Re: [dnsext] duplicate RRs and resulting RRSIG

[bert hubert <[e-mail]>]

On Wed, Jan 04, 2012 at 12:39:04PM -0800, Mohan Parthasarathy wrote:
> Section 6.3 of RFC 4034 states:

Hi Mohan,

Thank you very much - and apologies for not searching through the relevant
RFCs!

Some notes:

> 6.3.  Canonical RR Ordering within an RRset
>    [RFC2181] specifies that an RRset is not allowed to contain duplicate
>    records (multiple RRs with the same owner name, class, type, and
>    RDATA).  Therefore, if an implementation detects duplicate RRs when

Well, it sorta says that. 

>    putting the RRset in canonical form, it MUST treat this as a protocol
>    error.  If the implementation chooses to handle this protocol error
>    in the spirit of the robustness principle (being liberal in what it
>    accepts), it MUST remove all but one of the duplicate RR(s) for the
>    purposes of calculating the canonical form of the RRset.

This is exciting language - you MUST do A, but if you don't THEN you MUST do
B ;-) We'll go for B.

> Going by this,  PowerDNS should have removed the duplicate RRs before signing.

Very clear & will do!

	Bert