nsd users - May 2018 - NSD 4.1.21rc1 pre-release

W.C.A. Wijngaards:
> NSD 4.1.21rc1 prerelease is available:
> This release introduces query type ANY refusal.  NSD already has RRL
> support that by default throttles queries, and also queries of type ANY.
>  But an nsd.conf option has been added, this makes NSD refuse queries of
> type ANY.
compiled without warnings on Debian. Running on some lab systems now...

Is it intentional to refuse-any on UDP /and/ TCP?

    https://tools.ietf.org/html/draft-ietf-dnsop-refuse-any-06#section-4.4

    Implementers SHOULD provide configuration options to allow operators
    to specify different behaviour over UDP and TCP.

I've no idea if refuse-any will break something in my networks.
But if one day something break, it would be nice to know
NSD could be configured to at lease allow ANY (old behaviour) on TCP.

Andreas

On 07/05/2018 11:52, A. Schulze wrote:
> Is it intentional to refuse-any on UDP /and/ TCP?
> 
> ?? https://tools.ietf.org/html/draft-ietf-dnsop-refuse-any-06#section-4.4
> 
> ?? Implementers SHOULD provide configuration options to allow operators
> ?? to specify different behaviour over UDP and TCP.
> 
> I've no idea if refuse-any will break something in my networks.
> But if one day something break, it would be nice to know
> NSD could be configured to at lease allow ANY (old behaviour) on TCP.
I also prefer this, to refuse ANY queries over UDP, but allow them over TCP.

Actually, what Knot DNS does is to respond to ANY queries with an empty
answer and the TC bit set. The response is therefore just as small as a
REFUSED response. A genuine client will retry over TCP, and Knot answers
that. I personally prefer this to a REFUSED response.

Regards,
Anand