Re: Additional filtering of responses

[Paul Vixie <[e-mail]>]

> 1) Stuff in the additional section. RFC2181. Understand why Masataka and
> Paul think it is very important, and worth bickering over. Just mentioning.

first, we should not send, or if we receive, we should not cache or forward,
anything in the additional section that could be found using a new query.
this rules out all records except those referred to by NS RRs in an authority
or answer section, whose target names are at-or-below the NS RR owner name.

second, use these "glue" records only when trying to reach these nameservers,
or when answering questions or sending referrals about these nameservers.  do
not use them in answer sections, nor as additional data for MX or SRV or any
other purpose.  if needed for such "other purpose", go fetch them normally.

the small technical differences that masataka and i were bickering over have
to do with implicit antialiasing, and circular nonreachability.  i'll explain
for the gallery, even though i do not think that masataka will hear me.  if
the following responses are heard:

	authority	foo.org		NS     ns1.a.foo.org
	additional	ns1.a.foo.org	A      10.0.0.51

	authority	a.foo.org	NS     ns1.a.foo.org
	additional	ns1.a.foo.org	A      10.0.0.71

then there is a configuration error which crosses zone boundaries and is not
subject to normally operational fixits.  since both glue records are necessary
for reaching the nameserver, an RDNS has a difficult decision to make.
masataka recommends one choice, i recommend the other.  in masataka's design
the RDNS would contextualize the values of ns1.a.foo.org and use each one at
different times, depending on which NS RR was being followed.  in my design
there would never be more than one value for the glue in the rdns cache, and
it would be the deepest one (so, the one matching the most labels with the
zone whose delegation it was given for.)

then there's circular nonreachability.  in the following configuration:

	foo.org		NS	ns1.bar.net

	bar.net		NS	ns2.foo.org

my design says that neither zone is reachable, since no glue given by the
foo.org or .org servers for the ns1.bar.net nameserver would be believed,
and no glue given by the bar.net or .net servers for ns1.foo.org would be
believed.  in masataka's design, this glue can be sent, and heard, and then
used contextually, and both zones would be reachable.

these issues are now moot, since the baliwick rules of glue transmission
and reception are now enshrined in most operating nameservers as well as
several RFCs, and are "house rules" in terms of the DNSSEC design, which
contemplates baliwick issues more deeply than pre-SEC DNS did.  we can go
on bickering, and we could reopen these settled standards questions, but
we should stop treating them as open or unsettled questions.

i remain troubled and saddened by my inability to communicate effectively
with masataka, he is a brilliant and passionate dns engineer who among other
things came up with a better design for Secure DNS than any of the ones we
have standardized, and anyone who studies his work can learn a lot.  however,
our far flung rough and tumble community demands proper decorum and not just
technical excellence, and for my own self esteem i have to draw the line
someplace.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>