Subject: [DNSOP] (no subject)

From: Warren Kumari <[email-masked]>
Date: Fri, 11 Apr 2014 17:12:36 -0400

Hi there all,

At the moment this document says that the child SHOULD remove the
CDS/CDNSKEY record once the parent has consumed / acted on it (this
behavior was requested by someone -- unfortunately I cannot remember
whom).

I *think* that I'm hearing that folk would prefer that the child
SHOULD leave it in, or, less strongly MAY remove it.

This (IMO) makes the doc and the child's life simpler, but potentially
makes a bit more work for the parent -- currently most of the
time the parent will see no CDS, and so will go back to sleep. If the
child leaves them around, the parent will need to check them against
what is currently published and take action if they differ.

Can folk please let us know if they would prefer:
A: The child SHOULD remove the CDS/CDNSKEY RR from the zone once the
parent has published it (currently documented behavior) or

B: The child SHOULD NOT remove the CDS/CDNSKEY RR (will require a
small edit to the doc)

My personal preference is for B - it seems more elegant, but (as
always) we'll do whatever the WG wants.

W

---

From: Patrik Fältström <[email-masked]>
Date: Sat, 12 Apr 2014 09:27:32 +0200

> always) we'll do whatever the WG wants.

Let me try to explain in a neutral way what I see as an issue:

As I am one of the persons that have rised the issue that we must be extremely clear on what we thing is ok here, let me explain the situation I am looking at, and that is how things work when child want to do a key rollover. I.e. child has for example DS foo and want to swap to DS bar. This implies having CDS for foo ate some point in time, CDS for foo and bar at some interval and then CDS for bar at some point in time. I.e. both add bar and remove foo.

This is, I think -- but can be wrong, much easier if CDS foo is in the zone all the time DS for foo is to be valid, and then CDS for bar is in the zone as long as the DS for bar is to be valid. Example below is for CDS because it is shorter to type, but can be valid for CDNSKEY as well of course (and yes, Antoine has convinced me as well that DNSKEY is the path forward...;-) ).

The argument for me is that if CDS is removed, then we have:

1. Add DS foo
1.1. Add CDS foo
1.2. Remove CDS foo

2. Add DS bar and remove DS foo
1.2. Add CDS foo
2.2. Add CDS bar
2.3. Remove CDS foo
2.4. Remove CDS bar

I am here nervous over the parent detecting 2.4 before 2.3, and the wrong DS is removed. Note that the last DS is never removed if the last CDS is removed from the zone. And the parent still must detect when CDS foo is added that that is already in the parent zone, and no action is needed.

If the CDS stays in the zone, we have:

1. Add DS foo
1.1 Add CDS foo

2. Add DS bar and remove DS foo
2.1. Add CDS bar
2.2 Remove CDS foo

So I am in favor of B.

   Patrik

---

From: Antoin Verschuren <[email-masked]>
Date: Mon, 14 Apr 2014 10:04:33 +0200

op 11-04-14 23:12, Warren Kumari schreef:
> 
> Can folk please let us know if they would prefer: A: The child
> SHOULD remove the CDS/CDNSKEY RR from the zone once the parent has
> published it (currently documented behavior) or
> 

I can remember the arguments against leaving them in the zone. They were:

- -Leaving them in the zone makes the zone larger for a longer period of
time, consuming more memory and bandwith for master-slave transfers. I
think this is only minor, but it is an argument.

- -Zones that do not support CDNSKEY/CDS don't have those records in the
zone as well, so a provision by the server what to do in absence of
the records should be made anyway for backward compatibility.

- -If a zone is transfered to an operator not (yet) supporting
CDNSKEY/CDS, what's the procedure for removing the records from the
zone if they were compulsary?

That's why we concluded that it was not compulsory to leave them in
the zone, or even have them in the zone, but no harm should be done if
people left them in the zone.

I think the current text assumes people should allways remove the
records. That I think is wrong. The text should say:

- -It's ok to leave the records in the zone.

- -It's also ok to take the records out of the zone, but if you do so,
please follow these rules about the order to take them out: State rules.

Because the procedure HOW to take the records out consumes more text,
it looks like that's the standard procedure, but it isn't. That should
be made more clear. Both leaving them in and taking them out are ok
with me. So the text I would go with would be:

C: The child MAY remove the CDS/CDNSKEY RR from the zone once the
parent has published it, and this is how to do that safely.

- -- 
Antoin Verschuren

Technical Policy Advisor SIDN
Meander 501, PO Box 5022, 6802 EA Arnhem, The Netherlands

P: +31 26 3525500  M: +31 6 23368970
Mailto: [email-masked]
XMPP: [email-masked]
HTTP://www.sidn.nl/