Subject: [DNSOP] RFC 2136 pre-requisite checks before client authorization checks

From: Mukund Sivaraman <[email-masked]>
Date: Thu, 6 Dec 2018 20:15:04 +0530

Hi all

Does anyone know why RFC 2136 sequences pre-requisite checks (section
3.2) to be performed before client permission checks (section 3.3)?  It
seems weird to sequence them in this way, especially as it is cheaper to
perform client IP address checks (and some zone permission checks)
earlier in order.

Section 3.3.2 talks about why the client permissions check is in that
position previous to subsequent actions, but not why it can't be
performed earlier.

		Mukund

---

From: Ted Lemon <[email-masked]>
Date: Thu, 6 Dec 2018 07:16:50 -0800

Possibly because signature verification is thought to be expensive?

On Thu, Dec 6, 2018 at 6:45 AM Mukund Sivaraman <[email-masked]> wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: p vixie <[email-masked]>
Date: Thu, 6 Dec 2018 16:29:13 +0100 (GMT+01:00)

It's an error in the specification.

---

From: Mukund Sivaraman <[email-masked]>
Date: Fri, 7 Dec 2018 00:11:49 +0530

> It's an error in the specification.

Thank you Paul. That clears it. I asked because BIND follows the RFC to
the letter, and an admin may see some log messages that are unexpected
for an address that's not in the update ACL.

		Mukund

---

From: Chris Thompson <[email-masked]>
Date: 07 Dec 2018 14:37:31 +0000

>for an address that's not in the update ACL.

This is actually a (long-standing, if rather mild) security exposure.
By distinguishing the error codes returned for suitably crafted update
operations, a client not authorised to even query a zone can determine
the existence or otherwise of names, RRsets, and even specific RRs with
guessed rdata, within it.

-- 
Chris Thompson
Email: [email-masked]

---

From: Mukund Sivaraman <[email-masked]>
Date: Fri, 7 Dec 2018 20:26:11 +0530

> guessed rdata, within it.

IIRC BIND checks if a client can query the zone before it proceeds with
the update algorithm. Don't know about other implementations.

		Mukund