Re: [dnsext] [Editorial Errata Reported] RFC6672 (5297)

Hi,

Seems fine to me too.  Also Pieter's (5298) which is also about missing
out on the NSEC and RRSIG bits.  They aren't actually the focus, which
is why no-one missed them I guess (together with all the omitted RRSIG
fields?), but adding NSEC and RRSIG bits is correct for a signed zone.

Best regards, Wouter

On 23/03/18 16:27, Warren Kumari wrote:
> [ - RFC Editor for clutter ]
> 
> This *seems* correct to me, but my brain turned into jelly much
> earlier in the week -- anyone disagree with the errata?
> 
> W
> 
> On Fri, Mar 23, 2018 at 3:24 PM, RFC Errata System
> <rfc-editor@rfc-editor.org> wrote:
>> The following errata report has been submitted for RFC6672,
>> "DNAME Redirection in the DNS".
>>
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata/eid5297
>>
>> --------------------------------------
>> Type: Editorial
>> Reported by: Pieter Lexis <pieter.lexis@powerdns.com>
>>
>> Section: 5.3.4.1
>>
>> Original Text
>> -------------
>>    ;; Header: QR AA RCODE=3(NXDOMAIN)
>>    ;; OPT PSEUDOSECTION:
>>    ; EDNS: version: 0, flags: do; udp: 4096
>>
>>    ;; Question
>>    foo.bar.example.com. IN A
>>    ;; Authority
>>    bar.example.com. NSEC dub.example.com. A DNAME
>>    bar.example.com. RRSIG NSEC [valid signature]
>>
>> Corrected Text
>> --------------
>>    ;; Header: QR AA RCODE=3(NXDOMAIN)
>>    ;; OPT PSEUDOSECTION:
>>    ; EDNS: version: 0, flags: do; udp: 4096
>>
>>    ;; Question
>>    foo.bar.example.com. IN A
>>    ;; Authority
>>    bar.example.com. NSEC dub.example.com. A DNAME RRSIG NSEC
>>    bar.example.com. RRSIG NSEC [valid signature]
>>
>> Notes
>> -----
>> The NSEC record in the original text would in no case be valid as it denies it's own existence and the existence of the RRSIG, while the text indicates that " the validator can see that it is a  BOGUS reply from an attacker that collated existing records from the DNS to create a confusing reply". This indicates that NSEC and RRSIG should be set in the NSEC bitmap
>>
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party
>> can log in to change the status and edit the report, if necessary.
>>
>> --------------------------------------
>> RFC6672 (draft-ietf-dnsext-rfc2672bis-dname-26)
>> --------------------------------------
>> Title               : DNAME Redirection in the DNS
>> Publication Date    : June 2012
>> Author(s)           : S. Rose, W. Wijngaards
>> Category            : PROPOSED STANDARD
>> Source              : DNS Extensions
>> Area                : Internet
>> Stream              : IETF
>> Verifying Party     : IESG
>>
>> _______________________________________________
>> dnsext mailing list
>> dnsext@ietf.org
>> https://www.ietf.org/mailman/listinfo/dnsext
> 
> 
> 

Re: [dnsext] [Editorial Errata Reported] RFC6672 (5297)

Attachment: signature.asc