Re: [dnsext] duplicate RRs and resulting RRSIG

"Marco Davids (SIDN)" <marco.davids@sidn.nl> Fri, 06 January 2012 08:05 UTC

Message-ID: <4F06AB2C.9040408@sidn.nl>
Date: Fri, 06 Jan 2012 09:05:00 +0100
From: "Marco Davids (SIDN)" <marco.davids@sidn.nl>
Organization: SIDN
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.24) Gecko/20111108 Lightning/1.0b2 Thunderbird/3.1.16
MIME-Version: 1.0
To: dnsext@ietf.org
References: <CA+wr5LX8DbiGZnxEtQxRMsiW3Y+RnVHMZsBnuge=783BTL5PiQ@mail.gmail.com>
In-Reply-To: <CA+wr5LX8DbiGZnxEtQxRMsiW3Y+RnVHMZsBnuge=783BTL5PiQ@mail.gmail.com>
OpenPGP: id=A99B8609
Subject: Re: [dnsext] duplicate RRs and resulting RRSIG
Precedence: list
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: dnsext-bounces@ietf.org
Errors-To: dnsext-bounces@ietf.org

Hi Bert,

On 01/04/12 21:26, bert hubert wrote:

> RFC 2181, section 5, says that servers should (lower case) 'suppress'
> duplicate RRSIGs, which would argue that at least PowerDNS is
> partially to blame, and should've dropped the duplicate record.
> However, the outer server I think should also not feel free to drop
> records on an DNSSEC signed zone.

What about RFC4034, section 6.3:

"if an implementation detects duplicate RRs when putting the RRset in
canonical form, it MUST treat this as a protocol error.  If the
implementation chooses to handle this protocol error in the spirit of
the robustness principle (being liberal in what it accepts), it MUST
remove all but one of the duplicate RR(s) for the purposes of
calculating the canonical form of the RRset."

--
Marco
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext

[dnsext] duplicate RRs and resulting RRSIG bert hubert
Re: [dnsext] duplicate RRs and resulting RRSIG Mohan Parthasarathy
Re: [dnsext] duplicate RRs and resulting RRSIG bmanning
Re: [dnsext] duplicate RRs and resulting RRSIG bert hubert
Re: [dnsext] duplicate RRs and resulting RRSIG Doug Barton
Re: [dnsext] duplicate RRs and resulting RRSIG SM
Re: [dnsext] duplicate RRs and resulting RRSIG Marco Davids (SIDN)
Re: [dnsext] duplicate RRs and resulting RRSIG Tony Finch
Re: [dnsext] duplicate RRs and resulting RRSIG Tony Finch