Re: [dnsext] perhaps we should reintroduce "resimprove"

[Mohan Parthasarathy <[e-mail]>]

On Wed, Feb 15, 2012 at 5:24 PM, Mark Andrews <[e-mail]> wrote:
>
> In message <[e-mail]>,
>  Mohan Parthasarathy writes:
>> On Wed, Feb 15, 2012 at 1:59 PM, Paul Vixie <[e-mail]> wrote:
>> > On 2/15/2012 8:11 PM, Mohan Parthasarathy wrote:
>> >> On Thu, Feb 9, 2012 at 7:09 AM, paul vixie <[e-mail]> wrote:
>> >>> ... i did not
>> >>> agree that this was a problem since RBL DNS queries are always full
>> >>> length (that is, for all octets or all nybbles of an inverted host
>> >>> address) and since the DNSSEC specification clarified non-terminal names
>> >>> as existing but empty.
>> >>>
>> >> RFC 4035, "3.1.3.2. =A0Including NSEC RRs: Name Error Response" has the
>> >> following text towards the end:
>> >>
>> >> =A0 =A0Note that this form of response includes cases in which SNAME
>> >> =A0 =A0corresponds to an empty non-terminal name within the zone (a name
>> >> =A0 =A0that is not the owner name for any RRset but that is the parent n=
>> ame
>> >> =A0 =A0of one or more RRsets).
>> >>
>> >> I don't see anything clarified in the dnssec-bis-updates document
>> >> regarding this. Could you clarify what you meant by "DNSSEC
>> >> specification clarified non-terminal names as existing but empty" ?
>> >
>> > what i mean is hard to quote a chapter and verse for, but in dnssec if
>> > an authority server receives a query for a domain name which is empty of
>> > rrsets but has children, then the answer is NOERROR not NXDOMAIN, and
>> > there is no need to provide the usual proofs (of no wild card and so on)
>> > that would accompany an NXDOMAIN response.
>> >
>> > some dns implementations have been behaving this way for decades (BIND
>> > for example). others have been returning NXDOMAIN under these
>> > conditions. the original DNS spec didn't make either behaviour wrong. in
>> > DNSSEC one way is right and the other way is wrong.
>> >
>> Ok. The problem is that RFC 4035, section 3.1.3.2, mentions about ENT
>> under the name error response. That should be clarified in the
>> dnssec-bis-updates document then.
>>
>> -mohan
>>
>> >
>> > paul
>> _______________________________________________
>> dnsext mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/dnsext
>
> ENT exists in 1035.  The early DNSSEC RFC turned ENT into NXD by
> say there were no *names* between the end points of the NSEC record.
> 4035 repaired that defect by saying there were no *records* between
> the end points of the NSEC record.
>
> As for the paragraph in question is is warning the ENT may exist
> in the range covered by the NSEC record.  i.e. you can't assume
> that because a name is in the range that NXD is correct.  You need
> to do additional checks.
>
Ok, but I can't see how the text that I quoted translates to this. I
would have expected to see some text for the NOERROR case. It looks
like someone proposed text for this case longtime back and it did not
make it to the draft.

http://fixunix.com/dns/57177-rfc4035-missing-text-empty-non-terminal-proof.html

Can't tell where this was proposed.

-mohan

> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: [phone]                 INTERNET: [e-mail]
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext