Subject: direct query for NSEC

From: Miek Gieben <[email-masked]>
Date: Thu, 15 Jan 2004 11:41:45 +0100

Hello,

When doing some early testing with NSD2 and BIND9.4, we came across the
following. Both nameserver were loaded with the example. zone from protocol-04.
a.example is delegated in that zonem

dig @nsd-server nsec a.example

we get a referral to a.example, not the nsec. We feel this is ok.

dig @bind-server nsec a.example

we get the nsec from the a.example zone. One can argue this is also correct. But
what happens when the server is also authoritative the a.example (as a child
zone), which nsec do we get? Both?

In good old rfc2535 it says:

5.5 Special Considerations at Delegation Points

   A name (other than root) which is the head of a zone also appears as
   the leaf in a superzone.  If both are secure, there will always be
   two different NXT RRs with the same name.  They can be easily
   distinguished by their signers, the next domain name fields, the
   presence of the SOA type bit, etc.  Security aware servers should
   return the correct NXT automatically when required to authenticate
   the non-existence of a name and both NXTs, if available, on explicit
   query for type NXT.
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   
   ..... deleted the rest of the paragraph ....

I'm not really parsing this, but "...and both NXTs, if available, on
explicit..." ... so a server authoritative for both example. and a.example
should give them both back?

I cannot find this in the current protocol draft. The inclusion of NSEC (section
3.3) records only says how to deal with them when including them in a nxdomain
(and other) responses. Not what to do when directly queried for NSEC.

My feeling is that 2535 makes the nsec record (in this respect) as weird
as the DS record. We need to add extra logic to NSD to give back both
the NSECs. And this logic is _very_ simular to the DS logic...

Is this under specified?

Regards,
Miek

--
GPG fingerprint: miek.nl/about.html

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>