Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

On Fri, Jan 27, 2012 at 9:20 PM, Mark Andrews <marka@isc.org> wrote:
>
> In message <CACU5sDnS-3V26yKyvTGObR67H2LPiBjWxCZAbMpHPZrgXJeNFg@mail.gmail.com>
> , Mohan Parthasarathy writes:
>
>> - Section 5.7 setting the AD bit on queries. Is CD=0,DO=0 in the query
>> same as AD=1,DO=0 ?
>
> The question doesn't make sense.
>
> AD=0,DO=1 and AD=1,DO=1 produce the same result.
> AD=0,DO=0 and AD=1,DO=0 produce different results.
> AD=0,DO=0 and AD=0,DO=1 produce different results.
> AD=1,DO=0 and AD=0,DO=1 produce different results.
>
Thanks for the clarification. I realized after I posted that not
setting CD and DO is pre-DNSSEC.

>> missed the discussion on this earlier. If there is a valid reason,
>> that needs to be stated explicitly as to why we are introducing this
>> new option.
>
> Section 5.7 explains why this option exists.
>
>                This allows a requestor to indicate that it understands
>   the AD bit without also requesting DNSSEC data via the DO bit.
>
>
So, "understands" here means "Please do the validation for me " ?
Then, is  CD=1, AD=1 a invalid option ?

So, there are implementations out there that want to know whether
validation was successful or not but just not want to handle any
DNSSEC records ? My question was more on what prompted the addition of
this new feature ?

-mohan

> Examples of AD=1 vs DO=1.
>
> % dig +adflag soa . +noauth +noadd
>
> ; <<>> DiG 9.7.3-P3 <<>> +adflag soa . +noauth +noadd
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41997
> ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;.                              IN      SOA
>
> ;; ANSWER SECTION:
> .                       86382   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2012012701 1800 900 604800 86400
>
> ;; Query time: 2 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Sat Jan 28 16:03:34 2012
> ;; MSG SIZE  rcvd: 285
>
> % dig +dnssec soa . +noauth +noadd
>
> ; <<>> DiG 9.7.3-P3 <<>> +dnssec soa . +noauth +noadd
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61859
> ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 14, ADDITIONAL: 1
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 4096
> ;; QUESTION SECTION:
> ;.                              IN      SOA
>
> ;; ANSWER SECTION:
> .                       86372   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2012012701 1800 900 604800 86400
> .                       86372   IN      RRSIG   SOA 8 0 86400 20120203000000 20120126230000 51201 . nhFWtVAAdecUyYiGqvYYLprczaXbhsR+XK2S+OPBrBWMAk9fPyNjRH7A rSu7I1qIBNstxAlUJ/ncn+lL5o88wDD2PZW4GXolzFc3LslvmyEcEhVe wHhPETDJEsR9rrpx1yt1o5EqhjzBrQNT4FPbmqse0z+r9v9uPCZlB+KQ OvE=
>
> ;; Query time: 1 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Sat Jan 28 16:03:44 2012
> ;; MSG SIZE  rcvd: 612
>
> %
>
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext