take steps to make their nameservers
> compliant.
> 
> % dig +edns=1 isc.org @a2.org.afilias-nst.info.
> ;; Warning: Message parser reports malformed message packet.
> 
> ; <<>> DiG 9.7.0b2 <<>> +edns=1 isc.org @a2.org.afilias-nst.info.
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: FORMERR, id: 60171
> ;; flags: qr rd; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
> ;; WARNING: recursion requested but not available
> ;; WARNING: Messages has 8 extra bytes at end
> 
> ;; Query time: 179 msec
> ;; SERVER: 2001:500:40::1#53(2001:500:40::1)
> ;; WHEN: Mon Nov 16 08:12:31 2009
> ;; MSG SIZE  rcvd: 21
> 
> % 

Also if you want to see what breaks you can just set the default
EDNS version in lib/dns/resolver.c to 1 and pretend to be a EDNS
version 1 client.  The code should correctly fallback to EDNS0.

        if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
                if ((query->addrinfo->flags & DNS_FETCHOPT_NOEDNS0) == 0) {
                        unsigned int version = 0;       /* Default version. */
                        unsigned int flags;
                        isc_uint16_t udpsize = res->udpsize;
                        isc_boolean_t reqnsid = res->view->requestnsid;

> > No-hat, I say, "I worry very much about the implications."
> > 
> > Chair-hat, I say, "Tell me a great deal about interoperability,
> > failure cases, and the draft you've written."  Where "you" denotes,
> > "Everyone who wants to follow this idea," of course.
> > 
> > A
> > 
> > -- 
> > Andrew Sullivan
> > [email-masked]
> > Shinkuro, Inc.
> > 
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]