Subject: [dnsext] rfc2672-dname-bis: NXDOMAIN rcode question

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Thu, 12 Aug 2010 16:51:36 +0200

Hi,

The wg wanted the following taken to the mailing list at IETF78.  The
question is about the (NXDOMAIN) rcode after chasing a CNAME (or DNAME).

The spec, rfc1034, currently indicates that recursors return NXDOMAIN in
such a case, and that authority servers return NOERROR.

Is there a change to dname-bis to be made for this?

The discussion does not seem to be very adamant (there were comments
heard from the audience that only protocol purists would care about
this).  Once resolved, the WG chairs intend to resume WGLC.

Best regards,
   Wouter

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 12 Aug 2010 11:06:46 -0400

> this).  Once resolved, the WG chairs intend to resume WGLC.

Speaking as chair, I'll note that if this WG isn't going to be the
source of protocol purists, we maybe ought to think about giving up
the claim that we're where DNS protocol review happens.  There's
nothing wrong with being precise about the protocol.  Also, if we
think that this is a place that the protocol is simply undefined, we
can state that.  (No hat, however, I'll say that I think it would be a
bad idea to say that.)

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Paul Vixie <[email-masked]>
Date: Thu, 12 Aug 2010 15:38:18 +0000

> Date: Thu, 12 Aug 2010 16:51:36 +0200
> From: "W.C.A. Wijngaards" <[email-masked]>
> 

i think "no change".  not just "no change is needed" but "any change would
be bad".

---

From: Donald Eastlake <[email-masked]>
Date: Thu, 12 Aug 2010 12:16:27 -0400

So why don't we just adopt
https://datatracker.ietf.org/doc/draft-eastlake-dnsext-xnamercode/
with option B selected in Section 3. I wrote this so we could nail this
down.

Thanks,
Donald

---

From: Paul Vixie <[email-masked]>
Date: Thu, 12 Aug 2010 16:40:54 +0000

> Date: Thu, 12 Aug 2010 12:16:27 -0400
> From: Donald Eastlake <[email-masked]>
> 

that doesn't (yet?) describe the difference between RD=1 (where the rcode
is final and definitive) vs. RD=0,AA=1 where the rcode is only definitive
if ANCOUNT<>0 and the final name is in-bailiwick.

---

From: "Rose, Scott W." <[email-masked]>
Date: Fri, 13 Aug 2010 13:26:58 -0400

How about the following:  

When an xNAME chain is followed, all but the last query cycle
   necessarily had no error. The RCODE in the ultimate DNS response MUST
   BE set based on the final query cycle leading to that response as long as the following holds:
	
	* The RD bit is set in the original query     
		 OR
	* The RD bit is not set in the original query AND 
	* The AA bit is set in the response AND
	* The final target name terminating the xNAME chain is in-bailiwick or in another zone for which the zone is authoritative.   AND
	* The Answer section is not empty.

 In other words, if the xNAME chain was terminated by an error, it will be that error
   code. If the xNAME chain terminated without error, it will be zero. If the above conditions do not hold, the error code MUST be zero.
	
/end 

Very rough text, but trying to nail down a solution so we can move forward.  Of course, there is still the option of doing nothing, and letting DNAME-bis advance as is (on this point).

Scott

> if ANCOUNT<>0 and the final name is in-bailiwick.

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
===================================