RFC 7828
The edns-tcp-keepalive EDNS0 Option
RFC 7828: The edns-tcp-keepalive EDNS0 Option 🎀
- Request for Comments: 7828
- Authors: P. Wouters (Red Hat), J. Abley (Dyn, Inc.), S. Dickinson (Sinodun), R. Bellis (ISC)
- Category: Standards Track, ISSN 2070-1721
- Date: April 2016
- Obsoletes/Updates: the header doesn't list any RFCs it obsoletes or updates 🦋
Abstract ✨
okay so DNS messages between clients and servers can travel over UDP or TCP 🧚 UDP is way lighter on a busy server because it doesn't keep state, but it can cause truncation and then retries over TCP. UDP can also get abused for reflection attacks 😭 TCP would cut down on retransmits and amplification, but clients usually only use TCP for retries, and servers tend to close idle connections after just a few seconds ⏱️
This document defines an EDNS0 option called "edns-tcp-keepalive" 💖 It lets a DNS server tell the client what idle timeout to use. That signal encourages long-lived TCP connections, and the state for TCP can be managed well without really hurting how long each DNS transaction takes. Iconic. 👑
Status of This Memo 📜
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741.
For the current status of this document, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc7828. 🌸
Copyright Notice 💅
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication of this document. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License. 🫶
Table of Contents 🗂️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Requirements Notation . . . . . . . . . . . . . . . . . . . . 4
3. The edns-tcp-keepalive Option . . . . . . . . . . . . . . . . 5
3.1. Option Format . . . . . . . . . . . . . . . . . . . . . . 5
3.2. Use by DNS Clients . . . . . . . . . . . . . . . . . . . 5
3.2.1. Sending Queries . . . . . . . . . . . . . . . . . . . 5
3.2.2. Receiving Responses . . . . . . . . . . . . . . . . . 6
3.3. Use by DNS Servers . . . . . . . . . . . . . . . . . . . 6
3.3.1. Receiving Queries . . . . . . . . . . . . . . . . . . 6
3.3.2. Sending Responses . . . . . . . . . . . . . . . . . . 6
3.4. TCP Session Management . . . . . . . . . . . . . . . . . 7
3.5. Non-clean Paths . . . . . . . . . . . . . . . . . . . . . 8
3.6. Anycast Considerations . . . . . . . . . . . . . . . . . 8
4. Intermediary Considerations . . . . . . . . . . . . . . . . . 8
5. Security Considerations . . . . . . . . . . . . . . . . . . . 9
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 9
7.1. Normative References . . . . . . . . . . . . . . . . . . 9
7.2. Informative References . . . . . . . . . . . . . . . . . 10
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 111. Introduction 🌈
okay bestie, DNS messages between clients and servers can arrive over either UDP or TCP [RFC1035]. Back in the day, DNS clients used APIs that could only send and receive one query over UDP or TCP. Now new APIs, plus DNSSEC validating resolvers showing up on hosts that used to just do stub resolving, means more DNS clients want long-lived TCP connections 🦋 Long-lived TCP can mean lower request latency than UDP when truncated responses are involved. That's because clients that retry over TCP after a truncated UDP response usually only use that TCP session for one (request, response) pair, then go back to UDP for later queries. 🙈
TCP does need state kept on DNS servers. If a server is going to handle a big query load over TCP, it has to manage its resources so that every established TCP session gets used well, and idle connections get closed after a sensible amount of time. 💀
UDP is stateless, so it's a way smaller resource burden on a busy DNS server than TCP is. A UDP exchange of DNS messages can also finish in one round trip between the two hosts, which means super short transaction times ✨ UDP isn't risk-free though, babe.
