Network Working Group                                         M. Andrews
Internet-Draft                                                       ISC
Intended status: Standards Track                        January 22, 2012
Expires: July 25, 2012


                       DNS and UDP Fragmentation
             draft-andrews-dnsext-udp-fragmentation-01.txt

Abstract

   This document provides advice to DNS developers about sending DNS UDP
   messages and Path MTU Discovery.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on July 25, 2012.

Copyright Notice

   Copyright (c) 2012 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.






Andrews                   Expires July 25, 2012                 [Page 1]

Internet-Draft          DNS and UDP Fragmentation           January 2012


Table of Contents

   1.  Background  . . . . . . . . . . . . . . . . . . . . . . . . . . 3
     1.1.  Reserved Words  . . . . . . . . . . . . . . . . . . . . . . 3
   2.  IPv4 and Fragmentation  . . . . . . . . . . . . . . . . . . . . 3
   3.  IPv6 and Fragmentation  . . . . . . . . . . . . . . . . . . . . 3
   4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 4
   5.  Security Considerations . . . . . . . . . . . . . . . . . . . . 4
   6.  Normative References  . . . . . . . . . . . . . . . . . . . . . 4
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . . . 5









































Andrews                   Expires July 25, 2012                 [Page 2]

Internet-Draft          DNS and UDP Fragmentation           January 2012


.  Background

   IPv6 has changed the dynamics of UDP, Path MTU Discovery (PMTUD) and
   IP fragmentation.  With IPv4 DNS/UDP packets were fragmented by the
   network and no PMTUD was performed.  With IPv6 fragmentation occurs
   in the sending node and PMTUD is allways performed unless the IPv6
   packet is fragmented by the sending node using the minimum IPv6 MTU.

   DNS/UDP does not work well when PMTUD is performed.  If the Packet
   Too Big (PTB) / Need Fragmentation ICMP messages are not received
   there is no feedback path in DNS to reduce the size of the fragments
   like there is with TCP.

   Additionally there is no automatic retransmission of UDP packets like
   there is with TCP in response to a PTB message.  The sender needs to
   send the request after timing out.  Not only is this process slow,
   the resulting traffic patterns can be confused with other common
   sources of error, resulting from badly configured firewalls, leading
   to inappropriate remedial action being taken.

   This document recommends that all DNS/UDP messages are sent such that
   they do not trigger PMTUD.

1.1.  Reserved Words

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC 2119].


.  IPv4 and Fragmentation

   There are a number of IP stacks that enable PMTUD for all IP packets
   by default against the advice of [RFC 1191].  On those IP stacks it
   is necessary for the application to disable PMTUD on a per socket/
   packet basis or for the operator to disable it globally if there is
   no per socket/packet control.


.  IPv6 and Fragmentation

   It was realised that IPv6 changed the way PMTUD happened and that
   there were applications, like DNS, that would not work well with
   PMTUD.  For those applications a socket option called
   IPV6_USE_MIN_MTU was developed [RFC 3542] which tells the IPv6 stack
   to fragment packets at the minimum IPv6 MTU rather than use PMTUD to
   find the actual PMTU.




Andrews                   Expires July 25, 2012                 [Page 3]

Internet-Draft          DNS and UDP Fragmentation           January 2012


   It is RECOMMENDED that IPV6_USE_MIN_MTU be set to 1 (one) when
   sending DNS/UDP messages over IPv6.  This option can be set at the
   socket level or it can be set on a per UDP datagram basis.

   If the IPv6 stack does not support IPV6_USE_MIN_MTU, then steps
   should be taken to prevent PMTUD occuring.  These include, but are
   not limited to, setting the MTU of the interface the packets are
   being sent over to the minimum IPv6 MTU (1280 bytes), or restricing
   DNS/UDP packets to no more than 1280 bytes including IPv6 headers.

   It should be noted that even with IPV6_USE_MIN_MTU set to one that a
   PTB message may still be received [RFC 2460] which requires a IPv6 to
   add a Fragmentation header to subsequent packets.  There is currently
   no way to avoid this, without using raw sockets, as there is no way
   for a application to request that a Fragmentation header be added to
   a packet.  [I-D.draft-andrews-6man-force-fragmentation] however has
   some proposed methods.


.  IANA Considerations

   No IANA Considerations.


.  Security Considerations

   Failure to prevent PMTUD can lead to denial of service for DNS
   clients.

   Firewalls are often configured to block fragmented IP packets as
   early IP stacks had fragmentation re-assembly bugs.  These bugs were
   exploited to perform a number of denial of service and other attacks
   cira 1999.

   Such blocks should be relaxed to permit fragmented UDP packets.


.  Normative References

   [I-D.draft-andrews-6man-force-fragmentation]
              Andrews, M., "Forcing Fragmentation of IPv6 Packets",
              draft-andrews-6man-force-fragmentation-01 (work in
              progress), January 2012.

   [RFC 1191]
              Mogul, J. and S. Deering, "Path MTU Discovery", RFC 1191,
              November 1990.




Andrews                   Expires July 25, 2012                 [Page 4]

Internet-Draft          DNS and UDP Fragmentation           January 2012


   [RFC 2119]
              Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC 2460]
              Deering, S. and R. Hinden, "Internet Protocol, Version 6
              (IPv6) Specification", RFC 2460, December 1998.

   [RFC 3542]
              Stevens, W., Thomas, M., Normark, E., and T. Jinmei,
              "Advanced Sockets Application Program Interface (API) for
              IPv6", RFC 2003, May 2003.


Author's Address

   Mark Andrews
   Internet Systems Consortium
   950 Charter Street
   Redwood City, CA  94063
   US

   Email: marka@isc.org




























Andrews                   Expires July 25, 2012                 [Page 5]