Subject: comments about morishita-dnsop-misbehavior-against-aaaa-00

From: Pekka Savola <[email-masked]>
Date: Mon, 11 Aug 2003 13:15:42 +0300 (EEST)

Hi,

A few comments on:

       Common Misbehavior against DNS Queries for IPv6 Addresses
         draft-morishita-dnsop-misbehavior-against-aaaa-00.txt

In short, I think this is a very well written and a very useful document.  
I was surprised why it wasn't on the DNSOP agenda in Vienna.

In any case, down to the comments..

substantial
-----------

4.1 Return NXDOMAIN
                                                                                                  
   This type of server returns a response with the RCODE being 3
   (NXDOMAIN) to a query for a AAAA RR, indicating it does not have any
   RRs of any type for the queried name.  In fact, such a server
   apparently returns NXDOMAIN to all queries except those for an A RR.

and:

4.3 Ignore Queries for AAAA
[...]
   Again, these servers apparently ignore all queries except those for
   an A RR.

==> is this really the case?  Do these servers *also* ignore or return an 
error to queries for NS, MX, SOA, and other resource records (and the text 
was slightly inaccurate), or does it really, really break everything 
except A records (whoops, maybe add a few words of clarification to 
underline that).

4.2 Return NOTIMP
                                                                                                  
   Other authoritative servers return a response with the RCODE being 4
   (NOTIMP), indicating the servers do not support the requested type of
   query.

[...]

  Using SERVFAIL or FORMERR would cause the same effect, though the
   authors have not seen such implementations yet.
                                                                                                  
==> I recall faintly that e.g. bind 4.9 series prior to patching some
years ago returned SERVFAIL?  Maybe also have a look at: 
http://www.wcug.wwu.edu/lists/ngtrans/200110/msg00123.html

semi-editorial
--------------

In the following sections, this
   memo describes some typical cases of the misbehavior, the rationale,
   and (bad) effects of them.

==> "them" is an ambiguous referral.  Does it refer to the both 
misbehaviour and the rationale?  Based on the memo, it looks like it 
should only refer to the misbehaviour, because the document doesn't 
generally look at the (bad) effects of the _rationale_ (why the DNS 
queries are mishandled, which is typically just due to bugs or whatnot).

editorial
---------

This memo describes details of the known cases and
   discusses the effect.

==> s/effect/effects of these cases/ (seems to end a bit abruptly?)

   Many DNS clients (resolvers) that support IPv6 first search for AAAA
   RRs (Resource Records) of a target host name, and then for A RRs of
   the same name.

s/RRs (Resource Records)/Resource Records (RRs)/

Thus, if a DNS server which is responsible for the
   name is not compliant to the specifications

==> s/to/with/ (I've seen both but I think that with is better)?

 In some cases, for example, a web browser fails to connect
   to a web server otherwise it could.

==> s/otherwise it/it otherwise/ ?

The examples are for informational purposes
   only, and the authors do not intend accusation against any
   implementations or zone administrators described in this memo.

==> s/intend accusation against/intend to accuse/

4.4 Return a Broken Response
                                                                                                  
   Some other type of authoritative servers return broken responses to
   AAAA queries.

==> s/type/types/ ?

Full Copyright Statement

==> add the IPR boilerplate section before this?

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: JINMEI Tatuya / 神明達哉 <[email-masked]>
Date: Tue, 12 Aug 2003 17:46:39 +0900

>>>>> On Mon, 11 Aug 2003 13:15:42 +0300 (EEST), 
>>>>> Pekka Savola <[email-masked]> said:

> I was surprised why it wasn't on the DNSOP agenda in Vienna.

Thanks for the careful reading and the comments.  This is the first
response to the draft as far as I know:-)

                                                                                                  

> except A records (whoops, maybe add a few words of clarification to 

This is the case at least about the examples described in the draft.
You can even check the behavior described in Section 4.3 by yourself
(I just retried and confirmed that it is still the case).

                                                                                                  
> http://www.wcug.wwu.edu/lists/ngtrans/200110/msg00123.html

Hmm, I've looked at the ngtrans message, and the latest version of the
internet-draft discussed there, but I could not find a concrete
example.  Could you be more specific please?

Regarding BIND 4.9, I don't have an environment to check the behavior
at least at this moment.  If anyone else could confirm the
information, it would be helpful.

As for editorial comments, we'll take them into account when we ever
have a chance to revise the draft.  (At the moment, I, for one, do not
see the need.)  But in any event, we appreciate all the comments.

Thanks,

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Pekka Savola <[email-masked]>
Date: Wed, 13 Aug 2003 10:09:56 +0300 (EEST)

> (I just retried and confirmed that it is still the case).

So it seems, perhaps some stronger words are in order if revising the 
draft.

> example.  Could you be more specific please?

Unfortunately, I do not know more details than that.. :-/
 
> information, it would be helpful.

I tried to look this up, but failed; in any case, I believe the code would 
be some 6-7 years old at least.  We'll see if someone else brings this up.

In doing so, I googled across this one:

http://mailman.isi.edu/pipermail/6bone/2002-October/006531.html

which brings some statistics to the play, which may be interesting.

---

From: JINMEI Tatuya / 神明達哉 <[email-masked]>
Date: Wed, 13 Aug 2003 16:54:58 +0900

>>>>> On Wed, 13 Aug 2003 10:09:56 +0300 (EEST), 

> So it seems, perhaps some stronger words are in order if revising the 

Hmm, perhaps I misunderstood your original question.  Did you
actually ask if we checked the problematic server ignored all the
65535 (2^16 - 1) RR types?  If so, the answer is no.  We only tested
against AAAA, MX, SOA, and NS (perhaps A6 or some other types).  Also,
for the "ignore" case, the checking side cannot be sure if the
authoritative server really ignores the query or some intermediate
node drops the query or the response.  That's why we used the word
"apparently" in the draft.

And, you seem to require the authors to be more concrete (for example,
"we tried to send queries for AAAA, MX, SOA, NS, ...and XX, and waited
for yy seconds.  We did not get any responses.")

Not sure if the "redundant but perfectly accurate" wording is the best
way, but I'll keep this in mind for the next revision (if any).

					JINMEI, Tatuya

---

From: Pekka Savola <[email-masked]>
Date: Wed, 13 Aug 2003 11:17:50 +0300 (EEST)

On Wed, 13 Aug 2003, JINMEI Tatuya / [ISO-2022-JP] 神明達哉 wrote:
> 65535 (2^16 - 1) RR types?  If so, the answer is no. 

No, my question was as you first interpreted.

>  We only tested

Right.
 
> way, but I'll keep this in mind for the next revision (if any).

As the title of the section is "Ignore Queries for AAAA", it may be best
to be even more explicit on what was tested and what was not.  My
immediate reaction was "OK, these broken boxes have implemented very basic
RR support, but no "fancy" new features like AAAA", but the reality was
different, and they *only* seem to implement A records.  I think this was
already stated that only A RR's get responses, but to be double sure, it
would not hurt to really, really spell it out :-) -- that the issues are
not specific to AAAA records.