Subject: [DNSOP] Mandated order of CNAME records in a CNAME chain?

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 29 Sep 2016 14:35:32 +0200

On Thu, Sep 29, 2016 at 08:17:28AM +0000,
 Viktor Dukhovni <[email-masked]> wrote 
 a message of 57 lines which said:

> By the way, is it the case that CNAMEs in the answer section MUST
> appear in their natural chaining order:

Very good question but, IMHO, it is thread-stealing (hence changing
the subject, and removing thread headers).

> irrelevant CNAME responses that are even part of the chain, ...

You mean _not_ even part of the chain?

> Or put another way, does step "3 a" of Section 4.3.2 of RFC 1034
> imply

This algorithm seems to be for a resolver querying authoritative
servers, and therefore does not address your issue (which is for a
final client).

---

From: Robert Edmonds <[email-masked]>
Date: Thu, 29 Sep 2016 09:03:33 -0400

> the subject, and removing thread headers).

I think there was already a thread on this topic recently on this list
("Order of CNAME and A in Authoritative Reply" from August 2015). There
was some discussion over "adding" versus "appending" and it was pointed
out that a lot of existing code (e.g., the BSD stub resolver) was
written using the "add at the end" meaning.

-- 
Robert Edmonds

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 30 Sep 2016 05:44:51 +0000

> written using the "add at the end" meaning.

Right you are, and it seems I even participated in that discussion,
though it has entirely faded from memory.  All that said, it seems
to me that no conclusion was arrived at in that 2015 thread.

I'm inclined to conclude (as suggested off-list) that, while it
may be prudent to parse conservatively, and not make ordering
assumptions, in fact less tolerant stub resolvers are sufficiently
common and so one would likely get away with assuming natural
ordering.  So perhaps doing it right is not entirely overkill...

-- 
	Viktor.

---

From: "John Levine" <[email-masked]>
Date: 30 Sep 2016 16:24:41 -0000

>ordering.  So perhaps doing it right is not entirely overkill...

This strikes me as an obvious place to apply the hoary robustness
principle.  It's not very expensive to do a topological sort of
the CNAMEs at each end in case the other end didn't or won't.

R's,
John