Thu 20 Jan 2011 09:29:29 AM UTC, original submission:
The test for EDNS capabilities (necessary for DNSSEC) tests that the requested server sends back an EDNS packet and has a "payload size" >= 1024, regarded as the minimum value to do DNSSEC seriously (even if not mandated by the RFC).
But this comes from the expectation that the "payload size" indicates the maximum size the authoritative server can send. It does not seem true. RFC 2671, section 4.5, says that the "payload size" is the maximum you can receive, not the maximum you can send.
A typical example: as of today, Zonecheck cannot validate .NET:
,-------------.|
~~~~ | fatal || ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
`-------------'
f> does not support EDNS
=> k.gtld-servers.net/192.52.178.30
Because .NET name servers reply with a payload size of 512, despite the fact they can send the large DNSSEC responses:
% dig +dnssec @k.gtld-servers.net DNSKEY net.
; <<>> DiG 9.7.2-P3 <<>> +dnssec @k.gtld-servers.net DNSKEY net.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22203
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;net. IN DNSKEY
...
;; Query time: 20 msec
;; SERVER: 192.52.178.30#53(192.52.178.30)
;; WHEN: Thu Jan 20 10:25:40 2011
;; MSG SIZE rcvd: 889
So, the code in dnssec.rb:
def chk_edns(ns, ip)
...
return true if add.type == "OPT" && add.payloadsize > 1024
seems false.
|