A single-datagram UDP exchange between two hosts can be abused to enable a reflection attack on a third party. Response Rate Limiting [RRL] is designed to help mitigate such attacks against authoritative-only servers. One RRL feature lets some responses "slip" through the rate limiter. Those come back with the TC (truncation) bit set, which makes legit clients resend the same query over TCP. 😭
[RFC1035] set a maximum DNS message size over UDP of 512 bytes. Then DNSSEC [RFC4033] and other protocols made responses bigger than that limit way more common. EDNS0 [RFC6891] lets DNS messages larger than 512 bytes go over UDP, but that comes with more fragmentation. Fragmentation is known to be a problem in general, and it has also been linked to a higher risk of cache poisoning attacks [fragmentation-considered-poisonous]. 🔥
TCP is less exposed to fragmentation and reflection risks. But the TCP transport for DNS, as it's deployed today, has expensive setup overhead compared to UDP (when no retry is needed). 💅
The three-way TCP handshake adds a lot of overhead to a single DNS transaction. It makes a single (request, response) pair go from 1x RTT to 2x RTT. An already-established session has no such overhead, so the initial handshake cost gets minimised when that session is reused for multiple DNS message pairs. The extra RTT for session setup can be written as (1 + N)/N, where N is the number of DNS message pairs using the session. As N goes up, the result approaches unity 📈
With more DNSSEC deployment and new RR types carrying application-specific cryptographic material, there are more truncated UDP responses that get retried over TCP. A DNS transaction over UDP that got truncated because of RRL has 3x RTT more overhead than the same transaction started over TCP. 🍓
This document proposes a signalling mechanism between DNS clients and servers. It encourages long-lived TCP connections by letting the state associated with TCP transport be managed effectively, with minimal impact on DNS transaction time 🧚
This mechanism helps both stub-resolver TCP connections and resolver-to-authoritative TCP connections. For the second kind, the persistent TCP connection can give better defence against attacks like DDoS. 🛡️
The lower overhead from this extension really adds up when it's combined with other EDNS0 extensions, like [CHAIN-QUERY] and [DNS-over-TLS]. For example, these EDNS0 extensions together make it possible for hosts on high-latency mobile networks to do DNSSEC validation and encrypt queries natively and efficiently. Main character energy 👑
2. Requirements Notation 📝
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 🎀
3. The edns-tcp-keepalive Option 🦋
This document specifies a new EDNS0 [RFC6891] option, edns-tcp-keepalive. DNS clients and servers can use it to signal that they're willing to keep an idle TCP session open for future DNS transactions, and the server is the one that sets the idle timeout. This spec doesn't tell different types of DNS client and server apart when it comes to using this option. 💜
[RFC7766] defines an 'idle DNS-over-TCP session' from both the client and server perspectives. The idle timeout described here starts when the idle condition is met under that definition. It should be reset when that condition stops applying, which happens when a client sends a message or when a server receives a message on an idle connection. 🌸
3.1. Option Format 🧩
The edns-tcp-keepalive option is encoded like this:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-------------------------------+-------------------------------+
! OPTION-CODE ! OPTION-LENGTH !
+-------------------------------+-------------------------------+
| TIMEOUT !
+-------------------------------+where:
- OPTION-CODE: the EDNS0 option code assigned to edns-tcp-keepalive, 11
- OPTION-LENGTH: the value 0 if the TIMEOUT is omitted, the value 2 if it is present
- TIMEOUT: an idle timeout value for the TCP connection, specified in units of 100 milliseconds, encoded in network byte order 🍭
3.2. Use by DNS Clients 🫧
3.2.1. Sending Queries 📤
Clients need to watch out for this one. DNS clients MUST NOT include the edns-tcp-keepalive option in queries sent over UDP transport, no exceptions 🙅♀️
DNS clients MAY include the edns-tcp-keepalive option in the first query sent to a server over TCP transport, to signal that they want to keep the connection open when it's idle. 🌷
DNS clients MAY also include the edns-tcp-keepalive option in later queries sent to a server over TCP transport, to keep signalling that they still want the connection kept open when idle. ✨
And the formatting bit: clients MUST specify an OPTION-LENGTH of 0 and leave out the TIMEOUT value. Periodt 💖
3.2.2. Receiving Responses ✨
okay so, a DNS client that gets a UDP response with the edns-tcp-keepalive option in it MUST ignore the option. UDP doesn't have a connection to keep open, so this one's a hard no 🙈
a DNS client that gets a TCP response with the edns-tcp-keepalive option MAY keep the existing TCP session open while it's idle 🦋. It SHOULD honour the timeout from that response (replacing any older timeout) and start closing the connection before that timeout runs out. bestie, that's just being a good neighbour 🫶
