Re: [dnsext] Fwd: RFC 2308 & RFC 4035

[Edward Lewis <[e-mail]>]

At 16:48 -0400 2/25/11, Brian Dickson wrote:

>Does it matter which order the two responses arrive? (If it does, I
>think that indicates that there's a protocol problem....)

Order does matter, but that is not a problem in the protocol.  The 
DNS, prior to DNSSEC, had no concept of absolute (wall-clock) time 
for any reason.  Using UDP furthers the problem of trying to sequence 
the actions that occur in the system.

There was a conversation during the DNSSEC development years on 
whether the expiration/inception times could be used to try to 
sequence the values in an RRset, but this failed to come to fruition, 
partly because there is no guarantee that, for instance 
InceptionTime1>InceptionTime2 ==> ExpirationTime1>ExpirationTIme2.

Since then we've been wary of letting wall-clock time creep into DNS. 
To stop replay attacks, we need it but that's as far as it should 
really go.  This is why I once barked when someone did a survey of 
the clocks on authority servers - they shouldn't need to know the 
time of day.

What I meant to say is that the DNS protocol has the property that it 
is impossible to determine the sequence of messages in the system. 
If we built in some way to "make order unimportant" we'd severely 
crimp the protocol's scalability.  (All that locking and 
synchronization and all.)

The topic I am trying to tease out here is the question of how much 
"authority" is given to caches in generating answers.  The protocol 
is very conservative on this, as evidenced in RFC 2308's description 
of negative caching.  Again DNSSEC has tempted us to open this up, as 
quoted in the passages in the thread.

>Should it trigger discarding or non-caching of the NSEC record? (I
>think not, modulo the question on re-generation/re-signing NSEC/NSEC3
>data)

In the sense that code rules and specs walk, it would be good to get 
opinions from those who have written caches.  (I asked before, this 
isn't another nudge, I just want to emphasize this isn't mean to be a 
discussion over words in a static document.)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext