Subject: Re: [dnssec-deployment] some observations about .SE's DNSSEC

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 27 Sep 2007 10:25:57 +0200

Colleagues,

Below is a mail from Mats Sufberg, its part of a thread on the DNSSEC  
deployment list (http://mail.shinkuro.com:8100/Lists/dnssec- 
deployment/).

The background to this story is that a popular implementation started  
shipping code that sets the AD bit on validated responses even though  
the DO bit was not set on the query. These answers are getting stuck  
in the filters of popular DSL modems. The result being that data from  
secured zones would not be resolved.

The case is made that when there is a trust relation between the stub  
resolver and the validating nameserver you do not need to have all  
the DNSSEC information that you receive when you set the DO bit. On  
the other hand it was observed that a resolving nameserver should not  
just set bits in query headers without being instructed to do so.

The suggestion is that the AD bit is used in the query to signal the  
readiness to deal with AD bits in the answer.

I think its a fine idea and would support such text in  draft-ietf- 
dnsext-dnssec-bis-updates.

If folk think this needs an I-D then I'd be willing to edit it.

--Olaf

On 27Sep 2007, at 9:51 AM, <[email-masked]> wrote:

>> From: DNSSEC deployment
>> [mailto:[email-masked]] On Behalf Of Mark Andrews
>> Sent: den 27 september 2007 08:48
> (...)
>>> On 27 sep 2007, at 00.41, Mark Andrews wrote:
>>>
>>>> 	As AD is only supposed to be used where you trust the server
>>>> 	could we use AD itself to signal that we want AD to be set in
>>>> 	the response when DO is not set.
>>>
>>> if you can set AD, why not set DO and just ignore the
>> signatures in
>>> the response? that's how we do it in the stand-alone
>> implementation
>>> of getrrsetbyname() used by OpenSSH-portable.
>>>
>>> 	jakob
>>
>> 	Why ask for more than you need?
>
> Either of the two solutions would probably work. The lesson we should
> learn from the broadband router problem is that a DNSsec enhanced
> nameserver (resolving or hosting) should behave just like a non-DNSsec
> nameserver unless being asked to include DNSsec information.
>
> The AD flag in query has no other meaning and could be interpreted as
> "Authentication check Desired".
>
>

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: bert hubert <[email-masked]>
Date: Thu, 27 Sep 2007 11:16:28 +0200

> in the filters of popular DSL modems. The result being that data from  
[..]
> >nameserver unless being asked to include DNSsec information.

In fact, it should behave exactly like BIND 8 or 9:
http://blog.netherlabs.nl/articles/2006/04/13/the-general-mediocrity-of-the-world
(skip a bit past the rant to 'Go read the RFC already').

Compression is now mandatory, 0xc00c means 'start of answer' to the people
who build residential equipment that deals with DNS...

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Fri, 28 Sep 2007 08:03:38 +1000

> secured zones would not be resolved.

	Note this was legal to do back in 1999 when DNSSEC was first
	released. 

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Fri, 28 Sep 2007 00:48:41 +0200

> 	Note this was legal to do back in 1999 when DNSSEC was first

That is noted, I think that the behavior then made sense, just as it  
makes sense today.

Unfortunately we are only seeing deployment 8 years later and now the  
world is stuffed with DSL modems that do not expect the AD bit to be  
set and are less liberal in what they except then they should.

--Olaf

---

From: Mark Andrews <[email-masked]>
Date: Fri, 28 Sep 2007 09:03:18 +1000

> who build residential equipment that deals with DNS...
 
	Which just means we should use DNAME more often. :-)

	Start of answer is not 0xc00c with DNAME even using
	compresssion.

	Why do they reverse engineer a freely available published
	specfication?

---

From: Chris Thompson <[email-masked]>
Date: Fri, 28 Sep 2007 00:30:33 +0100 (BST)

> 	Why do they reverse engineer a freely available published

Mit der Dummheit kämpfen Götter selbst vergebens.
(c) Friedrich von Schiller (1801)

But maybe the question was rhetorical ... :-)

-- 
Chris Thompson
Email: [email-masked]