On 03. 08. 26 18:00, Philip Homburg wrote:
The DE flag really was introduced as a capability negotiation mechanism. Lat
er, it turned out that sending both NS
and DELEG in the referral didnt actually cause interoperability problems (I
believe Shumon and I were the ones who
tested this).
In the other direction, if you have a delegation point with only
DELEG, and you sent a response to an old non-aware resolver with
an authority section that has DELEG and maybe DS and maybe some
RRSIGs, will resolvers ignore the useless (to them) stuff and treat
it as NODATA, or barf because the authority section has garbage?
I have no idea, perhaps people have tried it out.
If the answer is NODATA the case for the DE bit is a lot weaker.
There is a problem with DELEG validation. I don't remember all corner cases,
but DELEG-unaware validating resolvers may conclude bogus if they receive
DELEG records (which they believe is a child-side type) with a parent-side
signature.
In this specific case of it would have validated fine.
Say DELEG-unaware validator faces this response (because we removed the
DE bit):
;; Question
foo.example. IN MX
;; Answer
;; (empty)
;; Authority
example. DELEG server-ipv4=192.0.2.1 server-ipv6=2001:db8::1
example. DELEG server-name=ns2.example.net.,ns3.example.org.
example. RRSIG DELEG 13 1 300 20260101000000 (
20250101000000 33333 . SigExampleDELEG/ )
example. DS 44444 13 2 ABCDEF01234567...
example. RRSIG DS 13 1 300 20260101000000 (
20250101000000 33333 . SigExampleDS )
example. NSEC net. NS DS RRSIG NSEC DELEG
example. RRSIG NSEC 13 1 300 20260101000000 (
20250101000000 33333 . SigExampleNSEC+/ )
It is DELEG-unaware, so DELEG bit in the type bitmap does not 'create'
delegation from validator's point of view. That means the zone the
validator _thinks_ it talks to is root. RRSIG signer field matches the
zone - root - so it will validate fine.
It would have exploded if there was NS bit set in the bitmap and the
validator decided to validate the DELEG RRset for some reason. Validator
must check the signer field and that would not match deepest known zone
cut, and validator would conclude it is bogus. (Again, because it is not
aware of DELEG special properties.)
--
Petr Špaček
_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]
