Re: [dnsext] duplicate RRs and resulting RRSIG

On Wed, Jan 04, 2012 at 09:26:44PM +0100, bert hubert wrote:
> Hi everybody,
> 
> As part of a recent very big PowerDNS deployment as a DNSSEC signer,
> we've encountered an interesting issue. I'm sharing this here in hopes
> of hearing your wisdom, plus possibly to warn you about this happening
> in your code or deployments too.
> 
> In a zone there are three MX RRs for a name, of which 2 are identical.
> PowerDNS signs all three records in canonical order when the zone is
> transferred to BIND (at least I think it is BIND).
> 
> That server subsequently drops one of the two identical records, and
> serves only two MX RRs to the world, BUT with the RRSIG that was
> calculated from all three records. Bad data ensues, and bounced
> emails, since this is in the country that actually validates.
> 
> Now, there are at least 3 places where we might call 'bug': 1) the
> process that put duplicate RRs in the database 2) PowerDNS for signing
> the 3 RRs or 3) the 'outer' server for silently dropping one of the
> RRs, in the assumption that the RRSIG will survice this process.
> 
> RFC 2181, section 5, says that servers should (lower case) 'suppress'
> duplicate RRSIGs, which would argue that at least PowerDNS is
> partially to blame, and should've dropped the duplicate record.
> However, the outer server I think should also not feel free to drop
> records on an DNSSEC signed zone.
> 
> What do you think?
> 
>     Bert
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext

RFC 2181 is DNSSEC oblivious.

What you are asserting is that prior to signing, you have two -identical- RRs... 
which accordingto RFC 2181, would be two identical RRsets (of a single RR each).
Once signed however, the RRsets are no longer identical, the NSEC RRs don't match,
so you have three unique RRsets.  (this may require a more careful reading of the
definition of an RRset....)

So the bug might be in PowerDNS allowing for identical RRsets when one should be
suppressed.  Once signed however, the RRsets are different and the external DNS
server is ignoring the RRset and extracting just some of the RRs and doing the 
evaluation...

/bill
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext