Message-Id: <m1sWxJi-0000MEC@stereo.hq.phicoh.net>
To: dnsop@ietf.org
From: Philip Homburg <pch-dnsop-5@u-1.phicoh.com>
Sender: pch-b538D2F77@u-1.phicoh.com
References: <m1sWF8d-0000LsC@stereo.hq.phicoh.net>
 <1070949df20a6ac1f9c2c2dd401d5953bb362bf2.camel@aisec.fraunhofer.de>
 <m1sWe2O-0000OKC@stereo.hq.phicoh.net>
 <fc306ade9816e06e19a1e2c9828c1c9ef2f0e2bb.camel@gnu.org> 
In-reply-to: Your message of "Wed, 24 Jul 2024 16:20:09 +0000 ."
             <fc306ade9816e06e19a1e2c9828c1c9ef2f0e2bb.camel@gnu.org>
Date: Thu, 25 Jul 2024 14:11:27 +0200
Message-ID-Hash: DQX4G63SIT2WNAQSPYOPEU5B53DJRZDC
CC: Martin Schanzenbach <schanzen@gnu.org>
Precedence: list
Subject: =?utf-8?q?=5BDNSOP=5D_Re=3A_Potentially_interesting_DNSSEC_library_CVE_?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/dnsop/T0l58kjlDwgKNOT8ASaD5CxLAP8>

> I think this is the core issue behind the CVE and the filed bug.
> Who is the "ultimate user"? And where is this expectation formulated
> exactly? I would believe that most applications using DNS libraries
> such as dnsjava do not expect that they have to sift through CNAMEs
> in the replies and filter according to their initial query.  So is
> dnsjava in your opinion the "ultimate user" that is expected to
> filter? If yes, "ultimate user" is an odd description because
> dnsjava is a resolver implementation, whereas "ultimate user" to
> me means application using a resolver (library/implementation).

The typical model is that of a library that implements a DNS stub resolver
function. This library is expected to offer a function that takes a QNAME,
QCLASS, and QTYPE as arguments and returns a set of resource records or an
error.

If dnsjava implements the function of a stub resolver, then yes, dnsjava would
be expected to sift through the CNAMEs. A stub resolvers speaks the DNS
protocol and this is just how the protocol works.

Obviously, you are free to define a new protocol that runs between a
stub resolver and a recursive resolver. However, just compaining about the
current situation is not going to change much.