[DNSOP] Where in a CNAME chain is the QNAME?

Stephane Bortzmeyer <bortzmeyer@nic.fr> Tue, 20 September 2016 16:17 UTC

Return-Path: <bortzmeyer@nic.fr>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEC6C12B3F7 for <dnsop@ietfa.amsl.com>; Tue, 20 Sep 2016 09:17:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JkRcXtRoJVZI for <dnsop@ietfa.amsl.com>; Tue, 20 Sep 2016 09:17:29 -0700 (PDT)
Received: from mail.bortzmeyer.org (aetius.bortzmeyer.org [IPv6:2001:4b98:dc0:41:216:3eff:fece:1902]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADB3C12B2ED for <dnsop@ietf.org>; Tue, 20 Sep 2016 09:17:29 -0700 (PDT)
Received: by mail.bortzmeyer.org (Postfix, from userid 10) id 5046731CA5; Tue, 20 Sep 2016 18:17:27 +0200 (CEST)
Received: by godin (Postfix, from userid 1000) id ADA48EC0AFD; Tue, 20 Sep 2016 18:13:50 +0200 (CEST)
Date: Tue, 20 Sep 2016 18:13:50 +0200
From: Stephane Bortzmeyer <bortzmeyer@nic.fr>
To: dnsop@ietf.org
Message-ID: <20160920161350.GA3288@laperouse.bortzmeyer.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Transport: UUCP rules
X-Operating-System: Ubuntu 16.04 (xenial)
X-Charlie: Je suis Charlie
User-Agent: Mutt/1.5.24 (2015-08-30)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/GFgQFVuRwdG3PqhSClcyMXaOWjs>
Subject: [DNSOP] Where in a CNAME chain is the QNAME?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 20 Sep 2016 16:17:32 -0000

Do you like long terminology discussions, backed by a dozen RFC, where
people disagree on what's written in these RFC? If so, read on.

This issue was spotted by Peter van Dijk. It is about
draft-ietf-dnsop-nxdomain-cut-05, recently approved by IESG. The
problem is the definition of "QNAME" when there is a CNAME chain.

Section 1.1 says:

> "Denied name": the domain name whose existence has been denied by a
> response of rcode NXDOMAIN.  In most cases, it is the QNAME but,
> because of [RFC6604], it is not always the case.

And section 2:

> Warning: if there is a chain of CNAME (or DNAME), the name which
> does not exist is the last of the chain ([RFC6604]) and not the
> QNAME.  The NXDOMAIN stored in the cache is for the denied name, not
> always for the QNAME.

This text in draft-ietf-dnsop-nxdomain-cut-05 assumes that the QNAME
is the owner name in the Question Section. But RFC 2308 thinks otherwise:

> "QNAME" - the name in the query section of an answer, or where this
> resolves to a CNAME, or CNAME chain, the data field of the last
> CNAME.

RFC 1034 had a different definition of QNAME but is not clear on the
specific case of CNAME chains:

> A standard query specifies a target domain name (QNAME)

RFC 7719 does not define QNAME (probably because it seemed obvious).

So, which is right? In this DNS query:

% dig A www.afnic.fr

; <<>> DiG 9.10.3-P4-Ubuntu <<>> A www.afnic.fr
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35551
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;www.afnic.fr.		IN A

;; ANSWER SECTION:
www.afnic.fr.		213 IN CNAME www.nic.fr.
www.nic.fr.		213 IN CNAME lb01-1.nic.fr.
lb01-1.nic.fr.		213 IN A 192.134.5.24

;; Query time: 875 msec
;; SERVER: 192.168.43.1#53(192.168.43.1)
;; WHEN: Tue Sep 20 18:11:06 CEST 2016
;; MSG SIZE  rcvd: 100

Is the QNAME "www.afnic.fr" or "lb01-1.nic.fr" ("the data field of the
last CNAME")???