Subject: LLMNR Issue: Inappropriate use of NXRRSET RCODE

From: [email-masked] (Andreas Gustafsson)
Date: Wed, 19 Mar 2003 16:33:26 -0800 (PST)

Inappropriate use of NXRRSET RCODE
Submitter name: Andreas Gustafsson
Submitter email address: [email-masked]
Date first submitted: March 19, 2003
Reference: 
Document: LLMNR-13
Comment type: T
Priority: S
Section: multiple
Rationale/Explanation of issue:

The mdns-13 draft makes several references to the NXRRSET RCODE.  For
example, section 3.1 says LLMNR may be used "when [DNS servers]
respond to to a query with an RCODE set to NXRRSET".  It seems there
is some confusion here regarding the use of RCODE=NXRRSET versus
RCODE=3 (Authoritative Name Error, sometimes referred to as NXDOMAIN)
or RCODE=0/ANCOUNT=0.

There is an RCODE called NXRRSET (with the assigned number 8), but it
is defined as part of the DNS Dynamic Update protocol (RFC2136) and is
used specifically to indicate the non-satisfaction of a dynamic update
prerequisite - it is not used in responses to ordinary DNS queries.

The standard way to indicate the nonexistence of an RRset (at an
existing name) in the response to a DNS query is an RCODE of 0 and an
empty answer section.  The standard way to indicate the nonexistence
of a name is RCODE=3 (Authoritative Name Error).

The references to RCODE=NXRRSET should be changed to refer to either
"RCODE=3 (Authoritative Name Error)" or "RCODE=0 with an empty answer
section", as appropriate.  The proposed text changes below represent
my best guess as to which of the several references to NXRRSET in the
text were intended as references to authoritative name errors
(nonexistence of names) and which ones were intended to be
RCODE=0/ANCOUNT=0 (nonexistence of an RRset at an existing name).

Note that although the change I'm suggesting below would revert part
of the changes made in response to Issue #10, the part of #10 that
clarifies when the RRset nonexistence indication is sent (whatever its
form may be) still applies.

Requested change:

1. In the sentence

  If no positive response is received, a resolver treats it as a
  response that no records of the specified type and class for the
  specified name exist (NXRRSET).

replace "(NXRRSET)" by "(that is, it is treated the same as a response
with RCODE=0 and an empty answer section)".

2. Replace the text

   While the responder MUST NOT respond to queries for names it is not
   authoritative for, a responder MAY respond to a query for the name it is
   authoritative for, even if the type of query does not match a RR owned
   by the responder, with RCODE set to NXRRSET.  For example, if the host
   has a AAAA RR, but no A RR, and an A RR query is received, the host
   would respond with an RCODE set to NXRRSET.

by

   While the responder MUST NOT respond to queries for names it is not
   authoritative for, a responder MAY respond to a query for the name it is
   authoritative for, even if the type of query does not match a RR owned
   by the responder, with RCODE=0 and an empty answer section.  For example,
   if the host has a AAAA RR, but no A RR, and an A RR query is received, 
   the host would respond with RCODE=0 and an empty answer section.

3. In the text

   As a result, the DNS proxy will respond to AAAA RR queries sent over
   IPv4 or IPv6 with an RCODE of NXRRSET.

replace "an RCODE of NXRRSET" by "an authoritative name error (RCODE=3)".

4. In each of the places where the draft talks about a DNS server not
being configured, not replying to a query, or responding to a query
with RCODE set to NXRRSET (using any of several different wordings),
replace "[an] RCODE set to NXRRSET" with "an authoritative name error
(RCODE=3)".

-- 
Andreas Gustafsson, [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>