Subject: [DNSOP] I-D Action: draft-ietf-dnsop-extended-error-10.txt

From: [email-masked]
Date: Fri, 27 Sep 2019 16:32:16 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations WG of the IETF.

        Title           : Extended DNS Errors
        Authors         : Warren Kumari
                          Evan Hunt
                          Roy Arends
                          Wes Hardaker
                          David C Lawrence
	Filename        : draft-ietf-dnsop-extended-error-10.txt
	Pages           : 13
	Date            : 2019-09-27

Abstract:
   This document defines an extensible method to return additional
   information about the cause of DNS errors.  Though created primarily
   to extend SERVFAIL to provide additional information about the cause
   of DNS and DNSSEC failures, the Extended DNS Errors option defined in
   this document allows all response types to contain extended error
   information.  Extended DNS Error information does not change the
   processing of RCODEs.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-extended-error/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-dnsop-extended-error-10
https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-extended-error-10

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-extended-error-10

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 30 Sep 2019 18:23:31 -0400

> On Sep 27, 2019, at 7:32 PM, [email-masked] wrote:
> 

Perhaps at my instigation the descriptions for:

	3.8.  Extended DNS Error Code 7 - Signature Expired
and	3.9.  Extended DNS Error Code 8 - Signature Not Yet Valid

were changed in version 10 to read, respectively:

	... but all the signatures in an RRset in the validation chain were expired.
	... but all the signatures received were not yet valid.

But I guess it is also possible in pathological cases, that both
might apply.  Specifically, when none of the RRSIGs are extant, with
at least one expired, and the rest (at least one) not yet valid.

FWIW, the language could be amended to accommodate this possibility:

	... but no signatures are presently valid and some (often all) are expired.
	... but no signatures are presently valid and some are not yet valid.

Which raises another question: Can an OPT RR legitimately carry more than one EDE
option, and thereby communicate multiple errors?  Such as perhaps the above
hypothetical with some RRSIGs expired, and some not yet vlid.

-- 
	Viktor.

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 30 Sep 2019 16:06:38 -0700

> 	... but no signatures are presently valid and some are not yet valid.

Ok, changed to that text.

> Which raises another question: Can an OPT RR legitimately carry more
> than one EDE option, and thereby communicate multiple errors?  Such as
> perhaps the above hypothetical with some RRSIGs expired, and some not
> yet vlid.

Yes, the draft discusses including multiple EDE reports.

-- 
Wes Hardaker
USC/ISI

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 30 Sep 2019 21:22:15 -0400

> On Sep 30, 2019, at 7:06 PM, Wes Hardaker <[email-masked]> wrote:
> 

I appears that text discussing the possibility of multiple EDE values
present in earlier drafts may have been inadvertently removed in -07.
I think such text should be restored, making it clear that the OPT
record may contain multiple pertinent EDE values.

-- 
	Viktor.