Re: [dnsext] [Editorial Errata Reported] RFC6672 (5297)

I agree with Wouter.  It is technically correct* this way.  The same 
goes with the other errata (5298).  They both should be approved, IMHO.

Scott
*The Best Kind of Correct

On 23 Mar 2018, at 11:43, W.C.A. Wijngaards wrote:

> Hi,
>
> Seems fine to me too.  Also Pieter's (5298) which is also about 
> missing
> out on the NSEC and RRSIG bits.  They aren't actually the focus, which
> is why no-one missed them I guess (together with all the omitted RRSIG
> fields?), but adding NSEC and RRSIG bits is correct for a signed zone.
>
> Best regards, Wouter
>
> On 23/03/18 16:27, Warren Kumari wrote:
>> [ - RFC Editor for clutter ]
>>
>> This *seems* correct to me, but my brain turned into jelly much
>> earlier in the week -- anyone disagree with the errata?
>>
>> W
>>
>> On Fri, Mar 23, 2018 at 3:24 PM, RFC Errata System
>> <rfc-editor@rfc-editor.org> wrote:
>>> The following errata report has been submitted for RFC6672,
>>> "DNAME Redirection in the DNS".
>>>
>>> --------------------------------------
>>> You may review the report below and at:
>>> http://www.rfc-editor.org/errata/eid5297
>>>
>>> --------------------------------------
>>> Type: Editorial
>>> Reported by: Pieter Lexis <pieter.lexis@powerdns.com>
>>>
>>> Section: 5.3.4.1
>>>
>>> Original Text
>>> -------------
>>>    ;; Header: QR AA RCODE=3(NXDOMAIN)
>>>    ;; OPT PSEUDOSECTION:
>>>    ; EDNS: version: 0, flags: do; udp: 4096
>>>
>>>    ;; Question
>>>    foo.bar.example.com. IN A
>>>    ;; Authority
>>>    bar.example.com. NSEC dub.example.com. A DNAME
>>>    bar.example.com. RRSIG NSEC [valid signature]
>>>
>>> Corrected Text
>>> --------------
>>>    ;; Header: QR AA RCODE=3(NXDOMAIN)
>>>    ;; OPT PSEUDOSECTION:
>>>    ; EDNS: version: 0, flags: do; udp: 4096
>>>
>>>    ;; Question
>>>    foo.bar.example.com. IN A
>>>    ;; Authority
>>>    bar.example.com. NSEC dub.example.com. A DNAME RRSIG NSEC
>>>    bar.example.com. RRSIG NSEC [valid signature]
>>>
>>> Notes
>>> -----
>>> The NSEC record in the original text would in no case be valid as it 
>>> denies it's own existence and the existence of the RRSIG, while the 
>>> text indicates that " the validator can see that it is a  BOGUS 
>>> reply from an attacker that collated existing records from the DNS 
>>> to create a confusing reply". This indicates that NSEC and RRSIG 
>>> should be set in the NSEC bitmap
>>>
>>> Instructions:
>>> -------------
>>> This erratum is currently posted as "Reported". If necessary, please
>>> use "Reply All" to discuss whether it should be verified or
>>> rejected. When a decision is reached, the verifying party
>>> can log in to change the status and edit the report, if necessary.
>>>
>>> --------------------------------------
>>> RFC6672 (draft-ietf-dnsext-rfc2672bis-dname-26)
>>> --------------------------------------
>>> Title               : DNAME Redirection in the DNS
>>> Publication Date    : June 2012
>>> Author(s)           : S. Rose, W. Wijngaards
>>> Category            : PROPOSED STANDARD
>>> Source              : DNS Extensions
>>> Area                : Internet
>>> Stream              : IETF
>>> Verifying Party     : IESG
>>>
>>> _______________________________________________
>>> dnsext mailing list
>>> dnsext@ietf.org
>>> https://www.ietf.org/mailman/listinfo/dnsext
>>
>>
>>

===================================
Scott Rose
NIST ITL
scott.rose@nist.gov
+1-301-975-8439
GV: +1-571-249-3671
===================================