Re: [dnsext] CNAME check Re: [WGLC: draft-ietf-dnsext-dnssec-bis-updates-16]

----- Original Message ----- 
From: "Andrew Sullivan" <ajs@anvilwalrusden.com>
To: <dnsext@ietf.org>
Sent: Thursday, February 02, 2012 12:05 AM
Subject: Re: [dnsext] CNAME check Re: [WGLC: 
draft-ietf-dnsext-dnssec-bis-updates-16]


> Hi,
>
> No hat.
>
> On Wed, Feb 01, 2012 at 11:40:23PM +0800, Yao Jiankang wrote:
>
>> >Now, imagine a FOO-unaware validating resolver that follows the advice
>> >you suggest.  It queries a signed zone with a FOO record.  The
>> >resolver doesn't know about FOO.  Therefore, it doesn't know that
>> >there could be a synthetic CNAME at that name, resulting from the FOO
>> >record.  Therefore, it will treat the unsigned CNAME as bogus, and the
>> >backwards compatibility doesn't happen.
>>
>> My suggested word is that "this CNAME should be neglected". It means
>> that the FOO-unaware validating resolver(when doing DNSSEC checking)
>> will see this unsigned CNAME as nothing, not accept it, and also not
>> report it as bogus. When a unsigned CNAME appears,  the FOO-unaware
>> validating resolver(when doing DNSSEC checking)  just sees nothing
>> and negelcts this CNAME. So I do not think that it will cause any
>> hole in DNSSEC.
>
> Ok, so the resolver ignores the unsigned CNAME (i.e. it's as though it
> wasn't received), and returns what to the initiator of the query
> (i.e. the originating resolver or the application or whatever)?
> NOERROR with an empty answer?  I don't understand how this is any
> better than treating the result as bogus; the originator of the query
> still can't get to the destination it was querying for, right?
>
For example,
Assume that the DNSEXT supports BNAME in the future.
 the FOO-unaware validating resolver(when doing DNSSEC checking) will not 
regard the BNAME's CNAME synthesis as bogus. So the section 5.2. " BNAME 
alias algorithm identifiers" is not needed.
 the FOO-unaware validating resolver(when DNSSEC check is not enabled) can 
use the CNAME.(unsigned CNAME is only neglected when DNSSEC check is 
enabled)

Jiankang Yao


Otherwise, the

> Best,
>
> A
>
> -- 
> Andrew Sullivan
> ajs@anvilwalrusden.com
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext
>