Re: [dnsext] perhaps we should reintroduce "resimprove"

On 10/02/2012 04:17, W.C.A. Wijngaards wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi Stephane,
>
> On 02/10/2012 09:44 AM, Stephane Bortzmeyer wrote:
>> It seems to me that this draft does not currently address the ghost
>> domain problem. It mandates revalidation at the parent when the
>> records expire, but it does not say anything about the rules that
>> allow an authoritative server to overwrite the old TTL with a new
>> value, thus preventing expiration.
>>
>> Would it be a better idea to use this draft as a starting point to
>> work on the issues proposed by the ghost domains paper? (Replacing>=
>> by>  in the credibility rules and other measures.)
>
> This replacement is wrong.  We must have '=' in>= to pick up zone
> changes from the same server.  We must have revalidation at the parent
> for the ghost-domain problem, it is simply a case of having the NS TTL
> expire (i.e. meaning, the NS RRset can be replaced with a newer one but
> the NS TTL does not increase).
>
> Best regards,
>     Wouter
>

<no-hat>

Strictly speaking when a resolver gets a RRset there are 4 different 
actions it can take:

Store: Applicable when the RRset does not exist
Replace: Applicable when there is a prior set
Ignore: always an option
Delete: This says that the resolver has lost confidence in the cached.

For Credibility Greater ">"  the following options make sense
	Store, Replace

For Credibility Equal "="   the following options make sense
	Ignore, Delete

For Credibility Less "<"
	Ignore

If you do Replace on NS on "=" you get ghost domains, because
NS set and Glue are the only data that resolver will see in an answer 
that it potentially has in cache.
If you insist on allowing "Replace" on equal then you MUST implement 
"Fetch NS from child" and "Fetch all glue" to combat the ghost domains 
and still have Kaminsky defense.

	Olafur

_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext