Re: [dnsext] perhaps we should reintroduce "resimprove"

In message <CACU5sDnNUeSrW54AcodDF2MBiQP_rr2YmyFEbsqH5eAvCE5vrw@mail.gmail.com>,
 Mohan Parthasarathy writes:
> On Wed, Feb 15, 2012 at 1:59 PM, Paul Vixie <vixie@isc.org> wrote:
> > On 2/15/2012 8:11 PM, Mohan Parthasarathy wrote:
> >> On Thu, Feb 9, 2012 at 7:09 AM, paul vixie <vixie@isc.org> wrote:
> >>> ... i did not
> >>> agree that this was a problem since RBL DNS queries are always full
> >>> length (that is, for all octets or all nybbles of an inverted host
> >>> address) and since the DNSSEC specification clarified non-terminal names
> >>> as existing but empty.
> >>>
> >> RFC 4035, "3.1.3.2. =A0Including NSEC RRs: Name Error Response" has the
> >> following text towards the end:
> >>
> >> =A0 =A0Note that this form of response includes cases in which SNAME
> >> =A0 =A0corresponds to an empty non-terminal name within the zone (a name
> >> =A0 =A0that is not the owner name for any RRset but that is the parent n=
> ame
> >> =A0 =A0of one or more RRsets).
> >>
> >> I don't see anything clarified in the dnssec-bis-updates document
> >> regarding this. Could you clarify what you meant by "DNSSEC
> >> specification clarified non-terminal names as existing but empty" ?
> >
> > what i mean is hard to quote a chapter and verse for, but in dnssec if
> > an authority server receives a query for a domain name which is empty of
> > rrsets but has children, then the answer is NOERROR not NXDOMAIN, and
> > there is no need to provide the usual proofs (of no wild card and so on)
> > that would accompany an NXDOMAIN response.
> >
> > some dns implementations have been behaving this way for decades (BIND
> > for example). others have been returning NXDOMAIN under these
> > conditions. the original DNS spec didn't make either behaviour wrong. in
> > DNSSEC one way is right and the other way is wrong.
> >
> Ok. The problem is that RFC 4035, section 3.1.3.2, mentions about ENT
> under the name error response. That should be clarified in the
> dnssec-bis-updates document then.
> 
> -mohan
> 
> >
> > paul
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext

ENT exists in 1035.  The early DNSSEC RFC turned ENT into NXD by
say there were no *names* between the end points of the NSEC record.
4035 repaired that defect by saying there were no *records* between
the end points of the NSEC record.

As for the paragraph in question is is warning the ENT may exist
in the range covered by the NSEC record.  i.e. you can't assume
that because a name is in the range that NXD is correct.  You need
to do additional checks.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext