Re: TKEY compatibility problems

[Kevin Darcy <[e-mail]>]

The key word in the RFC 1123 verbiage is "acquire". The only data that you
"acquire" in an AXFR transaction are Answer-section RRs. Anything else in
the response is to be considered "meta-data", and if you don't understand
it and/or didn't ask for it, you should ignore it.

Similarly, for ordinary queries, I don't know that "result", as used in the
RFC 1123 verbiage you quoted, extends beyond the direct answer to the
query, i.e. the Answer Section. Maybe it also encompasses the contents of
the Authority Section in the case of a referral...


- Kevin

D. J. Bernstein wrote:

> Suppose I'm a DNS cache with no special knowledge of type TKEY or type
> XYZZY. Someone asks me for all nominum.com records of type XYZZY.
>
> One of the nominum.com servers gives me the following response,
> including a spontaneously generated TKEY record, which Wellington says
> is not prohibited by the TKEY specification:
>
>    query: XYZZY nominum.com
>    answer: nominum.com 3600 XYZZY ...
>    authority: nominum.com 3600 NS ...
>    authority: nominum.com 3600 NS ...
>    authority: nominum.com 3600 NS ...
>    additional: gns1.nominum.com 3600 A ...
>    additional: gns2.nominum.com 3600 A ...
>    additional: nominum.com 3600 TKEY ...
>
> All those records are within nominum.com, so I cache all of them.
>
> I do _not_ ignore the two records of unrecognized types. As stated in
> RFC 1123, section 6.1.3.5: ``A name server may acquire, via zone
> transfer, RRs that the server doesn't know how to convert to printable
> format. A resolver can receive similar information as the result of
> queries. For proper operation, this data must be preserved.''
>
> I do _not_ ignore the three authority records, and I do _not_ ignore the
> three additional records. Wellington's comment ``they're not part of the
> zone, as indicated by the fact that they're in the additional section''
> is completely out of touch with the existing DNS protocol.
>
> Someone now asks me for all nominum.com records of type *. I am entirely
> within my rights to respond with all the cached nominum.com records,
> including the TKEY record:
>
>    query: * nominum.com
>    answer: nominum.com 3597 NS ...
>    answer: nominum.com 3597 NS ...
>    answer: nominum.com 3597 NS ...
>    answer: nominum.com 3597 TKEY ...
>    answer: nominum.com 3597 XYZZY ...
>
> Wellington claims that TKEY-aware clients may barf on this response.
>
> The inescapable conclusion is that the TKEY protocol is broken. It is
> incompatible with the existing protocol. It has to be fixed.
>
> How can a broken protocol be used as an argument against the behavior of
> my AXFR implementation? I'm indisputably allowed to save records from
> the authority section and the additional section when I'm a cache, so
> why can't I do the same when I'm an AXFR client?
>
>





to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.