Re: draft-ietf-dnsext-forgery-resilience-01.txt

[gson@araneus.fi (Andreas Gustafsson)]

Florian Weimer wrote re query IDs:
> Yes, and it has to choose them in a way that doesn't trigger bugs in
> authoritative servers (or upstream resolvers, if there's a hierarchy).

Do you know of any such bugs?  The users of the two recursive DNS
server implementations I have worked on certainly haven't reported
any problems caused by such bugs.

What both of those implementations actually do is to choose the query
ID randomly among the set of query IDs not already in use by
outstanding queries.  This exclusion of already outstanding IDs is
done purely to aid in uniquely identifying the response, not to work
around any known external bug.
-- 
Andreas Gustafsson, gson@araneus.fi

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>