if a response has the edns-tcp-keepalive option with a TIMEOUT value of 0, the client SHOULD send no more queries on that connection. It should start closing the connection once it has every outstanding response 🌸
if a client sent a query containing the edns-keepalive-option but the response doesn't have the edns-keepalive-option, the client SHOULD assume the server doesn't do keepalive and follow the guidance in [RFC7766] instead 💅. This still applies even if the same TCP connection already had an edns-keepalive-option exchange earlier. no exceptions, periodt 😭
3.3. Use by DNS Servers 🎀
3.3.1. Receiving Queries
a DNS server that gets a UDP query with the edns-tcp-keepalive option MUST ignore the option. same energy as the client side 🙈
a DNS server that gets a TCP query with the edns-tcp-keepalive option MAY change the local idle timeout for that TCP session, as long as its resources allow it 🧚
3.3.2. Sending Responses
a DNS server that gets a query over TCP with an OPT RR (with or without the edns-tcp-keepalive option) MAY include the edns-tcp-keepalive option in its response 💖. That's how it says what idle timeout to expect on the connection. Servers MUST put in the TIMEOUT value currently tied to that TCP session. This number is allowed to change based on local resource limits, which is very reasonable ✨. A DNS server SHOULD send edns-tcp-keepalive with a timeout of 0 if its local resources are too low to handle more TCP keepalive sessions, or if it wants clients to close the connections they already have open 💀
3.4. TCP Session Management 🦋
okay this section is about how much a TCP session can actually last. Both DNS clients and servers have resource limits that cap how long sessions can persist 🍓. Effective limits on how many active sessions each client and server can keep should be set up, either as configuration options or by checking the process limits the operating system puts on them. Servers that implement edns-tcp-keepalive should also manage their TCP connections: recycle existing ones when that's appropriate, close them gracefully, and manage request queues so everyone gets fair use 👑.
if there's more demand for TCP sessions than the server can handle, servers may lower the TIMEOUT value they signal in later DNS messages so idle time on existing sessions goes down 🌈. This also lets clients that have other candidate servers to query set up new TCP sessions with different servers, since an existing session is likely to close or they might fall back to UDP. it's giving strategy 🧠
depending on TCP session resources, servers may signal a TIMEOUT value of 0 to ask clients to close their connections as soon as they can 🚪. This helps when server resources get really low or when a denial-of-service attack is detected. It also pushes more of the TIME_WAIT state onto well-behaved clients 🫶
it should be noted that RFC 6891 says this, and it's important:
Lack of presence of an OPT record in a request MUST be taken as an
indication that the requestor does not implement any part of this
specification and that the responder MUST NOT include an OPT
record in its response.since servers have to follow this spec even on a persistent TCP connection, here's the catch 😬. After the first timeout exchange, a server might never get a chance to signal a change to the idle timeout for a connection if the client doesn't send any more requests with EDNS0 OPT RRs. So handling persistent connections with an initial idle timeout signal is way more attractive than a mechanism that sets up default persistence and then uses a connection close signal, similar to HTTP 1.1 [RFC7230] 🎀.
if a client includes the edns-tcp-keepalive option in its first query, it SHOULD include an EDNS0 OPT RR now and then in any further messages it sends during the TCP session 🔥. This makes it more likely the client hears about it if the server changes the timeout for that session. How often to do this is out of scope for this document and is up to the implementor and/or operator 💜.
DNS clients and servers MAY close a TCP session at any time to manage local resource limits 🌸. The algorithm they use to rank active TCP sessions and decide which one to close is not specified in this document.
3.5. Non-clean Paths 🧚
many paths between DNS clients and servers are kind of gross, and they limit the free flow of DNS messages that have certain EDNS0 options or that go over a certain size 🙃. A fallback strategy similar to the one in [RFC6891], Section 6.2.2 SHOULD be used to avoid persistent interference from non-clean paths 💅.
3.6. Anycast Considerations 🌍
DNS servers of many types are commonly deployed using anycast [RFC4786].
changes in network topology between clients and anycast servers may disrupt TCP sessions that use edns-tcp-keepalive more often than sessions that leave it out 😭. That's because those sessions are expected to last longer. anycast servers might be able to dodge disruption from topology changes by using TCP multipath [RFC6824] to anchor the server side of the TCP connection to an unambiguously unicast address ✨.
