IETF Logo Mail Archive

Re: [DNSOP] Setting the AD bit in the query changes whether you get the AD bit in the response?

Shumon Huque <shuque@gmail.com> Sun, 07 February 2016 00:41 UTC

Return-Path: <shuque@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B2341A887D for <dnsop@ietfa.amsl.com>; Sat, 6 Feb 2016 16:41:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qCyelDxG6Vm1 for <dnsop@ietfa.amsl.com>; Sat, 6 Feb 2016 16:41:53 -0800 (PST)
Received: from mail-qg0-x233.google.com (mail-qg0-x233.google.com [IPv6:2607:f8b0:400d:c04::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04A501A8860 for <dnsop@ietf.org>; Sat, 6 Feb 2016 16:41:53 -0800 (PST)
Received: by mail-qg0-x233.google.com with SMTP id y89so21505203qge.2 for <dnsop@ietf.org>; Sat, 06 Feb 2016 16:41:52 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=p4UBiYvBoOO8OzvweSNuCNBAcykY03JBidEMDAvYe48=; b=RYgS1ejgRnNhajayXjSNz7JLYvWBD5Mpq0pZX75+oMfypIOkIqb5YFFtaSKjWbmkh9 zlESd/63uVW7h19mT4IONVn8oiSofcxK+YunvH7S/JEokXMrJi+gXH3anjUCHppWeu4H w9yKaoI9MlQfWuRGczGz5zC/F21HiWvuvmqag9yGTc4OaX0Ph/VKwNkrwKifioSWqCSl mPsDeJmFbEv+ikCoVIlhv/srqJxiWKDQJlwzd8N2WD85Ghlkrdk0QG4LaCe8xMXmXo/F RqfWX0FrZs/HrvFj9kbZ/+lxvqxF6mUVVb2Y5HRbaHtymHWVzXNEp10ylDsHN4JSUzyL ii5g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=p4UBiYvBoOO8OzvweSNuCNBAcykY03JBidEMDAvYe48=; b=AIFd9vRpmQhk7riHIvQDTQzkrv3JZgSp4Xpx7hEBt8YX+duVML1WJexTiFti2SAPoZ c98nAGrHCXMSWO7mFkTtear+YW77RQ940VoN9oybMxUKtRl+rZiVds7A/d/ZJuXtVcMF wfL6wd4YJBd7OyLAdBfzEsSyCoNLPQo593td3Wxn7CKTaXws4s5knJzghudTZnWRqebF Mvy65/84T2FbtNPAbUN3iY6HlsMaaX2YYwQRs/HZ5QfoEvFCL02IbBu9wnVZh+inLLep 0kftQqCF5cMPchIqZ5HrPWofqZs3eqP1+g7KWCixUT3QmArhYkZmebJJhvOkuQumPmnG d7AA==
X-Gm-Message-State: AG10YOQQXgHmmIDb4Nh9YHmvWqLJEzHipkBAhYmurMHR4cvjkDmEExSiFQsWSnpKQYQRlt/Ip2At9wpgUmHbXQ==
MIME-Version: 1.0
X-Received: by 10.140.237.74 with SMTP id i71mr27853394qhc.55.1454805712212; Sat, 06 Feb 2016 16:41:52 -0800 (PST)
Received: by 10.140.102.9 with HTTP; Sat, 6 Feb 2016 16:41:52 -0800 (PST)
In-Reply-To: <DA4AEF28-00FD-4E8A-AB7C-9C0AFE6485ED@vpnc.org>
References: <DA4AEF28-00FD-4E8A-AB7C-9C0AFE6485ED@vpnc.org>
Date: Sat, 06 Feb 2016 19:41:52 -0500
Message-ID: <CAHPuVdUX3jDU0ba8v-hT8fwYVTmgxQEd+bGiaHK0T4gnFGmuHQ@mail.gmail.com>
From: Shumon Huque <shuque@gmail.com>
To: Paul Hoffman <paul.hoffman@vpnc.org>
Content-Type: multipart/alternative; boundary="001a1135914cb19810052b23595c"
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/f0V36KcTFM80sr9AJwPHw5UBjek>
Cc: dnsop WG <dnsop@ietf.org>
Subject: Re: [DNSOP] Setting the AD bit in the query changes whether you get the AD bit in the response?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 07 Feb 2016 00:41:54 -0000

On Sat, Feb 6, 2016 at 7:36 PM, Paul Hoffman <paul.hoffman@vpnc.org> wrote:

> Greetings again. While doing some testing, I came across something that is
> both consistent across implementations but that I do not find in RFC 4033,
> 4034, or 4035. If a query for a properly-signed zone is sent to
> BIND-as-recursor, Unbound, or Google DNS, and the AD bit in the request is
> set to 1, the answer returned has the AD bit set to 1. However, if the
> query has the AD bit set to 0, the response always has the AD bit set to 0,
> even though the requested zone is properly signed.
>
> This happens regardless of whether or not there is an EDNS0 extension with
> the DO bit set to 1.
>
> I can't find anywhere in 403[3:5] that says that the AD bit in the request
> means anything. Did I miss that? Or is it specified in a different RFC?
>
> --Paul Hoffman
>

Paul,

https://tools.ietf.org/html/rfc6840#section-5.7

Shumon.

v2.23.0 | Report a Bug | By Email