Subject: [dnsext] [Editorial Errata Reported] RFC6672 (5297)

From: RFC Errata System <[email-masked]>
Date: Fri, 23 Mar 2018 08:24:54 -0700 (PDT)

The following errata report has been submitted for RFC6672,
"DNAME Redirection in the DNS".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5297

--------------------------------------
Type: Editorial
Reported by: Pieter Lexis <[email-masked]>

Section: 5.3.4.1

Original Text
-------------
   ;; Header: QR AA RCODE=3(NXDOMAIN)
   ;; OPT PSEUDOSECTION:
   ; EDNS: version: 0, flags: do; udp: 4096

   ;; Question
   foo.bar.example.com. IN A
   ;; Authority
   bar.example.com. NSEC dub.example.com. A DNAME 
   bar.example.com. RRSIG NSEC [valid signature]

Corrected Text
--------------
   ;; Header: QR AA RCODE=3(NXDOMAIN)
   ;; OPT PSEUDOSECTION:
   ; EDNS: version: 0, flags: do; udp: 4096

   ;; Question
   foo.bar.example.com. IN A
   ;; Authority
   bar.example.com. NSEC dub.example.com. A DNAME RRSIG NSEC
   bar.example.com. RRSIG NSEC [valid signature]

Notes
-----
The NSEC record in the original text would in no case be valid as it denies it's own existence and the existence of the RRSIG, while the text indicates that " the validator can see that it is a  BOGUS reply from an attacker that collated existing records from the DNS to create a confusing reply". This indicates that NSEC and RRSIG should be set in the NSEC bitmap

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6672 (draft-ietf-dnsext-rfc2672bis-dname-26)
--------------------------------------
Title               : DNAME Redirection in the DNS
Publication Date    : June 2012
Author(s)           : S. Rose, W. Wijngaards
Category            : PROPOSED STANDARD
Source              : DNS Extensions
Area                : Internet
Stream              : IETF
Verifying Party     : IESG

---

From: Warren Kumari <[email-masked]>
Date: Fri, 23 Mar 2018 15:27:30 +0000

[ - RFC Editor for clutter ]

This *seems* correct to me, but my brain turned into jelly much
earlier in the week -- anyone disagree with the errata?

W

On Fri, Mar 23, 2018 at 3:24 PM, RFC Errata System
<[email-masked]> wrote:
> _______________________________________________
> dnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsext

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Fri, 23 Mar 2018 16:43:35 +0100

Hi,

Seems fine to me too.  Also Pieter's (5298) which is also about missing
out on the NSEC and RRSIG bits.  They aren't actually the focus, which
is why no-one missed them I guess (together with all the omitted RRSIG
fields?), but adding NSEC and RRSIG bits is correct for a signed zone.

Best regards, Wouter

---

From: "Rose, Scott" <[email-masked]>
Date: Fri, 23 Mar 2018 13:49:31 -0400

I agree with Wouter.  It is technically correct* this way.  The same 
goes with the other errata (5298).  They both should be approved, IMHO.

Scott
*The Best Kind of Correct

On 23 Mar 2018, at 11:43, W.C.A. Wijngaards wrote:

>>> The NSEC record in the original text would in no case be valid as it 
>>> denies it's own existence and the existence of the RRSIG, while the 
>>> text indicates that " the validator can see that it is a  BOGUS 
>>> reply from an attacker that collated existing records from the DNS 
>>> to create a confusing reply". This indicates that NSEC and RRSIG 
>>> should be set in the NSEC bitmap
>>>
>>> Instructions:
>>> -------------

===================================
Scott Rose
NIST ITL
[email-masked]
+1-301-975-8439
GV: +1-571-249-3671
===================================