Re: [homenet] I-D Action: draft-ietf-homenet-dot-11.txt (FINAL?)

Ted Lemon <mellon@fugue.com> Wed, 09 August 2017 15:54 UTC

MIME-Version: 1.0
In-Reply-To: <20170809031722.28F8F81C6FC7@rock.dv.isc.org>
References: <150223150804.3668.14190745110025046639@ietfa.amsl.com> <79597E4D-DEC0-4622-A410-003B45EB5E6A@fugue.com> <20170809031722.28F8F81C6FC7@rock.dv.isc.org>
From: Ted Lemon <mellon@fugue.com>
Date: Wed, 09 Aug 2017 11:53:42 -0400
Message-ID: <CAPt1N1mkOheWcQAispL7zpK=Whcjm=7ibjJcv9-DuNJKFyBiXw@mail.gmail.com>
To: Mark Andrews <marka@isc.org>
Cc: HOMENET <homenet@ietf.org>, Warren Kumari <warren@kumari.net>
Content-Type: multipart/alternative; boundary="94eb2c19f1420003e6055654182f"
Archived-At: <https://mailarchive.ietf.org/arch/msg/homenet/UcdQkuuGAOqr51Ggym25NLlfuNw>
Subject: Re: [homenet] I-D Action: draft-ietf-homenet-dot-11.txt (FINAL?)
Precedence: list

What does forwarding DS lookups for home.arpa out of the homenet do?   That
is, suppose I implement a cache that doesn't do this: what bad thing
happens?   It's going to return NXDOMAIN, right?   Isn't it the NSEC
lookups that have to succeed, and the NS record lookup?   And doesn't the
NS record have to be forged?

I think this actually means that it does have to be an unsigned delegation.
  Argh.

Hm, thinking farther, no, it doesn't, because it's okay to return the right
answer for the delegation as long as the stub resolver is willing to rely
on the cache, which we've already specified it must do.   So what's the
failure mode that this new text prevents?  Oh, you have to look up the DS
record to get the NSEC that validates it?

(I'm leaving in all of the stuff I typed while I was thinking this through
because I'm not sure I got it right, and you can point out what I got
wrong.)

On Tue, Aug 8, 2017 at 11:17 PM, Mark Andrews <marka@isc.org> wrote:

>
> In message <79597E4D-DEC0-4622-A410-003B45EB5E6A@fugue.com>, Ted Lemon
> writes:
> > I updated homenet-dot with the change that Mark requested regarding
> > signed, unsigned and insecure delegations.   I believe the text is
> > correct now, but would appreciate a sanity check.   Otherwise, I think
> > it's up to the chairs to make the next move.
>
> I would explictly list DS home.arpa as a exception.  (I had to file
> a bug report against recursive server that failed to have this
> exception this week for AS112 zones.  The bug has been fixed.)  Also
> I wouldn't be using '.home.arpa.' as we also want to stop queries
> for 'home.arpa' leaving the home.  There are a couple of references
> to '.home.arpa'.
>
> e.g.
>
> Old:
>    DNS queries for names ending with '.home.arpa.' are resolved using
>    local resolvers on the homenet.  Such queries MUST NOT be recursively
>    forwarded to servers outside the logical boundaries of the homenet.
>
> New:
>    DNS queries for names ending with 'home.arpa.' are resolved using
>    local resolvers on the homenet.  Such queries MUST NOT be recursively
>    forwarded to servers outside the logical boundaries of the homenet with
>    the exception of DS lookups for 'home.arpa.'.
>
> Mark
>
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
>

[homenet] I-D Action: draft-ietf-homenet-dot-11.t… internet-drafts
Re: [homenet] I-D Action: draft-ietf-homenet-dot-… Ted Lemon
Re: [homenet] I-D Action: draft-ietf-homenet-dot-… Mark Andrews
Re: [homenet] I-D Action: draft-ietf-homenet-dot-… Ted Lemon
Re: [homenet] I-D Action: draft-ietf-homenet-dot-… Mark Andrews