Subject: [dnsext] does C+D fail in current resolver?

From: "Yao Jiankang" <[email-masked]>
Date: Sat, 21 Aug 2010 09:52:35 +0800

based on the paul's closed code,

I have a feeling that C+D will fail in some current resolvers.

for example:

in the zone, you set

a.example cname a.test
a.example dname a.test

now you query a.example,

the resolver can get the result "a.example cname a.test" and cache it.
then, you query a.a.example, and get the result and cache them:

"a.a.example cname a.a.test
a.example dname a.test"

finally,

the cache will have 
the following RRs before the time out:
"
a.example cname a.test
a.a.example cname a.a.test
a.example dname a.test
"

so according to the closed code provided by Paul,

eithor cname or dname will not be resolved correctly.

if you want to make c+d to work correctly, signaling is a MUST even if the resolver is non-dnssec resolver.

Jiankang Yao

>In message <[email-masked]>, Paul Vixie writes:
> the following code exists in a deployed (commercial, closed-source)
> recursive dns server.  (which i wrote during a sabbatical in 2003.)
> 
> 	...
> 
> 	/* Cache error means there can't be a CNAME.  This happens
> 	 * when we have no root hints at all.
> 	 */
> 	if (dom == NULL)
> 	        break;
> 
> 	/* If QTYPE is CNAME then return it rather than following it.
> 	 */
> 	if (qtype == ns_t_cname)
> 	        break;
> 
> 	/* If there's no CNAME in cache but there's any other type
> 	 * (unexpired), then there cannot be a CNAME and we're done.
> 	 * Note: this is an optimization to avoid dns_cache_findtype.
> 	 */
> 	anytype = (dns_cache_anytype(dom, now.tv_sec) != NULL);
> 	if ((dns_dom_getflags(dom) & DNS_DOM_ISALIAS) == 0 &&
> 	    anytype)
> 	        break;
> 
> 	/* Handle CNAME (if it exists) chaining. */
> 	switch (dns_cache_findtype(dc, dom, qclass, ns_t_cname,
> 				   FALSE, &rrset, now.tv_sec))
> 	{
> 		...

---

From: Ondřej Surý <[email-masked]>
Date: Wed, 25 Aug 2010 14:53:31 +0200

On 21.8.2010 03:52, Yao Jiankang wrote:
> either cname or dname will not be resolved correctly.

Yes, and I thought we already agreed on that.

The draft on signaling is in:  draft-sury-dnsext-cname-at-apex-00

It's very rough at the edges, uses incorrect RFCs etc., I'll publish 
better version soon, but you can get the basic idea.

Ondrej
-- 
  Ondřej Surý
  vedoucí výzkumu/Head of R&D department
  -------------------------------------------
  CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
  Americka 23, 120 00 Praha 2, Czech Republic
  mailto:[email-masked]    http://nic.cz/
  tel:+420.222745110       fax:+420.222745112
  -------------------------------------------