Re: [dnsext] [DNSOP] RFC2308/6604 violation in NSD and BIND?

[Paul Wouters <[e-mail]>]

On Fri, 26 Oct 2012, Peter van Dijk wrote:

> There is no corner case. The NXDOMAIN is about the last name in the CNAME
> chain (RFC2308 1) or the last lookup done in optionally following the chain
> (RFC6604 3), not about the original QNAME.
>
> In your zone you have:
>
> cname.nohats.ca.	5	IN	CNAME	doesnotexist.nohats.ca.
>
> cname.nohats.ca exists and is an entry in your NSEC3 chain.
>
> doesnotexist.nohats.ca does not exist and is denied by your NSEC3 chain:
>
>  doesnotexist.nohats.ca (5jng314a18r89qab1ilhe54l393kfu8a) denied by 4nbrqak4o1esr5qpg452fucnh8k23d15..6hlm0p5e9c1f3haq64ci0puo97lmtp8g
>
>
> As for validators, they are not supposed to look at the RCODE anyway.

I was not so much thinking of the orignal query. I was thinking of the
case where the NSEC3 has made it into the cache, and some new query causes
the validator to check its cache to see if it has nsec(3) records
proving a QNAME does or does not exist.

The odd thing is that cname.nohats.ca "kinda" exists if you look at the
nsec(3) chain. I guess resolvers implement a negative cache on the QNAME,
so they never used this data to not even ask about a QNAME, and they
still query for the QNAME despite having proof in the cache about it
not existing. In which case, my issue would not come up.

Paul