4. Intermediary Considerations 🫶
It is RECOMMENDED that DNS intermediaries that terminate TCP connections implement edns-tcp-keepalive. An intermediary that doesn't implement edns-tcp-keepalive but sits between a client and server that both support it might close idle connections unnecessarily 💀. so yeah, it's a whole group project 👯
5. Security Considerations 🚨
this one's serious, so please read it fr fr 🚨
The edns-tcp-keepalive option can be abused to request large numbers of long-lived sessions in a quick burst 💀. When a DNS server detects abusive behaviour, it SHOULD immediately close the TCP connection and free up the resources it used 🛑.
Servers could choose to monitor client behaviour with respect to the edns-tcp-keepalive option and build up profiles of clients that don't honour the specified timeout 🕵️♀️.
Readers are advised to familiarise themselves with the security considerations outlined in [RFC7766] 📚
6. IANA Considerations 🌷
IANA has assigned an EDNS0 option code for the edns-tcp-keepalive option from the "DNS EDNS0 Option Codes (OPT)" registry as follows:
+-------+--------------------+----------+-----------+
| Value | Name | Status | Reference |
+-------+--------------------+----------+-----------+
| 11 | edns-tcp-keepalive | Standard | RFC 7828 |
+-------+--------------------+----------+-----------+7. References 📚
7.1. Normative References
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
November 1987, <http://www.rfc-editor.org/info/rfc1035>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S.
Rose, "DNS Security Introduction and Requirements",
RFC 4033, DOI 10.17487/RFC4033, March 2005,
<http://www.rfc-editor.org/info/rfc4033>.
[RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast
Services", BCP 126, RFC 4786, DOI 10.17487/RFC4786,
December 2006, <http://www.rfc-editor.org/info/rfc4786>.
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
for DNS (EDNS(0))", STD 75, RFC 6891,
DOI 10.17487/RFC6891, April 2013,
<http://www.rfc-editor.org/info/rfc6891>.
[RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
Protocol (HTTP/1.1): Message Syntax and Routing",
RFC 7230, DOI 10.17487/RFC7230, June 2014,
<http://www.rfc-editor.org/info/rfc7230>.
[RFC7766] Dickinson, J., Dickinson, S., Bellis, R., Mankin, A., and
D. Wessels, "DNS Transport over TCP - Implementation
Requirements", RFC 7766, DOI 10.17487/RFC7766, March 2016,
<http://www.rfc-editor.org/info/rfc7766>.7.2. Informative References
[CHAIN-QUERY]
Wouters, P., "Chain Query requests in DNS", Work in
Progress, draft-ietf-dnsop-edns-chain-query-07, February
2016.
[DNS-over-TLS]
Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D.,
and P. Hoffman, "Specification for DNS over TLS", Work in
Progress, draft-ietf-dprive-dns-over-tls-09, March 2016.
[fragmentation-considered-poisonous]
Herzberg, A. and H. Shulman, "Fragmentation Considered
Poisonous", arXiv: 1205.4011, May 2012,
<http://arxiv.org/abs/1205.4011>.
[RFC6824] Ford, A., Raiciu, C., Handley, M., and O. Bonaventure,
"TCP Extensions for Multipath Operation with Multiple
Addresses", RFC 6824, DOI 10.17487/RFC6824, January 2013,
<http://www.rfc-editor.org/info/rfc6824>.
[RRL] Vixie, P. and V. Schryver, "DNS Response Rate Limiting
(DNS RRL)", ISC-TN 2012-1-Draft1, April 2012,
<https://ftp.isc.org/isc/pubs/tn/isc-tn-2012-1.txt>.Acknowledgements 💖
The authors acknowledge the contributions of Jinmei TATUYA and Mark Andrews. Thanks to Duane Wessels for detailed review and the many others who contributed to the mailing list discussion 🫶🌈.
Authors' Addresses 🖋️
Paul Wouters
Red Hat
Email: pwouters@redhat.com
Joe Abley
Dyn, Inc.
103-186 Albert Street
London, ON N6A 1M1
Canada
Phone: +1 519 670 9327
Email: jabley@dyn.com
Sara Dickinson
Sinodun Internet Technologies
Magdalen Centre
Oxford Science Park
Oxford OX4 4GA
United Kingdom
Email: sara@sinodun.com
URI: http://sinodun.com
Ray Bellis
Internet Systems Consortium, Inc
950 Charter Street
Redwood City, CA 94063
United States
Phone: +1 650 423 1200
Email: ray@isc.org
URI: http://www.isc.org📦 where this page comes from
- ietf: rfc7828 2016-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms