Subject: nsec target restrictions

From: Paul Vixie <[email-masked]>
Date: Fri, 13 Feb 2004 06:20:00 +0000

in the current -bis docset, nsec asserts a range of nonexistence beginning
after its owner name and ending before its target name.  implementors are
thus free to syntax-check incoming nsec rr's requiring (target > owner).

however, there appears to be no other restriction on the target ("ending")
name.  it doesn't have to be in-zone, or even in-ballywick.  this doesn't
harm the current validator in any way i can see, but it seems sloppy.

if the nsec target name isn't in-ballywick for the nsec owner's zone apex,
then it should be a syntax error and should cause failure to be signalled
at zone loading time, and it should cause the nsec to be unusable for
validation if some server decides to hand it out anyway.

"ISC.ORG NSEC ... PBS.ORG" is unacceptable, unless ORG is the apex and both
ISC and PBS are in-zone data for ORG.  similarly "ISC.ORG NSEC ... ORG" or
"ISC.ORG NSEC ... ." or "ISC.ORG NSEC ... VIX.COM".

it is not possible to syntax-check the subzone case, for example if DV.ISC.ORG
is a zone cut and "ISC.ORG NSEC ... WWW.DV.ISC.ORG" is seen -- simply because
the existence of the DV.ISC.ORG zone cut doesn't have to be known if present,
whereas the existence of an ISC.ORG zone cut does have to be known if present.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>