Recursor sends data with TC=1 #1092

Closed
paddg opened this Issue Nov 4, 2013 · 3 comments

Projects

None yet

2 participants

@paddg
Contributor
paddg commented Nov 4, 2013

PowerDNS Recursor sends data in case of TC=1. In order to mitigate amplification attacks it would be better to send an empty packet in this case.

@Habbie Habbie closed this in add935a Nov 4, 2013
@Habbie Habbie added a commit to Habbie/pdns that referenced this issue Nov 14, 2013
@Habbie Habbie actually truncate packet when setting TC, closes #1092 3c4c2b3
@mind04 mind04 pushed a commit to mind04/pdns that referenced this issue Dec 28, 2013
@Habbie Habbie actually truncate packet when setting TC, closes #1092 1f46769
@Habbie Habbie added a commit to Habbie/pdns that referenced this issue Feb 20, 2014
@Habbie Habbie actually truncate packet when setting TC, closes #1092 8f129e4
@dstates
dstates commented May 8, 2014

Is this RFC compliant? I can imagine cases where a client might want only the partial answer and can make a decision to request the rest of the answer over TCP or not...

Could this be made configurable rather than default behavior?

@paddg
Contributor
paddg commented May 8, 2014

RFC 2181 says:
"Where TC is set, the partial RRSet that would not completely fit may be left in the response. When a DNS client receives a reply with TC set, it should ignore that response, and query again, using a mechanism, such as a TCP connection, that will permit larger replies."

So I guess, yes! Other implementation behave as well. You could file an enhancement issue if you want a configuration switch. But I think that's not necessary. We have this fix in production for several month and no one has complained.

@dstates
dstates commented May 8, 2014

That's fair, I probably should have checked myself first =)

I don't currently use the data in UDP replies with TC set, so I suppose that if I have a use-case for it down the road I can submit a patch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment