Re: [dnsext] Fwd: RFC 2308 & RFC 4035

[Edward Lewis <[e-mail]>]

At 10:42 +1100 2/27/11, Mark Andrews wrote:

>We do this for NXDOMAIN today.  If we ask for A foo.example and get
>back a NXDOMAIN then the cache gets asked for AAAA foo.example we
>use that NXDOMAIN.

That's cool - it complies with NCACHE (in a part I didn't quote).  I 
know you (as author know that, but I'm just saying it here.

>Using the NSEC/NSEC3 that matches the <qname,qclass>
>really no different.

There's a bit if difference.  I've been dealing with zones that are 
highly dynamic.  Signing such zones can be a challenge.  Besides the 
number of signatures needed for the positive answers, which is simply 
part of the workload is the generation and signing of the negative 
answers.

The way that NCACHE is written today, a simplifying assumption can be 
made for the NSEC/3 bit map if the negative cache is really type 
specific, basically returning a bit map that says "I don't have 
*that*".  If the negative cache is going to be name specific then the 
NSEC/3 has to state exactly what is there at the moment.

I'm asking this in the sense that on paper I would only need to send 
back "I don't have that" but if the deployed code tries to be 
tighter, I have to craft bit maps for each combination.  In addition 
to the provisioning and signing overhead, having to determine what's 
present "right now" will have to be done.

Even if that is pulled off, negative caches could be subject to 
higher false-positive negative-cache hits when sets become available. 
This could be a case where over-tightening on the security checks is 
a bad thing.   In this case, it isn't really the security, but the 
inferences made about the authority by the cache.

>The much more interesting question is infering NXDOMAIN for a
><qname,qclass> we havn't asked for.  Named already does this when
>looking for DLV records when validating but is expected by all
>parties involved.

Again, this is forbidden in RFC 2308 but brought up in resimprove.  I 
have to say there's something seductive about the idea, but it's like 
a siren's call to make caches take over being authorities.  I think 
that's something that should be resisted.  (And this also related to 
inferring across types at a name.)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"