Subject: [dnsext] dnssec-bis-updates item about CNAME

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Mon, 26 Apr 2010 14:06:01 +0200

Hi,

After a discussion with Ondrej about CNAME+DNAME, I realized that there
may be an omission in the dnssec spec about CNAME and other metadata.

The issue is easy to explain with this example.  The domain name has
CNAME and NSEC at the name.  Recursor A connects to an upstream cache B
that connects to the rest of the internet.  Recursor A has to resolve
qtype=NSEC.  Cache B has the CNAME in cache, it picks up the CNAME,
follows it and returns the wrong NSEC answer.  It validates because the
CNAME and cname-target NSEC verify.

(quick authority sketch: NSEC3 signed zone, qtype=NSEC, follows a CNAME
and returns the NSEC3 record for the wrong name.).

The text is: There is a set of metadata types that are allowed next to
CNAMEs, this set contains NSEC, RRSIG and NSEC3 (reference RFC403x,
5155).  For queries for types in this set, a server MUST NOT follow a
CNAME if that is present.

More text is: For a validation proof a CNAME is not allowed when
constructing a proof if the query type is in the set of metadata types
allowed next to CNAMEs.

Best regards,
   Wouter

---

From: Paul Vixie <[email-masked]>
Date: Mon, 26 Apr 2010 14:02:33 +0000

> Date: Mon, 26 Apr 2010 14:06:01 +0200
> From: "W.C.A. Wijngaards" <[email-masked]>
> ...

to me this is more evidence that we got DNSSEC wrong in as far as placement
of our metadata.  had we put OWNER(m) at BASENAME(x)."_DNSSEC_Z".DIRNAME(x)
for m in NSEC NSEC3 RRSIG DNSKEY, and OWNER(m) at BASENAME(x)."_DNSSEC_P".
DIRNAME(x) for m in DS, and required that "._DNSSEC_Z" and ".DNSSEC_P" be
in-zone (never delegation points) then there would be no CNAME collocation
fuzz nor NS/DS collocation fuzz, and dnssec metadata would be subject to
normal queries, and we could make stub validators work.  i realize that
it's too late to change this, so this is not a proposal.  "just saying."

---

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Mon, 26 Apr 2010 17:12:07 +0200

Hi George,

On 04/26/2010 03:54 PM, George Barwood wrote:
> I agree the standard does not appear to specify the response to NSEC and RRSIG
> queries where there is a CNAME, as per my earlier message
> 
> http://ops.ietf.org/lists/namedroppers/namedroppers.2010/msg01165.html

Yes, my email is a rewording of the trouble you saw there, and
dnssec-bis-updates could be a good place to document it.

Best regards,
   Wouter

---

From: Edward Lewis <[email-masked]>
Date: Mon, 26 Apr 2010 11:48:56 -0400

This impacts RFC 4592, section 3.3.3:

# 3.3.3.  Type Matching
...
#   The change is to add the following text to part 'c' prior to the
#   instructions to "go to step 6":
#
#       If the data at the source of synthesis is a CNAME, and QTYPE
#       doesn't match CNAME, copy the CNAME RR into the answer section of
#       the response changing the owner name to the QNAME, change QNAME to
#       the canonical name in the CNAME RR, and go back to step 1.

At 14:06 +0200 4/26/10, W.C.A. Wijngaards wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hi,
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.9 (GNU/Linux)
>Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
>iEYEARECAAYFAkvVgakACgkQkDLqNwOhpPj9wgCcCBk5GLp/UrFIyRUVv5rBgNUI
>70gAn0ctI96VVdQ7+lFBB3dqK6akE91p
>=cUJ9
>-----END PGP SIGNATURE-----

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

Wouldn't it be nice if all of the definitions of equivalence were the same?

---

From: Ondřej Surý <[email-masked]>
Date: Tue, 27 Apr 2010 15:51:53 +0200

> may be an omission in the dnssec spec about CNAME and other metadata.

Just adding that this applies to BNAME as well (since it acts as CNAME 
for the owner)

Ondrej
-- 
  Ondřej Surý
  vedoucí výzkumu/R&D manager
  -------------------------------------------
  CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
  Americka 23, 120 00 Praha 2, Czech Republic
  mailto:[email-masked]    http://nic.cz/
  tel:+420.222745110       fax:+420.222745112
  -------------------------------------------