Subject: [dnsext] perhaps we should reintroduce "resimprove"

From: paul vixie <[email-masked]>
Date: Thu, 09 Feb 2012 15:09:26 +0000

based on the renewed interest in the delegation and glue ttl problem
caused by the "ghost domains" paper, i looked again at:

http://tools.ietf.org/html/draft-vixie-dnsext-resimprove-00

...which i presented in prague about a year ago. the sticking point was:

    B. Stopping a downward cache search when an NXDOMAIN is encountered.

and all of section 3. this proposal was considered controversial since
two existing implementation (rbldnsd and tinydns) currently send
nxdomain when queried for an empty nonterminal domain name. i did not
agree that this was a problem since RBL DNS queries are always full
length (that is, for all octets or all nybbles of an inverted host
address) and since the DNSSEC specification clarified non-terminal names
as existing but empty.

i now propose that we dust off this draft, remove (B) and section 3, and
progress it not as an improvement but as a security and resiliency
requirement (so, a proposed standard) in the face of the "ghost domain"
problem.

i may yet reintroduce the NXDOMAIN matter but i don't think that we
should logjam on it any further.

with five shows of support i would consider the editorial work involved
here to be worth doing.

paul

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 9 Feb 2012 12:23:18 -0500

> with five shows of support i would consider the editorial work involved

Do you consider it possible to get done and through WGLC before Paris?
(FWIW, no hat, I do not.)

A

-- 
Andrew Sullivan
[email-masked]

---

From: Frederico A C Neves <[email-masked]>
Date: Thu, 9 Feb 2012 16:02:01 -0200

> (FWIW, no hat, I do not.)

Don't You think we should treat this orthogonally to the dnsext
shutdown ?

Clarifications and corrections will continue to show regardless of the
existence of dnsext.

Fred

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 9 Feb 2012 13:54:14 -0500

> Don't You think we should treat this orthogonally to the dnsext

Yes; that's why the "what do you mean 'we'"?  I was just trying to be
clear that the five reviewers, &c., is not a WG work item requirement
in this case, because DNSEXT isn't going to add this work to the WG
list.  I enthusiastically encourage people to use this mailing list to
co-ordinate additional work.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 9 Feb 2012 15:53:46 -0500

On Thu, Feb 09, 2012 at 01:54:14PM -0500, Andrew Sullivan wrote:

> list.

I note from my INBOX, though he's been too polite to say it, that
Olafur doesn't agree with me.  I personally find it hard to believe
this work could happen that fast, and I seem to recall that we had
previous negative reactions to it, but I'm not going to stand in the
way.

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Warren Kumari <[email-masked]>
Date: Thu, 9 Feb 2012 19:20:28 -0800

> with five shows of support i would consider the editorial work involved

I am no longer sure who the five were, but I was not one of them, you now have 6.

I would be more than happy to contribute / edit / review / whatever is needed to progress it. I think this is a very useful draft…

W

> 
> paul
> 
> _______________________________________________
> dnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsext
> 

--
Don't be impressed with unintelligible stuff said condescendingly.
    -- Radia Perlman.

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 10 Feb 2012 08:25:05 -0800

This does not seem like it is a quick fix that can be done in the next few weeks.

Why is there hesitation on making this an individual submission for standards track that would happen after the WG shuts down?

--Paul Hoffman

---

From: Mohan Parthasarathy <[email-masked]>
Date: Wed, 15 Feb 2012 12:11:28 -0800

> address) and since the DNSSEC specification clarified non-terminal names
RFC 4035, "3.1.3.2.  Including NSEC RRs: Name Error Response" has the
following text towards the end:

   Note that this form of response includes cases in which SNAME
   corresponds to an empty non-terminal name within the zone (a name
   that is not the owner name for any RRset but that is the parent name
   of one or more RRsets).

I don't see anything clarified in the dnssec-bis-updates document
regarding this. Could you clarify what you meant by "DNSSEC
specification clarified non-terminal names as existing but empty" ?

thanks
mohan

---

From: Edward Lewis <[email-masked]>
Date: Wed, 15 Feb 2012 16:48:58 -0500

>specification clarified non-terminal names as existing but empty" ?

Does RFC 4592, section 2.2 help?

Probably what was meant was that DNSSEC forced a clearer 
understanding of empty non-terminals among other issues, which 
spawned RFC 4592 and the words there updating what is meant by 
"existence."

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

2012...time to reuse those 1984 calendars!

---

From: Paul Vixie <[email-masked]>
Date: Wed, 15 Feb 2012 21:59:50 +0000

On 2/15/2012 8:11 PM, Mohan Parthasarathy wrote:
>> ... i did not

what i mean is hard to quote a chapter and verse for, but in dnssec if
an authority server receives a query for a domain name which is empty of
rrsets but has children, then the answer is NOERROR not NXDOMAIN, and
there is no need to provide the usual proofs (of no wild card and so on)
that would accompany an NXDOMAIN response.

some dns implementations have been behaving this way for decades (BIND
for example). others have been returning NXDOMAIN under these
conditions. the original DNS spec didn't make either behaviour wrong. in
DNSSEC one way is right and the other way is wrong.

paul

---

From: Mohan Parthasarathy <[email-masked]>
Date: Wed, 15 Feb 2012 16:28:12 -0800

> DNSSEC one way is right and the other way is wrong.
Ok. The problem is that RFC 4035, section 3.1.3.2, mentions about ENT
under the name error response. That should be clarified in the
dnssec-bis-updates document then.

-mohan

---

From: Mark Andrews <[email-masked]>
Date: Thu, 16 Feb 2012 12:24:10 +1100

In message <[email-masked]>,
 Mohan Parthasarathy writes:
> >> RFC 4035, "3.1.3.2. =A0Including NSEC RRs: Name Error Response" has the
> >> =A0 =A0Note that this form of response includes cases in which SNAME
> >> =A0 =A0corresponds to an empty non-terminal name within the zone (a name
> >> =A0 =A0that is not the owner name for any RRset but that is the parent n=
> ame
> >> =A0 =A0of one or more RRsets).
> >>

ENT exists in 1035.  The early DNSSEC RFC turned ENT into NXD by
say there were no *names* between the end points of the NSEC record.
4035 repaired that defect by saying there were no *records* between
the end points of the NSEC record.

As for the paragraph in question is is warning the ENT may exist
in the range covered by the NSEC record.  i.e. you can't assume
that because a name is in the range that NXD is correct.  You need
to do additional checks.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mohan Parthasarathy <[email-masked]>
Date: Thu, 16 Feb 2012 10:59:18 -0800

> that because a name is in the range that NXD is correct.  You need
Ok, but I can't see how the text that I quoted translates to this. I
would have expected to see some text for the NOERROR case. It looks
like someone proposed text for this case longtime back and it did not
make it to the draft.

http://fixunix.com/dns/57177-rfc4035-missing-text-empty-non-terminal-proof.html

Can't tell where this was proposed.

-mohan