IETF Logo Mail Archive

Re: [DNSOP] [Technical Errata Reported] RFC8078 (5049)

Ondřej Caletka <Ondrej.Caletka@cesnet.cz> Wed, 28 June 2017 11:27 UTC

Return-Path: <Ondrej.Caletka@cesnet.cz>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5049B1293E1 for <dnsop@ietfa.amsl.com>; Wed, 28 Jun 2017 04:27:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.301
X-Spam-Level:
X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cesnet.cz
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R68MxRQ_Lwki for <dnsop@ietfa.amsl.com>; Wed, 28 Jun 2017 04:27:07 -0700 (PDT)
Received: from office2.cesnet.cz (office2.cesnet.cz [IPv6:2001:718:1:101::144:244]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFD2912EBF9 for <dnsop@ietf.org>; Wed, 28 Jun 2017 04:27:06 -0700 (PDT)
Received: from [IPv6:2001:718:1:6::134:196] (oskarpc.cesnet.cz [IPv6:2001:718:1:6::134:196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by office2.cesnet.cz (Postfix) with ESMTPSA id 14BA5200AD; Wed, 28 Jun 2017 13:27:04 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cesnet.cz; s=office2; t=1498649224; bh=s21TuIA95uMY5kjZFSQM+Akf6WjtJhkJYGnMr0G3s24=; h=Subject:To:References:Cc:From:Date:In-Reply-To; b=f37Ze0tynFfkeVKGHlVPF3zabjDbIRf3meMkBFX/9RS7eRV8hS16xSwIlPlT7Yd/F j2rs6oXPmv3oSYUyZJhXrEtVar9jxbLJTGG9rMWVhFnukj9bDBpLymNF349SJPkXgK IqYb2DLm18788ExyN3oSGCnCuZRMQ7ZEoFtzg8Fg=
To: Mark Andrews <marka@isc.org>, Dick Franks <rwfranks@acm.org>
References: <20170623105434.22478B810AB@rfc-editor.org> <CAN6NTqyBg74NF-F8imGiK0ArwxAbhc0uE_xXbX-No+Le8E9DUg@mail.gmail.com> <CAKW6Ri7npS57gupPrUc2aGhsg21u8csx+69GKrCFkeQ6H5Dnxw@mail.gmail.com> <9284fde5-ea75-a25a-3aa1-2e521753dc3e@cesnet.cz> <519c2cb0-0239-e28f-e4e8-6dcb13459d3d@pletterpet.nl> <CAKW6Ri5hsUEFuWmVp1UNauk=C7HykdiA9stQoMcdDs6gd6+axg@mail.gmail.com> <cfed78ae-0133-e883-f579-3a9ca92ccab0@pletterpet.nl> <CAKW6Ri55OMz2ZO27XVNeEYTqscx6hJk+VqTE7p8DyV53uQ0YmA@mail.gmail.com> <20170627145452.623CB7C84E77@rock.dv.isc.org> <CAM1xaJ8UniCt+8CnO70_6GM9e6TvyN-0BVC69MRmaXcM78kviQ@mail.gmail.com> <CAKW6Ri6jCkm09UoJCoBe6c9jMsMjO4OihnCtzSmewnXQXv4qdw@mail.gmail.com> <20170628042127.863D87CA0CFF@rock.dv.isc.org>
Cc: tjw ietf <tjw.ietf@gmail.com>, Matthijs Mekking <matthijs@pletterpet.nl>, Jan Včelák <jv@fcelda.cz>, IETF DNSOP WG <dnsop@ietf.org>, Suzanne Woolf <suzworldwide@gmail.com>, pwouters@redhat.com, bclaise@cisco.com, Ólafur Guðmundsson <olafur@cloudflare.com>, Olafur Gudmundsson <olafur+ietf@cloudflare.com>, RFC Editor <rfc-editor@rfc-editor.org>, Jaromír Talíř <jaromir.talir@nic.cz>
From: Ondřej Caletka <Ondrej.Caletka@cesnet.cz>
Message-ID: <6e0e2e92-6c06-38cf-16d9-a78ddfbaaed6@cesnet.cz>
Date: Wed, 28 Jun 2017 13:27:03 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <20170628042127.863D87CA0CFF@rock.dv.isc.org>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="------------ms010703010307080509000101"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/sa84hDKFlCKsqn_FDxenS1pw-GE>
Subject: Re: [DNSOP] [Technical Errata Reported] RFC8078 (5049)
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Jun 2017 11:27:09 -0000

Hello,

>Dick Franks:
>> What is needed now is methodical use-case analysis based on RFC8078 as it
>> exists now and tested against a real implementation.  The time to rewrite
>> the RFC will come if/when we discover we are unable to live with it. We
>> have not reached that point yet.
Mark Andrews:
> I can't go from RFC8078 to a working implementation because the
> existing description is not clear enough to do it.  I don't think
> anyone can do it.
> 
> With the proposed errata fix I could write code.  For CDS the RRset
> is a single RR with a rdata of 0x00 0x00 0x00 0x00 0x00.  For CDNSKEY
> the RRset is a single RR with a rdata of 0x00 0x03 0x00 0x00 0x00.

I have a confirmation from the real implementation of RFC8078 in the .CZ
domain registry (cc jaromir.talir) that their understanding of CDNSKEY
DELETE operation is exactly the set of RDATA quoted by Mark Andrews,
which translates to the presentation form CDNSKEY 0 3 0 AA==

I don't think there is a big room to interpret RFC 8078 differently,
since it does not define any new presentation/wire format for
CDS/CDNSKEY record. Therefore, even future versions of software that
(de-)serializes RRs between wire and presentation format will have
issues if there are not all fields mandated by RFC 4034 present in the
rdata.

--
Ondřej Caletka

v2.23.0 | Report a Bug | By Email