Subject: DS mini-workshop results

From: Sam Weiler <[email-masked]>
Date: Mon, 15 Jul 2002 21:08:24 -0400 (EDT)

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

A small DS workshop was held in Rockville on Wednesday, July 3, 2002.
Our main goal was to try to identify any showstopper bugs in Nominum's
code prior to holding a larger workshop.  Attendees included Russ
Mundy, Sam Weiler, Scott Rose, Ed Lewis, Wes Griffin, Andy Vaskys,
Olafur Gudmundsson, Roger Hartmuller, Lindy Foster, Tom Newell, and
Rip Loomis.

Quick summary: Nominum's and Olafur's authoritative servers worked and
interoperated, to the extent of our testing.  There were bugs in
Nominum's recursive resolver, but basic cases generally worked as
expected.  I've listed some of the issues raised.  Bug reports have
been passed back to Nominum, and a more detailed report may be
available later.

Item 1:  TTLs v. SIG lifetimes.  If the SIG on an RRset expires sooner
than its TTL, what should the TTL for the cached RRset be?  Someone
(Ed?) proposed that the TTL should be the minimum of: the TTL on the
incoming RR, the original TTL in the SIG, or the remaining time on the
SIG.

Item 2:  TTLs in chains.  If you set the TTL to the smallest remaining
TTL of all the RRs needed to validate an RRset, then you're restricted
to the shortest of the parents' (including the root's) timeouts.
Delegations can't set longer timeouts, and, worse, everything under
.com will time out at once, pounding the nameservers.  Perhaps the TTL
should be set to that minimum less some random amount.

Item 3:  Erroneous AA bits with CNAMES.  Assume islands of trust, with
a CNAME in one and the associated A in another.  Query for the
(non-existent) A at the first zone.  With no DNSSEC checking enabled,
asking a recursive server that's also authoritative for the CNAME zone
returns BOTH CNAME and A and sets AA.  With DNSSEC, also get AA.  In
the first case, you're not AA for the A record.  In the second, you
should be saying AD for the A record, not AA.  Asking a recursive only
server with only the first zone's key configured gives neither AA nor
AD.  (perhaps correct) If both keys are configured, you get AD.
(correct)

Item 4:  When DS records or KEYs changed, recursive resolvers that had
cached the old records still answered, but gave no AD.  Why the
change?  Shouldn't they still give out ADs until the cache expires?

Item 5:  Unexplained and inconsistent SERVFAILs asking for DS records
from recursive servers, especially when testing islands of trust (see
below).

Some things tested:
DS delegations
key rollover
AXFR
islands of trust:
          [ signed ]
                \
                [ signed ]
                /         \
      [ unsigned ]        [ signed ]
        /
    [ signed ]
        /
  [ signed ]

Not tested:
deep DS delegations
TSIG

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Conrad <[email-masked]>
Date: Tue, 16 Jul 2002 10:36:40 +0900

Not to be too pedantic, but in a recent message on namedroppers regarding
RFC 1886 interoperability testing, the following was stated:

>> 1) The data is most peculiar since nowhere that I could find are X, Y and Z
>> identified.  If they are somewhere I couldn't find it. Is there a reason
>> to keep them obscured?
> This is standard procedure in DNSEXT interop testing and reporting.

Yet, Nominum gets identified in DS testing:

On 7/16/02 10:08 AM, "Sam Weiler" <[email-masked]> wrote:
> expected.  

Might I suggest a bit of consistency here?  I'm very much in favor of
interop testing, but I'd prefer to avoid the hassle of defending our
participation in informal interop events to my marketing/pr folks.

Tnx,
-drc

---

From: Randy Bush <[email-masked]>
Date: Tue, 16 Jul 2002 11:40:32 +0900

the ietf, itself, does not do interop testing.  we do solicit and file
interop testing reports.  we ask that those reports anonymize the
implementations.

randy