Re: [DNSOP] Where in a CNAME chain is the QNAME?

["Peter van Dijk" <[e-mail]>]

Hello Paul,

On 26 Sep 2016, at 16:32, Paul Hoffman wrote:

> On 26 Sep 2016, at 0:33, Peter van Dijk wrote:
>
>> 2308 does not “redefine” QNAME. It clarifies that the usage in 
>> 1034 4.3.2 is the definition we use in RFCs. 1035 4.1(.2) does not 
>> conflict with this; the QNAME there is just the initial QNAME.
>
> This seems like a very limited view of RFC 1034. RFC 1034 actually 
> defines QNAME in Section 3.7.1:
>
> 3.7.1. Standard queries
>
> A standard query specifies a target domain name (QNAME), query type
> (QTYPE), and query class (QCLASS) and asks for RRs which match.
>
> Further, the usage in Section 4.3.2 does not say that the QNAME is the 
> last name in the chain, just that the algorithm itself repeats with a 
> new value for QNAME:
>
>             If the data at the node is a CNAME, and QTYPE doesn't
>             match CNAME, copy the CNAME RR into the answer section
>             of the response, change QNAME to the canonical name in
>             the CNAME RR, and go back to step 1.

My reading of 3.7.1 + 4.3.2 is ‘the QNAME, at any time, means the name 
currently under consideration; initially this is the name from the query 
packet, but it gets updated on every CNAME follow’. To make QNAME work 
consistently between 1034, 2308 and several of the RFCs mentioned below, 
this is the only interpretation that makes sense to me. I don’t see 
any conflict between 1034 and 2308 given this reading.

>> Many other RFCs need 2308: 2874, 4035, 4343, 4592, 4470, 4471, 5074, 
>> 5155, 6147, 6672 and most likely several others rely on the 2308 
>> definition of QNAME. Without 2308, each of these RFCs would need 
>> extra text such as the text your draft has now. It is simply not 
>> necessary.
>
> I'm quite concerned about the assertion that RFC 4035 relies on RFC 
> 2038's definition. QNAME is only mentioned in Section 4.5 and 4.7 
> there, and I don't see how those usages indicate that it is the last 
> name in a chain. Can you clarify?

I agree - on rereading that part of 4035 indeed it is talking about 
whole response packets. Must’ve confused it with denials, like in 
5155.

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/