Subject: Re: Error codes and SIG(0)

From: Roy Arends <[email-masked]>
Date: Thu, 7 Aug 2003 19:56:12 +0200 (CEST)

On Thu, 7 Aug 2003, Scott Rose wrote:

> This is a part of the SIG(0) updating draft that is kind of an open
> question.  In the current RFC 2931, there is no error code (like in TSIG)
> returned to the client when an error occurs.  This is also an issue in
> draft-stjohns-secure-notify-00.txt when talking about error codes to return
> when using SIG(0)'s as part of the notify message.
>
> Is there a need to have some sort of error code returned when using SIG(0)?
> This could be the same codes as used with TSIG (BADSIG, BADTIME), with a
> slight variation in meaning.  Probably with never having a return signed
> with a SIG(0) (to prevent an easy DoS attack).  It would just return the
> error response without a SIG(0).
>
> The first question to ask ourselves is whether or not there needs to be text
> on error return codes for SIG(0) errors.

IMHO it would be very handy for debugging server side problems. If an
error is replicated in a response message, it would be handy to classify
them in BADSIG BADKEY BADTIME BADMODE BADNAME BADALG. It would actually
be handy to map them them in the extended RCODE in the OPT (edns(0))
record as well.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Scott Rose" <[email-masked]>
Date: Thu, 7 Aug 2003 14:39:55 -0400

However, there seems to be a problem.  The TSIG extended rcode values are
stored in the TSIG, while the "extended RCODE" value is in the OPT RR.
According to the IANA database, both have reserved the code 16 for BADVERS
and BADSIG.  There is no space for an extended rcode value in the SIG(0) RR,
unless the spec is changed to give remap a field to that purpose.

Or else the two competing rcode assignments be reconciled somehow.

Scott