Subject: Re: [dnsext] Danger of coming unstuck

From: Francis Dupont <[email-masked]>
Date: Tue, 23 Jun 2009 15:21:53 +0200

In your previous mail you wrote:

   >   Possible fixes:
   >   
   >   (1) Set the reply as truncated
   > 
   > => this is what the standard recommends
   
   Umm.. I don't think so.

=> note the glue here is a required glue (NS RRs are "below"). IMHO the
issue is a conflict between required glue and required DNSSEC (with
the 1220 enforced size for DO this should be less common).

   AFAIK glue that doesn't fit is always discarded silently ( without
  setting TC bit ).

=> yes but it is not true for the whole required glue. Of course it
is easy to find cases where the glue is not required but is necessary
(so your problem needs a solution anyway).

   Certainly my example seems to show this is also what happens in practice.
   I'm not aware of any provision that makes the last bit of glue special.
   Please give me RFC and section...
   
=> there is a notion of required glue in RFC 1035.

   >   (2) Discard some non-authoritative NS records, so a mixture of NS
   > records and glue can be sent.
   > 
   > => if this means a partial RRset this is not (yet) allowed
   
   Yes.
   I don't see much harm sending partial RRsets where they are not
  authoritative though.
   But that could be wrong.
    
=> you have to explain how partial RRsets make sense with DNSSEC too.

   >   (3) Respond to explicit requests for an A record, where the
   > non-authoritative value is held as glue, with a non-authoritative
   > answer.
   > 
   > => IMHO this doesn't fit in the authoritative vs caching servers model.
   > And of course you can't send the query to an authoritative server if
   > you don't know an address of one of them (:-).
   
=> to summary: either the answering server is an authoritative server (and
BTW the NS RRset in the referral is authoritative too), or it is a
caching/recursive server (and the reponse is non-authoritative and matches
the query, i.e., has a NS RRset only if the query type is NS).

   Umm.. don't understand you here. I'm saying the parent authoritative
   server responds to a request for a "necessary" glue A record with the value.

=> necessary or required? the second one is defined, the first one is
more useful but there is no easy criterion to recognize it.

   Currently servers always give the same referral (for a given child zone),
   regardless of the question ( at least this seems the most common response 
   - not sure if the standard is explicit here ).
    
=> the standard defines what is a referral.

[email-masked]

PS: in conclusion if the DNSSEC stuff doesn't fit in the referral the TC
flag should be set, if the required glue doesn't fit in the referral the
TC flag should be set, if the server is caching/recursive the response
is not a referral and the TC will be set if there is no enough space.

The remaining case is for necessary but not required glue in a referral.
Note your example is not in this case.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Wed, 24 Jun 2009 00:32:18 +1000

In message <[email-masked]>, Francis Dupont write
> is not a referral and the TC will be set if there is no enough space.

For the record named already does this.

1804.   [bug]           Ensure that if we are queried for glue that it fits
                        in the additional section or TC is set to tell the
                        client to retry using TCP. [RT #10114]

BIND 9.2.6, 9.3.2, 9.4.0

Note: this does not help for the case of sibling glue.  An argument
could be made that you should never drop glue (manditory or sibling)
and TC should be set if you need to for a referral.

Glue is much more complicated than RFC 1034 would lead you to
believe.  RFC 1034 is clearly wrong when it says the only required
glue is that which is below the delegation.

Mark

manditory: glue from beneath the delegation
sibling: glue from beneath a sibling delegation
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]